The CRA reporting clock is running. Generating an SBOM was never the hard part.

Description and use

Compliance with the EU Cyber Resilience Act requires more than an SBOM; cra‑kit automates the creation of the necessary documentation and judgments in a single command, enabling teams to prepare for the 11 December 2027 deadline.

Problem

Teams must comply with the EU Cyber Resilience Act (CRA) reporting requirements, but generating an SBOM is only the first step; the CRA requires additional documentation and judgments that are not produced by standard SBOM tools.

Outcome

cra‑kit bridges the gap between SBOM generation and CRA compliance by producing the required documentation and judgments in a single command, enabling teams to prepare for the 11 December 2027 compliance deadline.

Workflow

• Run npx @roshcompanylabs/cra-kit ./your-repo
• cra‑kit reads package.json and lockfile
• Generates CycloneDX 1.6 SBOM
• Creates depth justification
• Performs OSV vulnerability lookup with closed‑failure logic
• Drafts vulnerability‑handling + CVD policy with point‑of‑contact
• Lists Article 14 reporting steps
• Drafts Declaration of Conformity
• Outputs Annex I readiness checklist

Evidence

The part everyone reaches for first is the SBOM, and it is the part that is already solved.

Source

The CRA does not ask for a file. It asks you to use one — and that is the half nobody hands you.

Source

From package.json + the lockfile it produces a CycloneDX 1.6 SBOM and the evidence the free tools don't: the depth justification, an OSV vulnerability match that fails closed...

Source