The CRA reporting clock is running. Generating an SBOM was never the hard part.

Описание и применение

Выполнение требований EU Cyber Resilience Act требует не только генерации SBOM, но и дополнительных документов и оценок. Инструмент cra‑kit объединяет эти шаги в одну команду, создавая SBOM, обоснование глубины, политику обработки уязвимостей и черновик декларации соответствия.

Задача

Teams must comply with the EU Cyber Resilience Act (CRA) reporting requirements, but generating an SBOM is only the first step; the CRA requires additional documentation and judgments that are not produced by standard SBOM tools.

Результат

cra‑kit bridges the gap between SBOM generation and CRA compliance by producing the required documentation and judgments in a single command, enabling teams to prepare for the 11 December 2027 compliance deadline.

Рабочий процесс

• Run npx @roshcompanylabs/cra-kit ./your-repo
• cra‑kit reads package.json and lockfile
• Generates CycloneDX 1.6 SBOM
• Creates depth justification
• Performs OSV vulnerability lookup with closed‑failure logic
• Drafts vulnerability‑handling + CVD policy with point‑of‑contact
• Lists Article 14 reporting steps
• Drafts Declaration of Conformity
• Outputs Annex I readiness checklist

Доказательства

The part everyone reaches for first is the SBOM, and it is the part that is already solved.

Источник

The CRA does not ask for a file. It asks you to use one — and that is the half nobody hands you.

Источник

From package.json + the lockfile it produces a CycloneDX 1.6 SBOM and the evidence the free tools don't: the depth justification, an OSV vulnerability match that fails closed...

Источник