The CRA reporting clock is running. Generating an SBOM was never the hard part.

说明与用途

欧盟网络弹性法案的合规不仅需要生成SBOM，还需要额外的文档和评估。cra‑kit 将这些步骤整合为单一命令，帮助团队为2027年12月11日的合规截止日期做准备。

问题

Teams must comply with the EU Cyber Resilience Act (CRA) reporting requirements, but generating an SBOM is only the first step; the CRA requires additional documentation and judgments that are not produced by standard SBOM tools.

结果

cra‑kit bridges the gap between SBOM generation and CRA compliance by producing the required documentation and judgments in a single command, enabling teams to prepare for the 11 December 2027 compliance deadline.

工作流

• Run npx @roshcompanylabs/cra-kit ./your-repo
• cra‑kit reads package.json and lockfile
• Generates CycloneDX 1.6 SBOM
• Creates depth justification
• Performs OSV vulnerability lookup with closed‑failure logic
• Drafts vulnerability‑handling + CVD policy with point‑of‑contact
• Lists Article 14 reporting steps
• Drafts Declaration of Conformity
• Outputs Annex I readiness checklist

证据

The part everyone reaches for first is the SBOM, and it is the part that is already solved.

来源

The CRA does not ask for a file. It asks you to use one — and that is the half nobody hands you.

来源

From package.json + the lockfile it produces a CycloneDX 1.6 SBOM and the evidence the free tools don't: the depth justification, an OSV vulnerability match that fails closed...

来源