{"guid":"be8d50b2-ef51-5889-9704-b07641b2734d","title":"The CRA: A key to a more resilient FOSS ecosystem","subtitle":null,"slug":"2026-765-the-cra-a-key-to-a-more-resilient-foss-ecosystem","link":"https://talks.mrmcd.net/2026/talk/9LHP77/","description":"With the Cyber Resilience Act FOSS projects are legally on the hook as part of software supply chain ecosystems. In order to address regulatory obligations and foster open collaboration within software supply chain ecosystems best practices, tooling and standards as well as established pathways for public benefit stewardship are needed. The talk will present current work in various Open Source Foundations, the IETF, as well the EU.\n\nVarious supply chain regulations (EO 14028 [1], SSDF [2], SEC Cyber Rule [3], SLSA [4], NTIA [5]) and the currently developing Cyber Resilience Act (CRA) in the EU create obligations [6,7] for both software suppliers and dependents. For the first time, this includes Free and Open Source Software (FOSS) projects, with the CRA introducing the legal concept of the Open Source Software Steward in the EU framework.\n\nThe talk will provide an overview of the work being done to ease the regulatory burden of these regulations on FOSS projects and their dependents (aka manufacturers). This includes:\n\n - Standards to enable compliance-critical communication within software supply chain ecosystems (e.g., the SCITT Working Group at the IETF [8]);\n- Machine-readable information about FOSS projects at the OpenSSF [9];\n- The development of best practices for collaboration between FOSS projects and their dependents (aka manufacturers) under the CRA in the ORC Working Group [10].\n\nAdditionally, the talk will cover the current debate on recognizing public benefit status for the stewardship of Digital Commons (aka \"Gemeinnützigkeit Open Source\"), such as the recent policy paper by the German Association of Computer Scientists [11].\n\n[1] https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity\n[2] https://csrc.nist.gov/projects/ssdf\n[3] https://www.sec.gov/rules-regulations/2023/07/s7-09-22\n[4] https://slsa.dev/\n[5] https://www.ntia.gov/page/information-quality-guidelines\n[6] https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng\n[7] https://digital-strategy.ec.europa.eu/en/factpages/cyber-resilience-act-implementation\n[8] https://datatracker.ietf.org/group/scitt/about/\n[9] https://openssf.org/blog/2026/05/29/aligning-on-machine-readable-signals-as-the-foundation-for-due-diligence/\n[10] https://orcwg.org/\n[11] https://gi.de/fileadmin/GI/Allgemein/PDF/2026-06_GI_Policy_Brief_Anerkennung_und_Besserstellung_von_OSSS.pdf\n\nhttps://creativecommons.org/licenses/by-sa/4.0/","original_language":"eng","persons":["Gregor \"Little Detritus\" Bransky"],"view_count":117,"promoted":false,"date":"2026-09-11T20:20:00.000+02:00","release_date":"2026-09-12T00:00:00.000+02:00","updated_at":"2026-09-18T07:00:03.413+02:00","tags":["9LHP77","2026","mrmcd26","Infrastructure and Software","Freiraum - C120","mrmcd26-eng","Darmstadt","mrmcd26","Day 1"],"length":2724,"duration":2724,"thumb_url":"https://static.media.ccc.de/media/conferences/mrmcd/mrmcd26/765-be8d50b2-ef51-5889-9704-b07641b2734d.jpg","poster_url":"https://static.media.ccc.de/media/conferences/mrmcd/mrmcd26/765-be8d50b2-ef51-5889-9704-b07641b2734d_preview.jpg","timeline_url":"https://static.media.ccc.de/media/conferences/mrmcd/mrmcd26/765-be8d50b2-ef51-5889-9704-b07641b2734d.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/conferences/mrmcd/mrmcd26/765-be8d50b2-ef51-5889-9704-b07641b2734d.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/2026-765-the-cra-a-key-to-a-more-resilient-foss-ecosystem","url":"https://media.ccc.de/public/events/be8d50b2-ef51-5889-9704-b07641b2734d","conference_title":"MRMCD 2026 - Grenzen Überwinden","conference_url":"https://media.ccc.de/public/conferences/mrmcd26","related":[],"recordings":[{"length":2724,"mime_type":"audio/mpeg","language":"eng","filename":"mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_mp3.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2026-09-12T12:15:49.958+02:00","label":"eng","size":42,"recording_url":"https://cdn.media.ccc.de/events/mrmcd/mrmcd26/mp3/mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_mp3.mp3","url":"https://media.ccc.de/public/recordings/104356","event_url":"https://media.ccc.de/public/events/be8d50b2-ef51-5889-9704-b07641b2734d","conference_url":"https://media.ccc.de/public/conferences/mrmcd26"},{"length":2724,"mime_type":"audio/opus","language":"eng","filename":"mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_opus.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2026-09-12T12:15:53.712+02:00","label":"eng","size":25,"recording_url":"https://cdn.media.ccc.de/events/mrmcd/mrmcd26/opus/mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_opus.opus","url":"https://media.ccc.de/public/recordings/104357","event_url":"https://media.ccc.de/public/events/be8d50b2-ef51-5889-9704-b07641b2734d","conference_url":"https://media.ccc.de/public/conferences/mrmcd26"},{"length":2724,"mime_type":"video/mp4","language":"eng","filename":"mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-12T12:15:21.286+02:00","label":"eng 1080p","size":405,"recording_url":"https://cdn.media.ccc.de/events/mrmcd/mrmcd26/h264-hd/mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_hd.mp4","url":"https://media.ccc.de/public/recordings/104353","event_url":"https://media.ccc.de/public/events/be8d50b2-ef51-5889-9704-b07641b2734d","conference_url":"https://media.ccc.de/public/conferences/mrmcd26"},{"length":2724,"mime_type":"video/mp4","language":"eng","filename":"mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-12T12:20:01.034+02:00","label":"eng 576p","size":129,"recording_url":"https://cdn.media.ccc.de/events/mrmcd/mrmcd26/h264-sd/mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_sd.mp4","url":"https://media.ccc.de/public/recordings/104360","event_url":"https://media.ccc.de/public/events/be8d50b2-ef51-5889-9704-b07641b2734d","conference_url":"https://media.ccc.de/public/conferences/mrmcd26"},{"length":2724,"mime_type":"video/webm;codecs=av01","language":"eng","filename":"mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_av1-hd.webm","state":"new","folder":"av1-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-12T12:44:06.505+02:00","label":"eng 1080p","size":338,"recording_url":"https://cdn.media.ccc.de/events/mrmcd/mrmcd26/av1-hd/mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_av1-hd.webm","url":"https://media.ccc.de/public/recordings/104365","event_url":"https://media.ccc.de/public/events/be8d50b2-ef51-5889-9704-b07641b2734d","conference_url":"https://media.ccc.de/public/conferences/mrmcd26"},{"length":2724,"mime_type":"video/webm","language":"eng","filename":"mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-12T14:33:48.683+02:00","label":"eng 576p","size":116,"recording_url":"https://cdn.media.ccc.de/events/mrmcd/mrmcd26/webm-sd/mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_webm-sd.webm","url":"https://media.ccc.de/public/recordings/104397","event_url":"https://media.ccc.de/public/events/be8d50b2-ef51-5889-9704-b07641b2734d","conference_url":"https://media.ccc.de/public/conferences/mrmcd26"},{"length":2724,"mime_type":"video/webm","language":"eng","filename":"mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-12T14:46:58.487+02:00","label":"eng 1080p","size":389,"recording_url":"https://cdn.media.ccc.de/events/mrmcd/mrmcd26/webm-hd/mrmcd26-765-eng-The_CRA_A_key_to_a_more_resilient_FOSS_ecosystem_webm-hd.webm","url":"https://media.ccc.de/public/recordings/104403","event_url":"https://media.ccc.de/public/events/be8d50b2-ef51-5889-9704-b07641b2734d","conference_url":"https://media.ccc.de/public/conferences/mrmcd26"}]}