CRA Evidentiary Kit
Coverage current through v1.29.2 (2026-09-26; reporting duties live since 2026-09-11 — see the reporting runbook).
v1.20.10 “Proof” — an assembly of already-shipped evidence for the EU Cyber Resilience Act (CRA, in force 2026) “reporting + support + SBOM” bar. This is not a claim of formal conformity assessment; it is the evidentiary bundle an auditor/reviewer needs to evaluate that claim.
What the CRA evidentiary kit is
The CRA makes a manufacturer responsible for the security of the digital
elements of a product across its life — including producing a software bill
of materials (SBOM), a vulnerability reporting channel, and a security
support window. brain-server already ships each of these; scripts/cra-kit.sh
assembles them into one hashed bundle:
scripts/cra-kit.sh
writes dist/cra-kit/:
| Artifact | Source | What it evidences |
|---|---|---|
brain-server-<ver>.cdx.json | scripts/sbom.sh (CycloneDX from Cargo.lock) | SBOM — shipped runtime closure for component/supply-chain scan (not the dev+build tree; see docs/release-checklist.md SBOM scope) |
SECURITY.md | repo | reporting path + supported-versions window |
SUPPORT.md | repo | support statement + update guidance + no-SLA honesty |
deployment.md | docs/deployment.md | how the product is deployed/updated |
COMPLIANCE.md | repo | the framework mapping the kit’s controls answer to |
CRA_MANIFEST.json | generated | SHA-256 index of every artifact (integrity pin) |
Idempotent: re-running rebuilds from the same sources, so hashes are stable for
unchanged content. The only external tool is shasum/sha256sum (present on
macOS and Linux).
Relationship to the SBOM (pre-existing)
The per-release CycloneDX SBOM predates this kit (v1.17.5 ships it into sbom/
as brain-server-<version>.cdx.json on every tag release; SECURITY.md §SBOM documents it). The kit merely wraps
it with the reporting + support docs the CRA pairs with it, so the whole
evidentiary story is answerable in one command.
Honest ceiling
This kit assembles evidence, not certification. Conformity assessment, an EU-type designation, or a formal declaration of conformity are legal steps performed by the responsible manufacturer against the regulation’s security requirements (including Annex I security requirements and any applicable harmonised standard) — none of which this repository performs or claims. Where the regulation’s requirements exceed what a self-hosted, operator-run store can truthfully assert (e.g. organizational “responsible manufacturer” obligations or 24/7 coordinated-vulnerability-disclosure staffing), this kit is the record that surfaces the gap rather than hiding it.