The Cyber Resilience Act and Open Source: What Maintainers Really Need to Know

Cyber Resilience Act and Open Source Software: A Detailed Summary

Key Concepts:

• Cyber Resilience Act (CRA): EU legislation aimed at improving the cybersecurity of digital products (hardware and software) sold in the EU.
• Manufacturer: Entity placing a product (including software) on the EU market and profiting from it, bearing the primary responsibility under the CRA.
• Open Source Software Steward: Organization (nonprofit or for-profit) that maintains open-source software components without directly monetizing them, subject to lighter obligations.
• Monetization: The act of generating revenue from software, a key factor in determining whether a maintainer is considered a manufacturer under the CRA.
• Vulnerability Handling Process: Procedures for identifying, reporting, and addressing security vulnerabilities in software.
• Security Attestation: A mechanism to certify the security of open-source components, potentially easing compliance for manufacturers.
• Upstream Contribution: Sharing security patches and improvements with the original open-source project.

1. Overview of the Cyber Resilience Act

• The CRA aims to raise the floor on security practices for digital products in the EU market, addressing vulnerabilities in hardware and software.
• It primarily targets software that is monetized, placing obligations on those who profit from it.
• The CRA acknowledges and attempts to address the unique aspects of free and open-source software (FOSS).

2. Impact on Open Source Projects and Maintainers

• Manufacturers, not open-source maintainers, are responsible for the security of the end product placed on the market. This aligns with the "as-is" nature of open-source licenses.
• Contributors are out of scope: Individuals contributing to open-source projects are not subject to the CRA's requirements.
• Maintainers: Impact depends on monetization. The European Commission is developing guidance to clarify when maintainers are considered manufacturers.
• Open Source Software Stewards: Organizations like the Eclipse Foundation, Apache, and the Linux Foundation, or companies with open-source components they don't sell, have lighter obligations.

3. The Role of the Open Regulatory Compliance (ORC) Working Group

• The ORC working group at Eclipse is actively involved in clarifying the CRA's implications for open source.
• It maintains a frequently asked questions (FAQ) document on GitHub, accessible to the public, to address common concerns and ambiguities.
• The group engages with the European Commission through direct input and participation in the CRA expert group, influencing the development of guidance.

4. Practical Implications and Reactions

• The CRA is expected to drive changes in the software landscape, pushing manufacturers to use and support "good" open-source projects.
• Companies using open source may become more responsible and contribute to the projects they rely on.
• There's a potential for legacy open-source projects that are no longer maintained to be phased out.
• Manufacturers are obligated to share security patches with maintainers, potentially leading to increased contributions.

5. Addressing Concerns and Misconceptions

• Early versions of the CRA raised concerns about their impact on open source, but the final version has addressed many of these issues.
• The open-source community is generally more aware of the CRA than many industries targeted by it.
• The CRA's requirements, such as vulnerability handling processes, align with best practices that many projects already follow.

6. The Legislative Process and Open Source

• The CRA was unique in that it already contained references to open source when it was published.
• The European Commission and Parliament were receptive to feedback from the open-source community and national governments.
• The involvement of manufacturers in raising concerns also played a role in shaping the final legislation.

7. Key Questions and Answers from the Audience

• Differentiation between commercial software vendors and open-source maintainers: The key factor is monetization. Contributions to projects not under one's responsibility are exempt.
• Expectations from manufacturers for independent open-source projects: Manufacturers have obligations to fix vulnerabilities and contribute patches upstream.
• Impact on projects based inside vs. outside the EU: If shipping to the EU market, the CRA applies. The location determines which national regulator is responsible.
• Donations and full-time maintainers: The treatment of donations as monetization is still under discussion, with hopes for a positive resolution.
• Proprietary software vendors releasing products under open-source licenses: The guidance is expected to clarify whether obligations attach where money is being made.

8. Security Attestations for Open Source

• The CRA includes a concept of security attestations for FOSS, which could provide a mechanism for funding security improvements.
• Attestations could signify that an open-source project is secure, making it easier for companies to use.

9. Future of Open Source

• The use of open source is expected to continue to increase.
• Larger trends, such as the use of LLMs, may have a greater impact on the open-source landscape than the CRA.

10. Final Advice

• Don't panic: Many early concerns have been addressed in the final legislation.
• Use up-to-date resources: Refer to the CRA FAQ and other current information sources.
• Get involved: Join the ORC working group to help shape the implementation of the CRA.

Conclusion

The Cyber Resilience Act is a significant piece of legislation that aims to improve the cybersecurity of digital products in the EU. While it initially raised concerns within the open-source community, the final version has addressed many of these issues. The key takeaway is that manufacturers, not open-source maintainers, bear the primary responsibility under the CRA. However, the CRA is expected to have a positive impact on open source by encouraging manufacturers to use and support secure projects and contribute patches upstream. The ORC working group is actively involved in clarifying the CRA's implications and shaping its implementation, and open-source developers are encouraged to get involved.