The EU Cyber Resilience Act introduces new obligations across the software supply chain, for both manufacturers and for the new category of open source stewards. We've been thinking about what this means for the Yocto Project - what are our obligations? And what can we do to help our users meet their obligations as manufacturers?

For manufacturers, the CRA requires the avoidance of known exploitable security issues, tracking of software components & vulnerabilities, reporting to relevant Computer Security Incident Response Teams (CSIRTs) and provision of software updates for the useful lifetime of products. Today, the Yocto Project provides a repeatable build process and tooling that will help manufacturers to meet these requirements. With further development, we could make it easier to achieve the required level of security and vulnerability tracking.

For the Yocto Project itself, the requirements on open source stewards are more lightweight. We will need to align the project's cybersecurity policy with the CRA and be prepared to share information with market surveillance authorities if requested.