Eclipse and OWASP want to educate open source projects on security issues

The European Commission has released a detailed guidance document aimed at clarifying how the Cyber Resilience Act (CRA) applies to open source software. Published on Monday, the guide provides manufacturers, developers, and companies with a comprehensive overview of how to interpret the cybersecurity regulation, which came into effect in December 2024. The CRA sets uniform minimum security requirements for digital products throughout their entire lifecycle, affecting everything from product design to end-of-life support. The guidance covers key aspects of the CRA, including which products fall under its scope, how major updates should be classified, and how long support periods must last. It also outlines practical steps for conducting risk assessments and fulfilling reporting obligations. The document emphasizes the importance of clarity for small and medium-sized enterprises, offering numerous examples and scenarios to help users understand complex provisions. This is particularly crucial as the first mandatory reporting requirements under the CRA are set to take effect soon. The guidance also addresses concerns raised by open source communities during negotiations over the CRA. Developers and open source foundations had warned that new liability and documentation requirements could discourage volunteer contributions. In response, the Commission clarified that freely available open source software does not fall under the CRA unless it is distributed commercially. The document explains when such commercial activity occurs, noting that selling open source software, providing paid enterprise versions, or monetizing other services through an open source project counts as commercial activity under the CRA. The Commission further distinguishes between contributors and maintainers within open source projects. Those who merely fix bugs or add features generally do not bear responsibility under the CRA. However, individuals or organizations that control the release schedule, manage updates, or oversee the direction of a project, such as project stewards, are subject to different obligations. Simply having write access to a code repository is not enough to qualify as a maintainer under the CRA. The role of “stewards” is also clearly defined. These can include foundations or other entities that provide ongoing organizational or technical support to open source projects without actively promoting them. Their responsibilities vary depending on the level of involvement. For example, those who only handle community work have fewer obligations than those managing infrastructure or actively participating in development and security management. Depending on the nature of their support, stewards may also face reporting requirements related to security incidents or exploited vulnerabilities. In addition, the Commission outlines criteria for determining whether a change to a product qualifies as “essential.” Updates that solely address known vulnerabilities or enhance existing security levels typically do not constitute essential changes. This helps clarify what constitutes a significant update under the CRA, reducing ambiguity for both developers and regulators. The document aims to ensure that open source projects remain viable while still meeting the cybersecurity standards required by the CRA.