CRA at the time of submission is still in a draft status, but it is relatively clear that it will impose a duty to make the software safer if and when it is distributed on the market as a final product. Part of the safety requirements includes the obligation to collect and keep available for inspection a list of software components obtained from third parties, that is their provenance, and the insecurities obtained through mainly CVE scanning. Incidentally there is an obligation to support and provide security patches after the product is placed on the market (hint, open source rulez). Open Source Software is not exempted per se, the current discussion is where the final burden and responsibility of complying, if at all, lies. In any case, whatever the outcome of such discussion is, open source projects should strive to ease up CRA compliance for their downstream adopters, if they want to keep them. We will concentrate on how open source projects that aim at being considered in an industry supply chain (including that of software industry) should strive to make the supply chain's life easier, building on our experience with Eclipse Oniro and the toolchain and processes we have devised for it.

1. © 2023 Alberto Pianon, Carlo Piana - Array
KYCS ‒ Know Your Code Sources
KYCS ‒ Know Your Code Sources
(and let it be known)
(and let it be known)
Alberto Pianon, Carlo Piana –
SFScon @Noi Techpark 2023
Array
1


2. © 2023 Alberto Pianon, Carlo Piana - Array
Image by from
Brigipix Pixabay
2


3. © 2023 Alberto Pianon, Carlo Piana - Array
CRA
CRA
Cyber
Resilience
Act
3


4. © 2023 Alberto Pianon, Carlo Piana - Array
Under CRA
Under CRA
You Must Know Your (Upstream) Code
You Must Let It Be Known
Which Means:
-
-
-
provenance
integrity
security
maintenance
This is not just a friendly advice
5


5. © 2023 Alberto Pianon, Carlo Piana - Array
For instance:
For instance:
10.4
For the purposes of complying with the
obliga on laid down in paragraph 1,
manufacturers shall exercise due diligence
when integra ng components sourced from
third par es in products with digital elements.
They shall ensure that such components do
not compromise the security of the product
with digital elements.
6


6. © 2023 Alberto Pianon, Carlo Piana - Array
Annex I
Annex I
(2) Products with digital elements shall be delivered without
any known exploitable vulnerabili es
7


7. © 2023 Alberto Pianon, Carlo Piana - Array
Annex II
Annex II
As a minimum, the product with digital
elements shall be accompanied by:
[…]
6. if and, where applicable, where the so ware
bill of materials can be accessed;
8


8. © 2023 Alberto Pianon, Carlo Piana - Array
Annex V
Annex V
The technical documenta on […] shall contain
at least the following informa on
[…]
where applicable, the so ware bill of materials
[…], further to a reasoned request from a
market surveillance authority provided that it
is necessary in order for this authority to be
able to check compliance with the essen al
requirements set out in Annex I.
9


9. © 2023 Alberto Pianon, Carlo Piana - Array
Stricter requirements for
Stricter requirements for
Cri cal products with digital elements
High-risk AI systems
-
-
10


10. © 2023 Alberto Pianon, Carlo Piana - Array
Therefore…
Therefore…
Image by from
DaveMeier Pixabay
Just take the plunge!
11


11. © 2023 Alberto Pianon, Carlo Piana - Array
Where We Have Done It
Where We Have Done It
v2.0
Embedded Opera ng System pla orm, with mul ple build
targets
-
an integrated Con nuous Compliance process managed
through a dedicated toolchain
-
based on exis ng OSS tools
+ a set of custom tools (aliens4friends)
using across the whole worküow, to get machine
readable SBOM
-
12


12. © 2023 Alberto Pianon, Carlo Piana - Array
Who Did It?
Who Did It?
NOI Techpark
Array
h ps:/
/noi.bz.it/en
h ps:/
/array.eu
13


13. sca.so ware.bz.it


14. © 2023 Alberto Pianon, Carlo Piana - Array
14


15. sca.so ware.bz.it


16. © 2023 Alberto Pianon, Carlo Piana - Array
15


17. © 2023 Alberto Pianon, Carlo Piana - Array
The Problem We Had To Solve
The Problem We Had To Solve
In embedded opera ng systems, hardware integra on is a
PITA
-
to handle it, you need to bake your own custom linux
distribu on: is the tool
-
mixing ingredients by using recipes, layers and overrides
offers great üexibility and eases hardware integra on…
-
…but it brings PITA when you need to generate SBOM
-
16


18. © 2023 Alberto Pianon, Carlo Piana - Array
Soup Is Great But…
Soup Is Great But…
How do you trace ingredients when you already mixed them?
17


19. © 2023 Alberto Pianon, Carlo Piana - Array
Yocto Workflow (Simplified)
Yocto Workflow (Simplified)
18


20. © 2023 Alberto Pianon, Carlo Piana - Array
How We Want To Collect Required
How We Want To Collect Required
Data On Yocto Side
Data On Yocto Side
Map upstream source ûles to local workdir source ûles to
binary ûles
consume metadata coming from Yocto
trace unpacking of upstream source packages and of
downstream patches (the ingredients), separately from
each other, and map them to local workdir ûles (the soup
pan)
-
19


21. © 2023 Alberto Pianon, Carlo Piana - Array
Downstream Or Upstream?
Downstream Or Upstream?
In a ûrst PoC we did that with an external, post-mortem
script using Yocto/bitbake libraries to parse build directories
and reproduce the unpack process…
-
but the solu on needed to be pushed upstream!
-
20


22. © 2023 Alberto Pianon, Carlo Piana - Array
Finally, We Made It!
Finally, We Made It!
Patch has been recently accepted in Bitbake and Poky
repositories and will be part of the upcoming Yocto release
-
It exposes an <unpack tracer= API where one can plug-in
upstream source tracing logic directly into the core of
bitbake
-
Trace ingredients before making the soup!
-
A ûrst API implementa on (WIP) is already available at
-
h ps:/
/gitlab.eclipse.org/eclipse/oniro-
compliancetoolchain/toolchain/next/meta-bbtracer
We will work on back-por ng the patch to older Yocto LTS
releases
-
21


23. © 2023 Alberto Pianon, Carlo Piana - Array
Q&A: We Need Your Feedback!
Q&A: We Need Your Feedback!
22


24. © 2023 Alberto Pianon, Carlo Piana - Array
Thank You For Your Attention
Thank You For Your Attention



Array Alberto Pianon Carlo Piana
This work is licensed under a 4.0
Presentation made using and a workflow with
Soup image: , , via Wikimedia Commons
h ps:/
/array.eu
h ps:/
/projects.eclipse.org/projects/oniro.oniro-
compliancetoolchain
h ps:/
/gitlab.eclipse.org/eclipse/oniro-
compliancetoolchain/toolchain
     
Creative Commons - Attribution - ShareAlike
Reveal.js Markdown reveal-md
Bonniebartilomo CC BY-SA 4.0
23


25. 