LibreKAT/Ocideck

Watch

Fork 0

docs: CRA is hier geen verplichting maar een leidraad — en de tekst zegt dat nu #536

Merged

brenno merged 2 commits from docs/cra-als-beschreven into main

2026-07-22 11:20:46 +00:00

brenno commented

2026-07-22 11:20:44 +00:00

Owner

Summary

Records the maintainer's decision on #519 and fixes the wording it made wrong (#532).

Closes #519
Closes #532

The position

The Regulation imposes no obligations here: OciDeck is an open-source project made by the foundation, freely available, and not offered as a service. And we follow it anyway, as a guideline — not because we must, but because it describes reasonably well what maintaining software properly looks like.

Those two sentences belong together. The first stops us taking on a duty that does not exist; the second stops "we don't have to" becoming a reason not to.

Changes

assurance/CRA-2024-2847-positie.md — the position, a guideline table against Annex I Part II with what is open, and five re-evaluation triggers. In assurance/ and not docs/ for the same reason as the ASVS files: steering information, not a product promise.
Wording, four files. README.md, docs/GLOSSARY.md (×2), docs/SBOM.md, docs/SECURITY_DESIGN.md: "as required by" → "as described in", with the reason stated — we do it because it is part of building software properly. The paragraph in SBOM.md describing what the Regulation demands of manufacturers stays, since it is factually correct, now with the note that we are not one.
tool/check_service_norms.dart — its header already said it does not measure CRA conformity; it now points at where the reasoning lives.

What follows

Three directions came out of the decision, and they are about whether the work is good enough rather than about compliance:

How long things stay open. Security reports are measured already; ordinary issues are not. An issue sitting for months is not a security problem but it is a quality signal — and it is the first thing an outsider sees.
Whether the quality gates move the right way. They measure whether something works, not whether coverage sits in the right places, whether a test proves anything, or whether the seven or eight baselines are shrinking rather than standing still.
Whether documentation is right, not just present. docs_registration_test guards that a document is reachable, not that it is true or followable — the d7b609bf generated-guides episode is what that distinction cost last time.

Each gets its own issue; the write-up belongs there, not in the position record.

Gates

make check, make check-secrets, make sast all green.

## Summary Records the maintainer's decision on #519 and fixes the wording it made wrong (#532). Closes #519 Closes #532 ## The position The Regulation imposes no obligations here: OciDeck is an open-source project made by the foundation, freely available, and not offered as a service. **And we follow it anyway, as a guideline** — not because we must, but because it describes reasonably well what maintaining software properly looks like. Those two sentences belong together. The first stops us taking on a duty that does not exist; the second stops "we don't have to" becoming a reason not to. ## Changes - `assurance/CRA-2024-2847-positie.md` — the position, a guideline table against Annex I Part II with what is open, and five re-evaluation triggers. In `assurance/` and not `docs/` for the same reason as the ASVS files: steering information, not a product promise. - **Wording, four files.** `README.md`, `docs/GLOSSARY.md` (×2), `docs/SBOM.md`, `docs/SECURITY_DESIGN.md`: "as required by" → "as described in", with the reason stated — we do it because it is part of building software properly. The paragraph in `SBOM.md` describing what the Regulation demands *of manufacturers* stays, since it is factually correct, now with the note that we are not one. - `tool/check_service_norms.dart` — its header already said it does not measure CRA conformity; it now points at where the reasoning lives. ## What follows Three directions came out of the decision, and they are about whether the work is good enough rather than about compliance: 1. **How long things stay open.** Security reports are measured already; ordinary issues are not. An issue sitting for months is not a security problem but it is a quality signal — and it is the first thing an outsider sees. 2. **Whether the quality gates move the right way.** They measure whether something *works*, not whether coverage sits in the right places, whether a test proves anything, or whether the seven or eight baselines are shrinking rather than standing still. 3. **Whether documentation is right, not just present.** `docs_registration_test` guards that a document is reachable, not that it is true or followable — the d7b609bf generated-guides episode is what that distinction cost last time. Each gets its own issue; the write-up belongs there, not in the position record. ## Gates `make check`, `make check-secrets`, `make sast` all green.

brenno added 2 commits

2026-07-22 11:20:44 +00:00

docs(cra): 'als beschreven in' in plaats van 'zoals vereist door' 2439c37011

De SBOM stond in README, GLOSSARY, SBOM.md en SECURITY_DESIGN beschreven
als iets wat de Cyberweerbaarheidsverordening van óns eist. Dat is een
claim over onze eigen positie, en die klopt niet: OciDeck is een
opensourceproject van de stichting, vrij beschikbaar en geen dienst, dus
de verplichtingen uit de verordening gelden niet.

We bouwen de SBOM omdat een inventaris van wat je uitlevert hoort bij
software goed maken, niet omdat het moet. Dat staat er nu ook zo.

De passage in SBOM.md die beschrijft wat de verordening van fabrikanten
eist blijft staan — die is feitelijk juist — met erbij dat wij dat niet
zijn.

Closes #532

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs(cra): leg de positie vast — geen verplichting, wel leidraad

CI / Gate (Linux) · Format · Analyze · Coverage (pull_request) Has been cancelled

Details

CI / Test (macos-latest) (pull_request) Has been cancelled

Details

CI / Test (windows-latest) (pull_request) Has been cancelled

Details

CI / Web hardening (pull_request) Has been cancelled

Details

CI / Docs links (pull_request) Has been cancelled

Details

CI / Supply-chain (Trivy · advisory) (pull_request) Has been cancelled

Details

CI / Gate (Linux) · Format · Analyze · Coverage (push) Has been cancelled

Details

CI / Test (macos-latest) (push) Has been cancelled

Details

CI / Test (windows-latest) (push) Has been cancelled

Details

CI / Web hardening (push) Has been cancelled

Details

CI / Docs links (push) Has been cancelled

Details

CI / Supply-chain (Trivy · advisory) (push) Has been cancelled

Details

a84645a0e2

De verordening legt dit project niets op: opensource van de stichting,
vrij beschikbaar, geen dienst. Dat is de eerste alinea. De tweede is dat
we hem tóch aanhouden, omdat hij redelijk goed opschrijft hoe je software
fatsoenlijk onderhoudt — weten wat je uitlevert, kwetsbaarheden zonder
uitstel afhandelen, een melder een begaanbare weg geven.

Die twee zinnen horen bij elkaar: de eerste voorkomt een plicht die niet
bestaat, de tweede voorkomt dat "het hoeft niet" een reden wordt om het
niet te doen.

Staat in assurance/ en niet in docs/, om dezelfde reden als de
ASVS-stukken: dit is stuurinformatie, geen productbelofte.

Met een leidraadtabel tegen Annex I deel II, en drie richtingen die
eruit volgen: doorlooptijd van issues, of de kwaliteitspoorten de goede
kant op bewegen, en of documentatie klopt in plaats van alleen bestaat.

Closes #519

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

brenno merged commit 517723ae1d into main

2026-07-22 11:20:46 +00:00

brenno deleted branch docs/cra-als-beschreven

2026-07-22 11:20:46 +00:00

brenno referenced this pull request from a commit

2026-07-22 11:20:46 +00:00

Merge pull request 'docs: CRA is hier geen verplichting maar een leidraad — en de tekst zegt dat nu' (#536) from docs/cra-als-beschreven into main