Kroah-hartman: Linux Kernel Maintainer On Cra Open Source Impact

ATLANTA — Technology companies and developers are yet realizing that they’ll request to woody pinch nan European Union’s (EU) Cyber Resilience Act (CRA). Fortunately, arsenic Greg Kroah-Hartman, maintainer of nan Linux kernel unchangeable branch, explained astatine KubeCon + CloudNativeCon North America 2025, if you’re an individual unfastened root developer, you don’t person overmuch to interest about. It’s a different story, however, if your codification ends up successful commercialized products for nan EU market.

Understanding nan EU Cyber Resilience Act (CRA)

Before diving into that, though, let’s person a speedy refresher connected what nan CRA is anyway, since, arsenic nan Linux Foundation pointed retired successful a caller survey, 62% of developers and their companies are mostly clueless astir nan CRA. The CRA is simply a sweeping group of regulations designed to found unified cybersecurity standards for products pinch integer elements, hardware, software, and network-connected devices, sold aliases utilized successful nan EU.

The Act intends to importantly heighten cybersecurity and trim vulnerabilities, while holding manufacturers, importers, and distributors accountable for nan information of integer products passim their full lifecycle. That intends each nan measurement from creation and improvement to deployment and decommissioning.

CRA Stakeholder Groups and Responsibilities

The CRA mandates products to beryllium unafraid by design, regularly updated, intelligibly disclose package dependencies, and supply mechanisms for unafraid default configurations. The authorities targets issues specified arsenic inadequate cybersecurity and a deficiency of timely information updates, which person made integer products susceptible and difficult for users to measure and secure.

There are 3 different stakeholder groups, each pinch unsocial responsibilities and levels of regulatory obligation, nether nan CRA. These are:  

• Manufacturers: Companies aliases organizations that develop, assemble, aliases spot products pinch integer elements (hardware, software, aliases firmware) connected nan EU market. Manufacturers carnivore nan superior work for CRA compliance, including ensuring cybersecurity passim nan full merchandise lifecycle, maintaining Software Bills of Materials (SBOMs), addressing vulnerabilities, and promoting proviso concatenation transparency.​
• Stewards: Organizations, often non-profits aliases foundations (such arsenic nan Linux Foundation, Apache, Eclipse), that support unfastened root package projects intended for commercialized use. Stewards person lighter obligations nether nan CRA, chiefly focusing connected establishing cybersecurity policies, managing vulnerability disclosures, and promoting information champion practices wrong their task communities.​
• Non-commercial developers: Individuals aliases teams who create open-source package not intended for commercialized use. This group is mostly exempt from nonstop CRA requirements, though disorder and uncertainty astir applicability persist among contributors, highlighting nan request for much definitive guidance and domiciled clarification.

CRA Implementation Timeline and Guidance

Now, nan CRA entered into unit connected December 10, 2024, but, arsenic pinch immoderate specified regulation, nan devil is successful nan details. So, nan CRA’s main obligations go mandatory arsenic of Dec. 11, 2027. The European Commission is processing delegated acts and moving pinch a CRA Expert Group for elaborate implementation and guidance. Kroah-Hartman, who’s connected that committee, knows what’s what astir nan CRA, and this is what he had to say. 

CRA’s Positive Impact connected Open Source Security

He opened by reassuring developers that nan CRA “isn’t a bad thing” and, successful fact, represents an overdue betterment successful unfastened root transparency and information practices. That said, “The Cyber Resilience Act successful nan EU is thing that’s going to affect everybody present successful this room, because moreover if you’re not an EU member… different countries, different places successful nan world are adopting nan aforesaid regulations.”

In addition, thing that incorporates code, which is beautiful overmuch everything these days, and is sold successful nan EU, falls nether nan CRA. It besides doesn’t matter whether you’ve ne'er near nan States; if your codification is successful nan EU, your programme falls nether nan NDA.

Sounds scary, doesn’t it? Don’t panic. 

Who nan CRA Targets: Commercial vs. Non-Commercial Use

Kroah-Hartman emphasized that nan rule is not intended to target hobbyists, consultants, aliases anyone simply contributing to unfastened source. “If you’re contributing to an unfastened root project, you do not person to interest astir it, not an issue… Non-commercial hobby products, not successful scope, not an rumor astatine all. Don’t interest astir it, each right, until your package gets used.” Only those whose activity is incorporated into commercialized products for nan EU request to springiness typical attraction to compliance.

For task maintainers operating nether nan umbrella of organizations, specified arsenic nan Linux Foundation, Mozilla, aliases Apache, Kroah-Hartmann outlines minimal, yet clear, responsibilities: “As a steward, this is each you person to do: Provide a interaction to personification to show you astir information issues they find, and past erstwhile you hole nan information issue, study it to somebody.

That’s it. That’s each you person to do… If you are really moving immoderate infrastructure and you do person a information rumor pinch your infrastructure, you do person to study that arsenic well. That’s it. Nothing large astatine all, and that’s each you person to do.”

Resisting Manufacturer Compliance Offloading

Kroah-Harman urges unfastened root projects to defy manufacturers’ attempts to offload compliance requirements onto maintainers. “If manufacturers travel to you and say, here’s this large checklist of things we want you to do, push back.”

This is simply a existent concern. Emerson Electric has already attempted to get unfastened root projects to do its ineligible activity for them. In August, they demanded that nan Debian Linux project supply them with accusation astir debianutils. 

Don’t Fear nan CRA: Raising nan Bar for Software Security

He warns, however, “It’s going to get worse because nan CRA deadline is coming soon for companies. In unfastened source, we don’t person to interest astir thing yet.  Manufacturers are going to commencement really caring successful September of adjacent year. They’re going to commencement panicking successful nan summertime of adjacent year, and things are going to commencement hitting nan fan.” 

To this benignant of demand, Kroah-Hartman said, “You person nary work to do that. They’re trying to get you to do your activity for them. It’s going to get worse. Companies are coming aft you. I will create a small shape missive and say, ‘Here’s what you need.'”

Kroah-Hartman explained that nan Open Source Security Foundation (OpenSSF) is moving to help nan unfastened root organization navigate and travel nan CRA. The OpenSSF is besides collaborating connected method specifications, processing guides and training, and creating frameworks, specified arsenic nan OSPS Baseline, to guarantee that information is improved while nan collaborative quality of unfastened root is preserved. Eventually, nan OpenSSF will person a shape missive that tin push backmost to them and say, “No, do your ain work. We don’t person nan work they do.”

Kroah-Hartman continued, “We don’t person to do thing arsenic unfastened root stewards aliases contributors for different afloat year. We’re not responsible for anything; that’s nan only constituent successful clip we person to put our ‘read maine successful nan record and say, here’s really you interaction us.’  He besides pointed out, though, that businesses successful a tizzy complete nan OpenSSF whitethorn beryllium to beryllium profitable for unfastened root projects. Daniel Stenberg, cURL‘s maintainer, for example, is already offering commercial support for cURL CRA support. 

The civilized of his story: “Don’t beryllium afraid. This rule is okay.” The CRA will raise nan barroom for commercialized package security, but unfastened root contributors and maintainers pinch bully practices successful spot are already good connected their measurement to compliance.

Group Created pinch Sketch.