CRA & Dev: our freely accessible technical wiki to secure your software
The CRA & Dev series: short episodes, one development technique each time (SBOM, VEX, signing, secrets), to move your code toward the Cyber Resilience Act requirements.
The Cyber Resilience Act reads like a lawyer’s document: annexes, conformity assessment procedures, reporting obligations. But it is won on the developer’s side, in a software inventory that comes out of the build, in signed binaries, in secrets that never sit around in plaintext. That is the side we opened CRA & Dev for: a freely accessible technical wiki.
The principle: a concrete need, a technique, a threat model
Each episode reads in a few minutes and follows the same thread. We start from a concrete developer need, give an applicable technique with code (Rust, Python, .NET), and end with the threat model, meaning what the technique protects and what it does not. No cryptography background required. Each episode also states which requirement of Annex I of Regulation (EU) 2024/2847 it addresses.
The episodes available today:
- SBOM and VEX: you can’t fix what you don’t know you’re running. Generate the inventory of your components and document what actually affects you.
- Sign your binaries: an unsigned
.exeis a parcel with no sender. Authenticode on Windows. - Never store a secret in plaintext again: Windows DPAPI for encryption at rest, with an in-depth article to go deeper.
- Sign your data: trust, but verify. Data integrity, cross-platform.
The list will grow with each episode. And for the full CI/CD side (SBOM pipeline, CVE auditing, automated VEX on baremetal firmware), our article SBOM and CVE auditing in CI/CD remains the reference.
Why freely accessible
Because that is how we work: start from engineering, show the method, and be judged on the work. The wiki stays purely technical, with no sales pitch, just code and threat models. If your teams find something there that moves them forward, it has done its job.
Going further
The wiki covers the techniques. It replaces neither the scoping of your obligations nor the conformity assessment. For that part, we support software vendors and embedded product manufacturers: our CRA compliance service.
➡️ Check whether your product is in scope: 3 minutes, no email required