EU Cyber Resilience Act (CRA)

• Include an SBOM as part of the attestation for a generated artifact.
• Periodically run an SCA vulnerability scan on officially supported, released versions of the product.

• The SBOM is typically generated when the artifact is first created.
• Scanners are often run later, and repeatedly, on already-built artifacts.

• You have a Chainloop project with at least one version. We will refer to this project as production-project.
• Within this project there is a workflow associated with a CI process that sends an SBOM in the attestation. We’ll refer to this as release-workflow.
• Within the same project, you have a workflow associated with the CI process that sends SCA scan reports in the attestation. We’ll refer to this as vuln-scan-workflow.

• Step 1: Attach the CRA framework to the project
• Step 2: Update or create contracts to gather SBOM, vulnerability report and run policies.
• Step 3: Attach those contracts to workflows (only when previously using default-contract)

• An existing project that already meets the workflow requirements described above.
• A new project and workflows, where we’ll demonstrate the process manually by uploading attestations. This helps illustrate the mechanics of CRA compliance tracking. You can later automate this via your CI pipeline.

​

Step 1. Attach the CRA Framework to the Project

​

Step 2. Update or Create Contracts

• Correct material types (if you already had contracts, you probably already had the material needed, keep your existing name for each type so you don’t need to update your CI pipeline).
• Required policy groups: sbom-quality for the release-workflow and vulnerability-management for the vuln-scan-workflow.

#release-contract
apiVersion: chainloop.dev/v1
kind: Contract
metadata:
  name: release-contract
spec:
  materials:
    # SBOMs will be uploaded to your artifact registry and referenced by digest in the attestation
    # Both SBOM_CYCLONEDX_JSON and SBOM_SPDX_JSON are supported
    - type: SBOM_CYCLONEDX_JSON
      name: sbom
  policyGroups:
    - ref: sbom-quality

#vuln-scan-contract
apiVersion: chainloop.dev/v1
kind: Contract
metadata:
  name: vuln-scan-contract
spec:
  materials:
    # SCA scans will be uploaded to your artifact registry and referenced by digest in the attestation
    # BLACKDUCK_SCA_JSON, SARIF, TWISTCLI_SCAN_JSON, GHAS_DEPENDENCY_SCAN
    # are supported
    - type: SARIF
      name: vuln-scan
  policyGroups:
    - ref: vulnerability-management

# Create release-contract
chainloop workflow contract create -f https://raw.githubusercontent.com/chainloop-dev/chainloop/main/docs/examples/contracts/sbom/sbom-quality.yaml

# Create vuln-scan-contract
chainloop workflow contract create -f https://raw.githubusercontent.com/chainloop-dev/chainloop/main/docs/examples/contracts/vulnerabilities/vulnerability-management.yaml

​

Step 3. Attach Contracts to Workflows

# Assign release-contract to release-worfklow
chainloop workflow update --name release-workflow --project production-project --contract release-contract

# Assign vuln-scan-contract to vuln-scan-worfklow
chainloop workflow update --name vuln-scan-workflow --project production-project --contract vuln-scan-contract

• Create a workflow with the release-workflow name and associate it with the production-project and the release-contract that you created in the previous step.
• Create a workflow with the vuln-scan-workflow name and associate it with the production-project and the vuln-scan-contract that you created in the previous step.

​

Step 4. Send Attestation and Create a Project Version

# send sbom attestation
chainloop att init --workflow release-workflow --project production-project --version 1.0 --release
chainloop att add --name sbom --value https://raw.githubusercontent.com/chainloop-dev/chainloop/refs/heads/main/docs/examples/quickstart/sbom.json
chainloop att push

#send vulnerability scan attestation
chainloop att init --workflow vuln-scan-workflow --project production-project --version 1.0 --release
chainloop att add --name vuln-scan --value https://raw.githubusercontent.com/chainloop-dev/chainloop/refs/heads/main/docs/examples/quickstart/vulnerability-report.json
chainloop att push

​

Tracking CRA Compliance

• Attestations are submitted through a workflow.
• Manual evidence is provided.
• A policy is due for evaluation (based on time-based rules or SLAs).