Navigating Compliance: What Developers Can Learn From Driving
Talkat Open Source Summit Europe 2025 · on Tuesday, 2025-08-26· at 15:05· Elicium 2A (Elicium Level 1)·
summary
Regulation focus is on manufacturers while individual contributors remain exempt unless code is placed on the market; stewards face a very light set of obligations: write a vulnerability handling policy, cooperate with regulators, and assist reporting only for critical incidents. Practical measures include automating SBOM generation and vulnerability scanning into CI/CD, using VEX to mark non‑exploitable findings, scanning for secrets before commit, dependency hygiene and reproducible builds, maintaining audit trails, tagged releases and changelogs, and monitoring packages for malware.
AI-written summary · about
chapters (10)
- 0:00Introduction to CRA
- 3:35Key stakeholders in CRA
- 6:44External influence on compliance
- 13:06Compliance obligations rules
- 18:46Open source stewards obligations
- 22:15Safety tips for developers
- 26:50Steps for manufacturers
- 29:58Advocating security tooling
- 31:06Compliance as guidance
- 32:30Q&A
related talks
20mNavigating Compliance: What Developers Can Learn From Driving
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
05mHow To Automate Compliance If You Aren't Chuck Norris
44mCompliance by Design | Continuous Compliance
45mBuilding Secure Software: Practical Strategies for Developers
15mShifting Open Source Compliance Activities Left
41mCompliance & Regulatory Standards are NOT Incompatible with Modern Development
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)