ADR 0009 — Cyber Resilience Act: cepharum as open-source software steward
- Status: Accepted
- Date: 2026-09-30
- Context repos: all
Problem
The EU Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity obligations for software placed on the EU market. Its reporting obligations apply from 11 September 2026, the rest from 11 December 2027. How much of it applies depends on the role the one providing the software plays:
- a manufacturer places a product on the market in the course of a commercial activity and carries the full set of obligations — risk assessment, conformity assessment, CE marking, technical documentation, a support period;
- an open-source software steward is a legal person that systematically supports the development of free and open-source software intended for commercial activities, without monetising it itself (Article 3(14), Article 24);
- free and open-source software provided outside any commercial activity is not covered at all.
Until now nothing in cratly recorded which of these cepharum is, and nothing in any repository answered even the obligations every role shares.
Decision
cepharum acts as open-source software steward for cratly. All of cratly's source is public, under MIT or GPL (see ADR 0002), and its use is not charged for. cepharum develops it continuously and uses it in its own and its customers' websites, so it is intended for commercial activities — which is what makes this stewardship rather than software outside the Act's scope.
Consequences
What Article 24 asks of a steward, and where cratly answers it:
| Obligation | Answered by |
|---|---|
| A documented, verifiable cybersecurity policy that fosters secure development, effective handling of vulnerabilities and their voluntary reporting | The security policy on this site |
| Notifying actively exploited vulnerabilities, to the extent the steward is involved in the development (Article 14(1)) | The policy's reporting procedure; cepharum develops all of cratly, so all of it is covered |
| Notifying severe incidents affecting the infrastructure used for development (Article 14(3), (8)) | Likewise — for cratly that is the gitlab.com group and the pipelines building its releases |
| Cooperating with market surveillance authorities on request | Stated in the policy |
Not required of a steward, and therefore not taken on: conformity assessment, CE marking, an EU declaration of conformity, and a fixed support period. An SBOM and a continuous check for known vulnerabilities are not strictly required either; they are kept anyway, because a steward that cannot say what its packages ship cannot handle a vulnerability in them effectively. scavold is the first project to have both; every project distributed as a package follows its setup.
Each project's SECURITY.md points at the policy and adds what is specific to that project: which versions receive fixes, and where its SBOM is kept.
What would change the decision
The role follows from how cratly is provided, not from what it is. It stops fitting as soon as cepharum monetises cratly itself — charges for a licence, sells a distribution of it, or makes its use conditional on a paid service. cepharum is then its manufacturer, with the full set of obligations, from the first release provided that way. Paid work with cratly — building or hosting a customer's website — is a separate question: that website is the customer's, and whether it is a product in the Act's sense is assessed on its own.
Not covered here
This record states the reasoning. It is not legal advice, and the assessment of cepharum's role is worth having confirmed by counsel.