Demo: EU Cyber Resilience Act (CRA) Compliance - Supply Chain Security

[eins78]

Overview

Implement supply chain security features to comply with the EU Cyber Resilience Act (Regulation EU 2024/2847).

Timeline:

• September 2026: Vulnerability reporting to ENISA required
• December 2027: Full SBOM enforcement

Implemented Features (PR #407)

Phase 1: SBOM Generation

• CycloneDX format SBOM (security-focused)
• SPDX format SBOM (ISO compliance)
• Grype vulnerability scanning
• SARIF upload to GitHub Security tab
• SBOMs attached to GitHub releases

Phase 2: Attestations & Signing

• GitHub artifact attestations (SLSA L2 provenance)
• SBOM attestations pushed to registry
• Cosign keyless signing for GHCR
• Cosign keyless signing for Docker Hub (with error handling)

Phase 4: Reproducibility

• SOURCE_DATE_EPOCH support in Dockerfile
• Git commit timestamp for reproducible builds

Remaining Tasks

Verification (after merge)

• Create alpha release to trigger the new workflow
• Verify SBOM generation works correctly
• Verify vulnerability scan uploads to Security tab
• Verify GitHub attestations are created
• Verify Cosign signatures are attached to images
• Test verification commands work as documented

Future Improvements

• Phase 3: SLSA Level 3 - Create reusable workflow for hardened builds
• Consider SHA pinning for GitHub Actions (supply chain security)
• Add VEX (Vulnerability Exploitability eXchange) support
• Implement policy enforcement (Kyverno/Gatekeeper)

Verification Commands

After alpha release, verify with:

# Verify GitHub attestations
gh attestation verify \
  oci://ghcr.io/eins78/hello-world-web@sha256:<digest> \
  --owner eins78

# Verify Cosign signature
cosign verify \
  --certificate-identity-regexp "github.com/eins78/hello-world-web" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/eins78/hello-world-web@sha256:<digest>