Open-Source Foundations Join Forces on Digital Supply Chain

Foundations housing seven large open-source projects are banding together ahead of what they say is a nearly impossible 2027 deadline created by the world’s first digital supply chain regulation.

See Also: Cyber Hygiene and Asset Management Perception vs. Reality

European Union lawmakers in March approved the Cyber Resilience Act, which creates cybersecurity rules for manufacturers and developers of connected devices. The regulation must undergo final approval by a council of direct representatives of trading bloc members – a step that should be a formality following the political agreement on the regulation that lawmakers and the council reached in December. The European Commission put forward the proposal in 2022.

The act will come into full effect 36 months after the European Council acts – and the clock is racing not just for manufacturers of proprietary software development processes but also for major open-source projects. Estimates vary for how deeply open-source code pervades the world. One estimate says 96% of all code bases contain open source. The Eclipse Foundation – one of the seven foundations working together on Cyber Resilience Act compliance – estimates 80% of global software infrastructure is open source.

“It is fair to say that when we discuss the ‘software supply chain,’ we are primarily, but not exclusively, referring to open source,” said Executive Director Mike Milinkovich in a Tuesday blog post.

The other six foundations – Apache, Blender, OpenSSL, PHP, Python and Rust – initiated a Brussels-based working group charged with finding common specifications for secure software development, using as a starting point their existing open-source experience with matters such as coordinated disclosure, peer review and release processes.

“It is a tight deadline,” Milinkovich said in an email. “Developing specifications is time-consuming” and publishing guidelines is just the first step. “Every product made available in the European Union will need to implement these processes and document their adherence, which is also a time-intensive task.”

Primary responsibility for adhering to the Cyber Resilience Act falls on commercial manufacturers and developers, not open-source coders – volunteers aren’t even covered by the act. But it makes “a lot of sense to do as much as possible in the open-source projects and share the results downstream,” Milinkovich said.

Following the pressure from the open-source community, European lawmakers introduced the concept of an “open-source steward” exempt from the act’s monetary penalties and most of its requirements (see: Cyber Mavens Slam Europe’s Cyber Resilience Act).

The final text calls on open-source stewards to fashion policies that foster the development of secure products and effective handling of vulnerabilities and to voluntarily report vulnerabilities to European authorities.

“The creation of the OSS steward language ensures that we weren’t subject to rules primarily aimed at commercial supply chains,” said Rebecca Rumbul, executive director and CEO at the Rust Foundation. “What it does is ensure that nonprofits like the Rust Foundation are not considered commercial actors under the CRA, but are considered to be more like public guardians.”

One possible side effect of the CRA, which Milinkovich hopes for, is that if manufacturers are legally obligated to address security bugs in the open-source code that they incorporate into a product, they might beef up their support of open source.

“They should, as it will be much more cost-efficient and safe in terms of compliance for them to ensure the quality of their OSS components,” he said. “It’s going to be interesting to watch.”