Cyber Resilience Act

[SonnyBoyXXl]

As already discussed regarding the SBOM, the Cyber Resilience Act (CRA) is approaching as well.

Besides preparing the SBOM, has anyone already conducted a risk assessment as required by the CRA?

The first SBOM-related obligations will become relevant within the next few days, at least in cases where a vulnerability has been exploited in a malicious attack. However, full compliance with the CRA will be required by December 2027.

This raises the question of how we can demonstrate and justify the security of Free Pascal. And I do not mean only the source code itself. We also rely on what we consider to be one of the best compilers available. While we are confident in its quality, an auditor will expect objective evidence and documented arguments rather than personal conviction.

Has anyone already gathered material, performed an assessment, or developed an approach that could help address CRA compliance and support an auditor's review?

[Hobbit00]

If we consider FPC/Lazarus open source, managed (my thinking) by a nonprofit organization (Free Pascal and Lazarus Foundation), then this falls outside the CRA. The problem falls solely on those who use Lazarus/FPC, who must demonstrate compliance with the CRA.

(the previous words are mine, apologies if there is no adherence to what is reality).

This is one of the reasons that pushed me to stick with Delphi (without detracting from any responsibilities)... Embarcadero is obligated to maintain the product as long as it markets it (this is for CRA purposes), and therefore the responsibility for the product lies with them.
Obviously, its use and production falls on the developer, but at least their back is covered.

In any case, there's still much more to write about. It's a long road to its final implementation (in any case, I'm already doing the SBOM... you never know).

[Warfley]

CRA is going to be interesting, because it requires also to consider things like your dependencies. I like FPC, but FPC has no security fixes. Errors in the RTL or FCL are only fixed with new major releases.

The CRA does not mean that you cannot use something like Lazarus or FPC, but you need to consider the risks that arise from this. I wouldn't be confident to rely on e.g. FPWeb from the FCL for a server backend under these conditions. I mean I do use it sometimes in internal networks but for something internet facing?

Those kinds of questions developers need to ask themselves now. I think this is overall a good thing but it's going to be a ride for the first few years I can imaginr

[Thaddy]

but FPC has no security fixes.

Yes it has, quite a few. You read the compiler and RTL like a book, so you know.
They are just not marked as security fixes, (We can discuss that..)
E.g. timing attacks are fixed by Jonas some years ago (maybe 8?) on my request.
MvC also fixed some holes in the rtl the mean time.

But if you mean it is advertised as such? No! In that case you are correct.

[Warfley]

I meant the release schedule. There is a fixes branch but no official release