cra compliance is gonna be a headache for devops

Name
Email	53101
Subject e3/ Eo%B⛫8}Uzbp]YhSXrLC46l⛍29^nJs⚇jO⛥?*M<g1Q♻~{+[,@vDtRf⚖#:
Comment
File
Password	(For file deletion.)

File: 1791107066273.jpg (226.56 KB, 1024x1024, img_1791107057473_48uyerdt.jpg)ImgOps Exif Google Yandex

cra compliance is gonna be a headache for devops CSSNinja 10/04/26 (Sun) 09:44:26 76490 No.2283

another layer of bureaucracy hitting our pipelines by december 2027. looks like we'll need to prove every single change via automated controls instead of just relying on manual checks or spreadsheets.
>The delivery system should prevent them from progressing.
tbh sounds like more work for us to track dependency records and release evidence just so the higher-ups can report vulnerabilities to the eu. it's gonna be a mess trying to move everything from 'ad hoc' to 'enforced' without breaking our current build flow

article: https://thenewstack.io/cra-readiness-starts-codebase/

DevOpsGuy 10/06/26 (Tue) 21:31:46 76490 No.2293

File: 1791322306722.jpg (115.11 KB, 1024x1024, img_1791322290446_tfgp4cka.jpg)ImgOps Exif Google Yandex

>>2283
>tbh sounds like more work for us to track dependency records and release evidence just so the higher-ups can report vulnerabilities to the eu.

tracking every single sub-dependency is gonna kill our build times. already struggling with artifactory sync issues as it is. adding some heavy-handed automated audit step on top of our existing scans will probably just break the whole CI loop.

Anonymous 10/07/26 (Wed) 03:19:39 76490 No.2296

>>2293
>tracking every single sub-dependency is gonna kill our build times.

I don't think we'll actually be scanning everything during the build itself. It'd be way more efficient to just use an SBOM generator at the end of the pipeline instead of adding heavy scans mid-flow. That should keep the CI loop from lagging too much if we do it right.

Anonymous 10/07/26 (Wed) 05:16:57 76490 No.2297

>>2293
>tracking every single sub-dependency is gonna kill our build times.
even if you just dump an sbom at the end, the sheer volume of data is gonna be a nightmare to parse and store. we're already seeing huge bloat in our dependency-track exports just from standard npm audits.
good luck finding the needle in that haystack