CRA co-sponsor slide track (~15 min)

June 4, 2026 · View on GitHub

Slide: Shortlist towards CRA compliance

Use CRA-Compliance-Shortlist.md — two columns per pillar: your job vs wolfSSL helps.

Pillar	On slide (customer)	wolfSSL
Know your software components	Survey all integrated components: who maintains them? how do you track vulns/releases?	SBOMs for our products; continuous vulnerability management and updates
Implement secure boot	Most influential action today: trusted firmware + update path aligned with complaint/timing rules	wolfBoot
Remote data processing / data in transfer	CRA covers data between device and network — use current crypto and secure protocols	TLS, SSH, MQTTS, …
Vulnerability handling & reporting	Published CVD policy + `security.txt`; 24h ENISA reporting (Art. 14); on-call coverage — process, not a deliverable	wolfSSL `security.txt` + CVD policy as reference templates; advisories; CNA

Bridge to this session: pillar 1 is where the CRA Kit lands (SBOM, auditor packet, scripts).

You will leave with:

Who provides what — what you provide vs what wolfSSL provides
→ CRA-Cheat-Sheet.md (print/PDF)
→ full terms: CRA-Supply-Chain-Glossary.md
A worked example — wolfSSL CRA Kit
→ wolfssl-examples/cra-kit/auditor-packet/
Helper scripts + AI playbook — product SBOM, nest wolfSSL, optional bomsh on Linux CI only
→ SKILL.md for AI-assisted execution (Cursor / agents)

Instead of…	Say…
Learn every acronym	“Cheat sheet for roles; glossary in the same kit.”
wolfSSL is CRA compliant	“Component SBOMs from us; product SBOM and vuln process from you.”
We ship CBOM	“Build properties today; formal CBOM profile on the roadmap.”
You need bomsh	“Usually no — Linux CI only if a contract asks.”
AI is extra	“SKILL.md is the playbook—copy it into Cursor and run the scripts with your tree.”

cd wolfssl-examples/cra-kit
./scripts/validate.sh

Show auditor-packet/product-acme-connect-gateway.cdx.json → wolfSSL component reference.

Optional: show copying SKILL.md into .cursor/skills/wolfssl-cra-kit/.