diff --git a/website/content/en/status/report-2026-04-2026-06/freebsd-cra-eurobsdcon-and-security-team.adoc b/website/content/en/status/report-2026-04-2026-06/freebsd-cra-eurobsdcon-and-security-team.adoc new file mode 100644 index 0000000000..a0a4df599e --- /dev/null +++ b/website/content/en/status/report-2026-04-2026-06/freebsd-cra-eurobsdcon-and-security-team.adoc @@ -0,0 +1,30 @@ +=== FreeBSD, CRA, EuroBSDCon, and Security Team + +Links: + +link:https://alpha-omega.dev[Alpha-Omega -- Linux Foundation Project] URL: link:https://alpha-omega.dev[] + +link:https://freebsdfoundation.org[FreeBSD Foundation] URL: link:https://freebsdfoundation.org[] + +link:https://www.freebsd.org/security/[FreeBSD Security Information] URL: link:https://www.freebsd.org/security/[] + +link:https://2026.eurobsdcon.org[EuroBSDCon 2026] URL: link:https://2026.eurobsdcon.org[] + +Contact: Pierre Pronchery + +This quarter marked the beginning of my participation to Alpha-Omega's new initiative around AI. +The new wave of LLM-assisted disclosures of security vulnerabilities has been hard to miss, and Alpha-Omega is now assisting prominent Open Source ecosystems facing this challenge. +This includes FreeBSD, and given the situation, I have volunteered and been accepted into FreeBSD's security team. +My objective there, besides helping with incoming reports where I can, is to understand existing processes and suggest improvements to facilitate and scale operations. +This started with a new instance of link:https://requesttracker.com/rtir/[RTIR], and with an experimental instance of link:https://forgejo.org[Forgejo] for CI/CD and possible leveraging of LLM integration with the security team's workflow. + +On a related note, and in an effort to facilitate compliance with the European link:https://en.wikipedia.org/wiki/Cyber_Resilience_Act[Cyber Resilience Act] (CRA), link:http://pkgconf.org[pkgconf] was imported at version 2.9.93 in FreeBSD's base system. +This now includes man:spdxtool[1], which supports the generation of link:https://en.wikipedia.org/wiki/Software_supply_chain[Software Bill of Material] (SBOM) conforming to link:https://spdx.github.io/spdx-spec/v3.0.1/[SPDX 3.0.1 specification]. +Together with Tuukka Pasanen, we are offering a framework for review to that effect in link:https://reviews.freebsd.org/D56474[D56474], which still requires polishing before import unfortunately. + +First, it should be updated to reflect the availability of spdxtool (a patch is already available). +More importantly, finding the correct granularity for the amount of SBOM files to generate while fitting FreeBSD's build system was not easy. +This explains the metadata still missing in some cases; we are working on it for an approach as consistent as possible from the start. +Lastly, I apologize in advance for the 1.000+ files added to the coming release; hopefully, this will be mitigated by the switch to pkgbase, with which we believe it will fit perfectly. +The SBOM files are expected to be automatically provided in the corresponding packages installed, allowing subsequent SBOM tooling to function with the exact knowledge of the system's status as installed. + +In this context, I am glad to announce that Alice Sowerby, Peter Hansteen, and myself are teaming up to host a workshop about CRA compliance for BSD-based systems during the coming EuroBSDCon conference in Brussels, this September 2026. +You are welcome to join us there for practical information about CRA compliance in our ecosystem! + +Sponsor: Alpha-Omega, The FreeBSD Foundation