The Cyber Resilience Act (CRA) introduces a subtle but profound shift in how manufacturers must think about open source software. For years, integrating free and open-source software (FOSS) into products largely meant relying on upstream maintainers for fixes, monitoring vulnerabilities, and updating when patches became available. Under the CRA, that passive model no longer holds. In certain situations, a vulnerability

The EU’s growing focus on SBOMs, highlighted in ENISA’s SBOM Landscape Analysis – Towards an Implementation Guide, is a key step toward greater transparency and resilience in software supply chains. SBOMs are rapidly becoming a central building block for cybersecurity governance under the Cyber Resilience Act (CRA) and related frameworks. From Bitsea’s perspective, this direction is both necessary and overdue.

Introduction to the Syscall Exception The syscall exception maps closely to how the Linux kernel exposes its user-space interface. The boundary covered by the syscall note primarily consists of the kernel’s user-space API (UAPI), which is implemented through header files intended for inclusion by user programs. These headers live mainly under the include/uapi/ directory (and its architecture-specific counterparts under arch/*/include/uapi/)