CRA? [LWN.net]

CRA?

Posted Jul 21, 2025 21:49 UTC (Mon) by intelfx (subscriber, #130118)
In reply to: CRA? by philh
Parent article: The end of Clear Linux

> The EU's Cyber Resiliency Act has the potential to cost commercial entities large amounts in fines if they are found to have done a poor job on software released to the market.

> <...> or nobody's problem since non-profits seem to mostly get a free-pass

I think it was discussed multiple times (not sure where though; either here or on Lobsters) that for the purposes of CRA "releasing [software] to the market" carries a very specific meaning, which is explicitly not applicable to free (and gratis) software projects publicly released on the Internet — even if they are developed by large corporations, I believe?

I hope I'm not misstating this, though. Perhaps someone more knowledgeable could clarify.

to post comments

CRA?

Posted Jul 21, 2025 23:37 UTC (Mon) by Wol (subscriber, #4433) [Link] (2 responses)

I think the technical term is "place on the market", not release, but yes. It has a very particular meaning, which can basically be summed up as "advertised for sale". So Free Software, by definition, can NOT be "placed on the market".

There's nothing stopping a manufacturer taking out a support contract with the team behind a Free Software product, at which point in a sense the software has been placed on the market, but legally it's the support contract.

The point of the CRA is that all software must come with the digital equivalent of a CE mark - an official certificate that confirms the software complies with European rules. And a CE mark is a game of "follow the contract" - there *must* be a chain of liability, and without a contract that chain is broken.

The neat thing also, is that if a manufacturer takes a FLOSS program and includes it in their product, without a support contract not only are they on the hook for fixing any relevant bugs, but they are obliged to offer their fixes to upstream. Although, as ?pizza pointed out a long while ago, if the bug is in functionality they don't use, the fix could be as simple as ripping that functionality out. A fix that upstream is unlikely to accept. This is counterbalanced, however, by the fact they are now maintaining a (potentially costly) fork, so it's in their interests to get a proper fix in. Even if it is just a build-time switch to disable the functionality, that they always enable. But that will motivate other people to fix the problem ...

Cheers,
Wol

CRA?

Posted Jul 22, 2025 9:10 UTC (Tue) by philh (subscriber, #14797) [Link] (1 responses)

I'm not a lawyer, but having heard lawyers discuss this I don't think it's quite this straight-forward.

Let's say a vendor were to release a (perhaps vast, perhaps obfuscated) patch against e.g. the kernel, that makes their hardware run faster than the competition, I think a court might well agree that even though the software is free, it's being released for reasons of commercial gain and so when the patch turns out to be buggy, the CRA should apply.

If that's correct, then it's wise to switch to working exclusively upstream, and if vendors learn that lesson it will be better than all the unmaintainable vendor patches we've seen in the past, so that would be a symptom of the CRA doing its job.

CRA?

Posted Jul 22, 2025 10:51 UTC (Tue) by Wol (subscriber, #4433) [Link]

I like that :-) I don't think it works quite the way you describe, though :-)

> Let's say a vendor were to release a (perhaps vast, perhaps obfuscated) patch against e.g. the kernel, that makes their hardware run faster than the competition, I think a court might well agree that even though the software is free, it's being released for reasons of commercial gain and so when the patch turns out to be buggy, the CRA should apply.

So they're releasing it to encourage people to buy their hardware? From what you say, it's unlikely to be upstreamed, so the patch will be abandon-ware. If it is upstreamed, there's no contract, no formal relationship, the CRA does not apply, and upstream is on the hook (even more reason for upstream to reject it).

> If that's correct, then it's wise to switch to working exclusively upstream, and if vendors learn that lesson it will be better than all the unmaintainable vendor patches we've seen in the past, so that would be a symptom of the CRA doing its job.

Very much so! Because as soon as Red Hat, or Dell, or whoever start selling hardware with linux installed, or support contracts, they now have a contractual relationship, and they ARE on the hook under the CRA, and they will not want to touch this junk with a bargepole!

So this hypothetical vendor, instead of *gaining* by releasing this obfuscated mess, has just given the hardware guys every reason to *avoid* buying their hardware, and given all the distos even more reason to patch their software *out* of their distro in order to avoid liability.

As I keep saying, "follow the contract", which is why big companies can release and support FLOSS, and avoid liability, but because the only way they can avoid liability is also to avoid any contracts, they are forced to be *full* members of the FLOSS community (as far as that software is concerned).

Cheers,
Wol

CRA?

Posted Jul 22, 2025 8:58 UTC (Tue) by kleptog (subscriber, #1183) [Link]

> that for the purposes of CRA "releasing [software] to the market" carries a very specific meaning

Not just the CRA, for all EU law. In many areas the EU is by treaty limited to regulating the common/single market. Saying "placing on the [common/single] market" is just a term of art for "limiting this regulation to that which we actually have authority over".

It's the EU's version of the "interstate commerce clause", except it's 200 years newer. It covers more (trade within a member state can be regulated) and less (private/non-commercial transactions are excluded, even if they cross borders). It also seem less susceptible to scope creep compared to the US version.

CRA?

Posted Jul 22, 2025 9:31 UTC (Tue) by farnz (subscriber, #17727) [Link]

The reason that this is all a bit shaky is that placing on the market as a term of art applies to free (and gratis) software projects, too, and the CRA has very specific exemptions to cover "normal" open source activities. This is quite deliberate, because the Act's drafters do not want to exempt "open core" from the CRA's requirements (e.g. just because a bug is in AOSP should not mean that Google is exempt from the CRA's provisions as they apply to Pixel phones), nor do they want to create a situation where you release a "data collection" app as open source (depending on your Internet services to do anything useful) and get exempted, where your competitor who does all the work on-device is not exempt.

Instead, there's two significant classes of exception, which are intended to cover most FOSS activities:

Where you give away the software for free, separately to hardware, permit onwards distribution under the same terms as direct distribution from you and you neither collect personal data not necessary to the operation of the software, nor accept donations in excess of your costs. This is intended to cover most personal projects; if you take code you wrote, slap a FOSS licence on it, and upload it to Savannah or equivalent services, this exception covers you. It should also cover a lot of corporate open source, but it pushes companies wanting to be under this exception into a place where they have no way to prevent a competitor hiring away their developers and making more money from the project that the originating company did.
Where the previous exception does not apply, but you act as an "open source steward" (which means accepting contributions from outside your organisation on the same terms as you licence the final product, as one example), you are covered, but you cannot be fined for a breach of the Act. You still face the other penalties in the Act (e.g. being required to take the project off the market if you can't fix your security processes quickly enough), but there's no monetary penalty for breaching the Act, only for keeping the project on the market yourself after failing to meet the required schedule for fixing things. This one's meant to cover things like CentOS Stream

In this specific case, Clear Linux should come under the first exception; it doesn't collect personal data, you can't give them money, and you're allowed to redistribute Clear Linux under the same terms as Intel.