The results of the general voting (GR, general resolution) conducted by Debian project developers, involved in package maintenance and infrastructure support, have been published. The statement expressing the project's position regarding the proposed Cyber Resilience Act (CRA) legislation in the European Union has been approved. The bill introduces additional requirements for software producers aimed at enhancing security, disclosing incident information, and promptly addressing vulnerabilities throughout the product lifecycle. <\/p>\n
In case of non-compliance, fines may be imposed, reaching up to 15 million euros or 2.5% of the company's annual turnover. Following the bill's adoption, producers will be required to provide means for delivering vulnerability fixes, conduct assessments of security-related risks before bringing a product to market, perform security testing (mandatory external audits for critical systems), address vulnerabilities throughout the entire lifecycle, and report security incident information within 24 hours of detecting an issue. <\/p>\n
Despite the prevailing trends suggesting that the bill will primarily affect commercial software producers, the community is concerned about its negative impact on the open-source development ecosystem. They view the bill as a factor hindering the advancement of open projects and obstructing the development of open-source software as an international movement. Companies developing products based on international open projects or using open libraries will be held accountable for security issues and inadequate remediation of vulnerabilities in the code, even if that code is written by enthusiasts from other countries. It is anticipated that these additional business risks will lessen the appeal of creating software based on open source. <\/p>\n
At the same time, the legal consequences may also affect independent projects that include code from commercial product manufacturers. For instance, there is uncertainty regarding liability in cases where open source code developed by a commercial company can be transferred to third-party non-profit projects and used in Linux distributions. <\/p>\n
The bill introduces legal liability for non-compliance with safety requirements, which conflicts with Debian's social commitments to distribute software for any purpose without restrictions. Debian does not track the involvement of code in commercial projects, the employment of developers, or the funding sources for developments included in the distribution. Therefore, imposing the requirements outlined in the bill increases legal risks when using the distribution. <\/p>\n
There is a risk that upstream projects may stop providing their code due to concerns about falling under the CRA and facing related penalties. The CRA may also complicate the process of sharing open-source code with the community \u2014 developers will have to evaluate the potential legal consequences before releasing their code. Additionally, the bill reduces the attractiveness of an open development process, as work is conducted in public and is transparent to all, and code can be used in the development process, allowing CRA requirements to apply during the product's development, while proprietary software is developed behind closed doors and falls under the law only after the final release. <\/p>\n
Debian developers are calling for a complete removal of the open development process from the scope of the CRA and for the law to only apply to final products. It is also proposed that CRA requirements should not apply to products from individual entrepreneurs and small businesses, as they cannot meet all the requirements set by the CRA and would be forced to shut down their business. <\/p>\n