What the Cyber Resilience Act Actually Requires From a Release Pipeline
The Cyber Resilience Act turns your release pipeline into a regulated control: SBOMs from tooling you already run, signed provenance attached to the artifact, a 24-hour early warning path, and a multi-year rebuild obligation. This short walks the dates that matter, runs the CycloneDX and Syft SBOM passes side by side, and shows where the lockfile and filesystem views diverge. It also covers why an attestation proves how something was built but not what it is for, what the reporting clock demands of an on-call rota, and why a five-year support period is a build infrastructure cost rather than a documentation task. Full post with the commands, the workflow snippets and the annex mapping: https://hackyjs.com/posts/what-the-cyber-resilience-act-actually-requires-from-a-release-pipeline