The EU Cyber Resilience Act (CRA), in Article 13(5), places a new obligation on manufacturers: they are to "exercise due diligence" when integrating components sourced from third parties, including components of free and open-source software.

The term "due diligence" has a well-understood meaning in legal and business contexts: it denotes a reasonable, documented investigation of risks before making a decision. Applied to OSS components, the natural interpretation is that a manufacturer must actively assess whether a component is cybersecurity-sound before integrating it.

 It seems that almost everyone confronted with this problem reaches for the OpenSSF Scorecard as a natural starting point. The Scorecard is an automated tool that evaluates the security posture of open-source projects against a set of heuristic checks covering areas such as vulnerability management, code review practices, and dependency maintenance, producing a single numeric score. A tool that will score any project hosted on GitHub (and, to some extent, GitLab) is readily available, and many vendors and open-source tools already integrate OpenSSF Scorecard information. On the other hand, not all OSS projects live on GitHub, and not every repository structure is handled well (e.g., mono-repos and mirrors). Moreover, closer examination of the OpenSSF Scorecard reveals that its primary use case is to allow easy self-assessment for projects and to drive them toward specific security practices. This is not to say that Scorecard information cannot be used for third-party assessment, but it was not built with that as its foremost goal and is therefore not a perfect fit.

 What are the alternatives? In this talk, we will look at the landscape of approaches for scoring and evaluating OSS projects, including the OpenSSF Scorecard, CHAOSS, the OSPS Baseline, and approaches taken by some security vendors. We will then step back and assess what can sensibly be achieved for due diligence, given the enormous scale of the task for all but the smallest projects: which information would genuinely be helpful, what would be required to gather it with different degrees of confidence, and how one should respond to negative ratings for a component.

Unfortunately, no finished recipe for achieving compliance with the CRA's due diligence requirement will be presented. As of today, it remains unclear (to the speaker and, arguably, to anyone) precisely what the EU intends due diligence to look like in practice for OSS components. What this talk will offer instead is a clear-eyed picture of the current state. The goal is to leave the audience better equipped to ask the right questions and to make defensible, reasoned choices, even in the absence of definitive answers.

Short Bio:

Bernd Grobauer is a Principal Key Expert at the Technology Field "Cybersecurity and Trust" of Siemens Foundational Technologies, Research and Predevelopment. His current work focuses on automated system hardening and OSS security. He holds a PhD in computer science from Aarhus University, Denmark.