Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Cyber Resilience Act: what applies to Pyronear?

Aperta
  • Qualcosa non va?
#40 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Documentazione
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
security
Ambito
security

Direzione di ricerca

Start by reviewing the Cyber Resilience Act and the referenced Radio Equipment Directive cybersecurity rules, then assess each product separately: detection stations, the hosted platform and API, and community-built stations. Record Pyronear’s role, which products are in scope, applicable obligations and dates, and whether a gap audit or follow-up issues are needed; the issue is done when the verdict and any required next steps are recorded.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

P2 T2-27

Context

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) sets security rules for "products with digital elements" placed on the EU market: hardware with software, and software sold or supplied in a commercial activity. Products in scope must carry the CE marking for cybersecurity. The obligation to report actively exploited vulnerabilities and severe incidents applies since September 2026, and the rest (security by design, updates, documentation, CE marking) from end of 2027 (dates to confirm).

Pyronear builds open-source software and also assembles and installs stations. First reading: Pyronear is mainly an open-source software steward (lighter regime), but since we sometimes produce stations, we are probably a manufacturer for those, so concerned at least a little. The answer must be given product by product. A contributor analyses the topic and gives a clear verdict before any technical work.

What has to be done

Step 1: role and scope (deliverable: the verdict)

  • Decide Pyronear's role separately for each product:
    • Detection stations / boxes (hardware + pyro-engine): likely manufacturer when Pyronear produces them. Are they sold, rented or given? Who places them on the market, Pyronear or the partner?
    • Platform and API supplied as a service: steward of open-source software, or a paid service in a commercial activity?
    • Homemade / community stations: who is the manufacturer when someone builds their own from our open-source code?
  • Check what already applies to the station as radio equipment (CE marking under RED and its cybersecurity delegated act) (to confirm).
  • Write the verdict in this issue: role, products in scope, obligations and dates.

Step 2: gap audit (only if Pyronear is in scope)

  • SBOM for each product in scope.
  • Vulnerability reporting procedure, and a SECURITY.md in each repo.
  • Secure updates for stations (signed, tracked, can be rolled out to the whole fleet).
  • No default password on stations and services.
  • Secrets management (tokens, credentials on stations and in deployments).

Step 3: technical work (only if the verdict calls for it)

  • Open the technical issues in the right repos and group them in an epic.

Open questions

  • Is there a person or partner (legal or association network) who can confirm the verdict?
  • Do partners who buy or host stations expect a CE / CRA statement from us?

Done when

  • Verdict written: Pyronear's role and the list of products concerned
  • If in scope: gap audit done on the five points above
  • If needed: technical issues and epic created, or a decision recorded that nothing is needed
Lingua principale
Nessun dato sulla lingua
Stelle
0
Fork
0
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di pyronear/roadmap

Tutte le issue di pyronear/roadmap

Issue simili

Altre issue su Security

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.