=== FreeBSD, CRA, EuroBSDCon, and Security Team

Links: +
link:https://alpha-omega.dev[Alpha-Omega -- Linux Foundation Project] URL: link:https://alpha-omega.dev[] +
link:https://freebsdfoundation.org[FreeBSD Foundation] URL: link:https://freebsdfoundation.org[] +
link:https://www.freebsd.org/security/[FreeBSD Security Information] URL: link:https://www.freebsd.org/security/[] +
link:https://2026.eurobsdcon.org[EuroBSDCon 2026] URL: link:https://2026.eurobsdcon.org[]

Contact: Pierre Pronchery <pierre@freebsdfoundation.org>

This quarter marked the beginning of my participation to Alpha-Omega's new initiative around AI.
The new wave of LLM-assisted disclosures of security vulnerabilities has been hard to miss, and Alpha-Omega is now assisting prominent Open Source ecosystems facing this challenge.
This includes FreeBSD, and given the situation, I have volunteered and been accepted into FreeBSD's security team.
My objective there, besides helping with incoming reports where I can, is to understand existing processes and suggest improvements to facilitate and scale operations.
This started with a new instance of link:https://requesttracker.com/rtir/[RTIR], and with an experimental instance of link:https://forgejo.org[Forgejo] for CI/CD and possible leveraging of LLM integration with the security team's workflow.

On a related note, and in an effort to facilitate compliance with the European link:https://en.wikipedia.org/wiki/Cyber_Resilience_Act[Cyber Resilience Act] (CRA), link:http://pkgconf.org[pkgconf] was imported at version 2.9.93 in FreeBSD's base system.
This now includes man:spdxtool[1], which supports the generation of link:https://en.wikipedia.org/wiki/Software_supply_chain[Software Bill of Material] (SBOM) conforming to link:https://spdx.github.io/spdx-spec/v3.0.1/[SPDX 3.0.1 specification].
Together with Tuukka Pasanen, we are offering a framework for review to that effect in link:https://reviews.freebsd.org/D56474[D56474], which still requires polishing before import unfortunately.

First, it should be updated to reflect the availability of spdxtool (a patch is already available).
More importantly, finding the correct granularity for the amount of SBOM files to generate while fitting FreeBSD's build system was not easy.
This explains the metadata still missing in some cases; we are working on it for an approach as consistent as possible from the start.
Lastly, I apologize in advance for the 1.000+ files added to the coming release; hopefully, this will be mitigated by the switch to pkgbase, with which we believe it will fit perfectly.
The SBOM files are expected to be automatically provided in the corresponding packages installed, allowing subsequent SBOM tooling to function with the exact knowledge of the system's status as installed.

In this context, I am glad to announce that Alice Sowerby, Peter Hansteen, and myself are teaming up to host a workshop about CRA compliance for BSD-based systems during the coming EuroBSDCon conference in Brussels, this September 2026.
You are welcome to join us there for practical information about CRA compliance in our ecosystem!

Sponsor: Alpha-Omega, The FreeBSD Foundation