Skip to main content
Determinate Systems logo
Nix for the EU Cyber Resilience Act

The CRA asks what you ship, and Nix already knows

The EU Cyber Resilience Act turns on a question Nix answers by construction: what is actually inside the thing you shipped? Determinate turns that answer into machine-readable evidence, generated on every build.

Contact salesRead our CRA analysisThe regulation (opens in a new tab)
Secure Packages: Due diligence over open source components

Due diligence over open source components

Article 13(5) makes the security posture of every third-party component your responsibility. Determinate Secure Packages is a curated package set maintained by Nix security specialists, so that obligation has an owner instead of a 100,000-package blind spot.
Secure Packages
FlakeBOM: Machine-readable SBOMs on every build

Machine-readable SBOMs on every build

Annex I asks for a bill of materials in a commonly used, machine-readable format, kept current. FlakeBOM generates CycloneDX SBOMs straight from your flakes, fast enough to run as a build artifact rather than a document somebody maintains by hand.
FlakeBOM
How Nix makes this possible: Your whole closure, not just top-level dependencies

Your whole closure, not just top-level dependencies

The regulation sets top-level dependencies as the floor. A Nix closure is the complete transitive set by definition, and FlakeBOM reaches inside vendored blobs to list what's there with PURL identifiers attached.
How Nix makes this possible
FlakeAudit: A gate against known exploitable vulnerabilities

A gate against known exploitable vulnerabilities

Products have to reach the market without known exploitable vulnerabilities. You write that rule in a flakeaudit.toml policy, and flakeaudit check exits non-zero on a violation, so the requirement is enforced by CI rather than by a review meeting.
FlakeAudit
Introducing FlakeAudit: Evidence ready for the 24-hour clock

Evidence ready for the 24-hour clock

Article 14 gives you 24 hours for an early warning and 72 for a fuller notification. flakeaudit scan writes advisory data from the NVD and osv.dev back into your SBOMs, so "which products contain this?" is a query against documents you already have.
Introducing FlakeAudit
About the SLA: Remediation on a clock somebody is accountable for

Remediation on a clock somebody is accountable for

Article 13(8) sets a support period of at least five years, and the essential requirements say vulnerabilities get addressed without delay. Determinate Secure Packages patches critical CVEs within a contractual 7-day SLA.
About the SLA (opens in a new tab)
About VEX: Triage that travels with the artifact

Triage that travels with the artifact

Not every advisory that matches a component is exploitable in your product. We record that analysis as Vulnerability Exploitability eXchange (VEX) data on the packages themselves, and it rides along in the SBOM.
About VEX (opens in a new tab)
Verifiable provenance: Build records that double as technical documentation

Build records that double as technical documentation

Annex VII asks for a description of how your product is designed, developed, and produced. Every Nix build is described by a derivation recording the builder, the inputs, the patches, and the system, kept whether or not anybody asks.
Verifiable provenance
FlakeAudit: Change reporting between releases

Change reporting between releases

flakeaudit compare diffs two SBOMs using Nix-specific metadata, answering "what changed in this release?" precisely. That question comes up during an incident, during an audit, and for years afterward.
FlakeAudit

Start with the part that's expensive to retrofit

No vendor can make you CRA compliant, since the risk assessment, the conformity assessment, and the reporting process live with your security and legal teams. What Determinate covers is the foundation underneath all of it: knowing exactly what you ship, keeping it patched on a schedule somebody is accountable for, and producing machine-readable evidence of both automatically.

  • Critical CVEs patched within a contractual 7-day SLA
  • CycloneDX SBOMs generated straight from your flakes
  • Policy violations that fail CI instead of surfacing at audit time
  • Curated CPE identifiers and VEX triage on every package
Explore
The platform

Three products, one evidence trail

Determinate Nix makes the build reproducible and introspectable, Determinate Secure Packages puts a maintained security posture behind the components you didn't write, and FlakeHub distributes the result with its provenance intact.

Guides and resources

  • The EU Cyber Resilience Act is coming

    The EU Cyber Resilience Act is coming

    Our full analysis of what the CRA requires of your supply chain, why Nix is built right for those requirements, and how to prepare before each deadline.

  • Derivations, sandboxing, and closures: the Nix supply chain

    Derivations, sandboxing, and closures: the Nix supply chain

    The deep dive on how sandboxed builds and content-addressed closures make provenance a property of the build itself.

  • Introducing FlakeBOM

    Introducing FlakeBOM

    How FlakeBOM generates CycloneDX SBOMs from any Nix flake, with comprehensive metadata and vendored-dependency detection.

  • Introducing FlakeAudit

    Introducing FlakeAudit

    How FlakeAudit evaluates CycloneDX SBOMs against custom policies, scans for known vulnerabilities, and compares SBOMs over time.

  • Software supply chain security

    Software supply chain security

    The wider picture: reproducible builds, curated packages, signed distribution, and compliance-ready infrastructure.

  • The Cyber Resilience Act at the European Commission

    The Cyber Resilience Act at the European Commission (opens in a new tab)

    The Commission's own overview of the regulation, its scope, and its timeline.

Explore more solutions