--- title: What’s in the SOSS? Podcast #69 – S3E21 Watering the... description: A podcast episode features Roman Zhukov, co-chair of the OpenSSF Global Cyber Policy Working Group and Security Communities Lead at Red Hat, explaining the EU... canonical: https://daily.dev/posts/what-s-in-the-soss-podcast-69-s3e21-watering-the-community-garden-navigating-the-eu-cra-for-ope-ela77x7o0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What’s in the SOSS? Podcast #69 – S3E21 Watering the Community Garden: Navigating the EU CRA for Open Source with Roman Zhukov – Open Source Security Foundation | daily.dev og:description: A podcast episode features Roman Zhukov, co-chair of the OpenSSF Global Cyber Policy Working Group and Security Communities Lead at Red Hat, explaining the EU... og:url: https://daily.dev/posts/what-s-in-the-soss-podcast-69-s3e21-watering-the-community-garden-navigating-the-eu-cra-for-ope-ela77x7o0 og:image: https://api.daily.dev/og/posts/eLA77x7o0.png og:image:alt: What’s in the SOSS? Podcast #69 – S3E21 Watering the Community Garden: Navigating the EU CRA for Open Source with Roman Zhukov – Open Source Security Foundation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What’s in the SOSS? Podcast #69 – S3E21 Watering the Community Garden: Navigating the EU CRA for Open Source with Roman Zhukov – Open Source Security Foundation **[OpenSSF](https://daily.dev/sources/openssf)** · 34 min read · 0 upvotes · 0 comments ## Summary A podcast episode features Roman Zhukov, co-chair of the OpenSSF Global Cyber Policy Working Group and Security Communities Lead at Red Hat, explaining the EU Cyber Resilience Act (CRA) using a community garden analogy to define maintainers, stewards, and manufacturers. The conversation covers findings from the 2026 CRA Awareness and Readiness Report, including that 66% of organizations remain unaware of the regulation, over 70% of North American software producers are unfamiliar with it, and maintaining private forks costs organizations over $250,000 per release cycle in engineering overhead. Key CRA deadlines are discussed: vulnerability reporting obligations begin September 2026, with full compliance required by December 2027. The discussion also touches on AI-generated vulnerability report spam, the end of the 'consume and forget' open source model, and free OpenSSF resources like OSPS, SLSA, Gemara, GUAC, and a free CRA training course. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When do the EU Cyber Resilience Act vulnerability reporting obligations take effect? Organizations subject to the EU Cyber Resilience Act must begin reporting vulnerabilities and severe incidents to authorities starting September 2026, ahead of the full compliance deadline of December 2027, after which non-compliant hardware and software vendors will be unable to sell products in the EU market. _daily.dev helps teams tracking regulatory deadlines like the CRA stay ahead of compliance work._ ### How much does maintaining a private fork of an open source project cost compared to contributing upstream? Maintaining private forks costs organizations more than $250,000 per release cycle in engineering labor, according to the 2026 CRA Awareness and Readiness Report. This 'rebase tax' comes from manually porting patches over every new upstream release, whereas upstreaming changes lets the community inherit maintenance and reduces long-term legal risk exposure under the CRA. _engineers weighing forking versus upstreaming can follow this trade-off discussion on daily.dev._ ### Who is exempt from the EU Cyber Resilience Act as an open source maintainer? Independent maintainers doing non-commercial open source work are completely exempt from the CRA and fall out of scope of the regulation. Obligations instead fall on stewards, such as foundations like OpenSSF or Linux Foundation that set baseline policies for hosted projects, and manufacturers, companies that sell commercial products built on open source code, who bear the full legal liability. _daily.dev surfaces regulatory shifts like this for developers navigating open source compliance roles._ ## Similar posts on daily.dev - [What’s in the SOSS? Navigating the EU Cyber Resilience Act with Madalin Neag](https://daily.dev/posts/what-s-in-the-soss-navigating-the-eu-cyber-resilience-act-with-madalin-neag-51ysfd9dr) · OpenSSF · 0 upvotes · 0 comments - [CRA Readiness for Open Source Communities](https://daily.dev/posts/cra-readiness-for-open-source-communities-txer6gy10) · OpenSSF · 0 upvotes · 0 comments - [The EU CRA Doesn’t Change What Good Open Source Governance Looks Like. It Just Makes the Accountability Visible.](https://daily.dev/posts/the-eu-cra-doesn-t-change-what-good-open-source-governance-looks-like-it-just-makes-the-accountabil-ktb7v0fog) · Security Boulevard · 0 upvotes · 0 comments - [The CRA Readiness Reality: What Changed \(and What Didn’t\) Between 2025 and 2026?](https://daily.dev/posts/the-cra-readiness-reality-what-changed-and-what-didn-t-between-2025-and-2026--gnnp5ktpp) · Linux Foundation · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#compliance](https://daily.dev/tags/compliance) [View this post on daily.dev](https://daily.dev/posts/what-s-in-the-soss-podcast-69-s3e21-watering-the-community-garden-navigating-the-eu-cra-for-ope-ela77x7o0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What’s in the SOSS? Podcast #69 – S3E21 Watering the Community Garden: Navigating the EU CRA for Open Source with Roman Zhukov – Open Source Security Foundation","url":"https://daily.dev/posts/what-s-in-the-soss-podcast-69-s3e21-watering-the-community-garden-navigating-the-eu-cra-for-ope-ela77x7o0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-s-in-the-soss-podcast-69-s3e21-watering-the-community-garden-navigating-the-eu-cra-for-ope-ela77x7o0"},"datePublished":"2026-08-18T17:17:14.189Z","dateModified":"2026-08-18T17:48:35.949Z","description":"A podcast episode features Roman Zhukov, co-chair of the OpenSSF Global Cyber Policy Working Group and Security Communities Lead at Red Hat, explaining the EU...","image":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","thumbnailUrl":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","isAccessibleForFree":true,"articleSection":"OpenSSF","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"OpenSSF","logo":"https://media.daily.dev/image/upload/s--l6RJ5uPj--/f_auto,q_auto/v1774959959/logos/openssf?_a=BAMAMiWQ0","url":"https://daily.dev/sources/openssf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-s-in-the-soss-podcast-69-s3e21-watering-the-community-garden-navigating-the-eu-cra-for-ope-ela77x7o0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,compliance","timeRequired":"PT34M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"OpenSSF","item":"https://daily.dev/sources/openssf"},{"@type":"ListItem","position":3,"name":"What’s in the SOSS? Podcast #69 – S3E21 Watering the Community Garden: Navigating the EU CRA for Open Source with Roman Zhukov – Open Source Security Foundation"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-s-in-the-soss-podcast-69-s3e21-watering-the-community-garden-navigating-the-eu-cra-for-ope-ela77x7o0#faq","mainEntity":[{"@type":"Question","name":"When do the EU Cyber Resilience Act vulnerability reporting obligations take effect?","acceptedAnswer":{"@type":"Answer","text":"Organizations subject to the EU Cyber Resilience Act must begin reporting vulnerabilities and severe incidents to authorities starting September 2026, ahead of the full compliance deadline of December 2027, after which non-compliant hardware and software vendors will be unable to sell products in the EU market. daily.dev helps teams tracking regulatory deadlines like the CRA stay ahead of compliance work."}},{"@type":"Question","name":"How much does maintaining a private fork of an open source project cost compared to contributing upstream?","acceptedAnswer":{"@type":"Answer","text":"Maintaining private forks costs organizations more than $250,000 per release cycle in engineering labor, according to the 2026 CRA Awareness and Readiness Report. This 'rebase tax' comes from manually porting patches over every new upstream release, whereas upstreaming changes lets the community inherit maintenance and reduces long-term legal risk exposure under the CRA. engineers weighing forking versus upstreaming can follow this trade-off discussion on daily.dev."}},{"@type":"Question","name":"Who is exempt from the EU Cyber Resilience Act as an open source maintainer?","acceptedAnswer":{"@type":"Answer","text":"Independent maintainers doing non-commercial open source work are completely exempt from the CRA and fall out of scope of the regulation. Obligations instead fall on stewards, such as foundations like OpenSSF or Linux Foundation that set baseline policies for hosted projects, and manufacturers, companies that sell commercial products built on open source code, who bear the full legal liability. daily.dev surfaces regulatory shifts like this for developers navigating open source compliance roles."}}]} ```