In use for our own products. Not available yet.
Get your software ready for the Cyber Resilience Act, in your own repository.
Shipward is a command-line tool and a GitHub Action for small software makers. It lists every component of your product, finds known vulnerabilities in them, and keeps your decisions about each one. Everything it makes stays in your repository.
$ cra sbom --version 1.4.0
wrote sbom/sbom.cdx.json (82 components)
$ cra scan
82 components checked against the snapshot of 2026-11-06
Newtonsoft.Json@12.0.1 GHSA-5crp-9r3c-p9vr
rating high; fixed in 13.0.1; EPSS 32.9%
decision: not affected: vulnerable code not
in execute path (2026-11-06)
Advisories: 1. Need a decision or work: 0.
$ cra triage export
wrote sbom/vex.openvex.json (1 statement)The CRA in two dates
The Cyber Resilience Act (Regulation (EU) 2024/2847) covers software that people download and run, when a business supplies it in the EU.
11 September 2026
Report what is exploited
Makers report actively exploited vulnerabilities and severe incidents to ENISA's single reporting platform: an early warning within 24 hours, a notification within 72 hours, then a final report.
11 December 2027
Everything else
A software bill of materials, vulnerability handling, free security updates for the support period, technical documentation, an EU declaration of conformity and the CE marking.
What it does
One tool for the technical side of the work, run where your code already is: on your machine and in your CI.
cra sbom
Software bill of materials
A CycloneDX 1.6 SBOM from your lock files (npm, NuGet, Composer, Go, Python, Maven, Rust, Ruby and more), plus the parts no package manager knows, such as a game engine.
cra check sbom
Missing SBOM fields
Checks the SBOM against Germany's BSI TR-03183-2 and names each component that misses a required field. Hashes, creators and file details are filled in from local files where they exist.
cra scan
Known vulnerabilities
Matches every component version against a daily, signed snapshot of public advisories, on your machine. Shows which ones are known to be exploited (CISA KEV, ENISA EUVD) and their EPSS score.
cra triage
Your decisions, as VEX
An advisory that names a version does not mean your product is affected. Record why, in a file in your repository, and export it as OpenVEX for your users and their scanners.
cra licences
Licences a person checked
Declared licences come from package metadata. The licences you confirm are kept in your repository and written into the SBOM.
uses: soriresitve/shipward
In every build
A GitHub Action runs all of the above on every push and puts the results in the job summary. You choose whether findings fail a build; by default they never do.
Also: drafts of your security policy, security.txt, user information, declaration of conformity and technical documentation (cra init). And when something is exploited: drafts of the 24-hour, 72-hour and final reports, with their deadlines (cra report).
How it works
Your code and your results never leave your hands. The only thing that comes from us is public data, signed.
- Your repository holds a short
cra.yaml, your lock files, and the decisions you made (vex.yaml). - cra runs where you are: your laptop or your CI. It downloads the snapshot files it needs and checks their signature.
- The results are files in your repository: the SBOM, the VEX document and a summary. Nothing is uploaded anywhere.
Principles
Your data stays yours
No account, no upload, no package names sent to us or to anyone else. The snapshot is the same file for everyone.
Signed public data
A daily snapshot from sources whose terms allow it, signed with Ed25519 and checked file by file. A copy older than the one you have is refused.
Facts, not claims
Shipward lists what is present and what is missing. It does not certify anything; a person decides what a finding means.
It reports, you decide
Shipward never blocks, removes or changes your software. Whether a finding stops a release is your setting.
Built for our own products first
Šori rešitve is a one-person software company in Ljubljana. We make an online game, Ludo, that people download, so we prepare for the CRA too. Shipward is the tool we needed and could not find: small, local, and honest about what it knows.
It runs on our own products today. We will decide later whether to offer it to others.