Docs
Documentation
How Shipward's command, cra, works, from the first SBOM to the decisions you publish.
Shipward is in use for our own products and is not available to others yet. These pages describe how it works.
Shipward is one command, cra, and a GitHub Action that runs it. It works in your repository and on your machine or
CI runner. It needs no account and uploads nothing.
| Command | What it does |
|---|---|
cra sbom | Writes a CycloneDX 1.6 SBOM of your product |
cra check sbom | Lists the fields the SBOM misses for BSI TR-03183-2 |
cra init | Writes drafts of the CRA documents: security policy, security.txt, user information, declaration of conformity, technical documentation |
cra licences | Lists components without a confirmed licence |
cra scan | Matches the SBOM against public vulnerability data, locally |
cra triage | Records your decisions about advisories (VEX) and exports them as OpenVEX |
cra report | Drafts of the Article 14 reports and their deadlines |
Start with Getting started.
- Getting startedOne settings file, then three commands.
- CRA documentsDrafts of the documents the CRA asks a manufacturer to have, filled in from cra.yaml.
- SBOMA list of every component of your product, in CycloneDX 1.6.
- SBOM fieldsWhich fields Germany's BSI asks for, and which ones your SBOM misses.
- LicencesDeclared licences come from package metadata; the ones you confirm come from you.
- Vulnerability scanEvery component version against public advisories, matched on your machine.
- Decisions (VEX)Record whether an advisory affects your product, and tell your users.
- ReportsThe reports the CRA asks for when a vulnerability is exploited or a severe incident happens, with their deadlines.
- GitHub ActionAll of the above on every push, with the results in the job summary.
- Data sourcesWhat the daily snapshot contains, under which terms, and how cra checks it.
- Security and privacyWhat cra sends, what it keeps, and how to tell us about a problem.