Skip to content

Cyber Resilience Act (CRA)

The EU Cyber Resilience Act (Regulation 2024/2847) introduces mandatory cybersecurity requirements for products with digital elements placed on the EU market. This page describes what Algol provides towards CRA compliance.

What Algol provides

Software Bill of Materials (SBOM)

A CycloneDX SBOM is generated per container image at each release. The sbom/ directory at the repository root contains:

  • One .cyclonedx.json file per published image (e.g. algol-app-algold-v0.41.0.cyclonedx.json)
  • A manifest.json linking each image name, ECR digest, and SBOM file for the release

SBOMs enumerate all software components and their versions, enabling downstream vulnerability analysis with standard tooling (Grype, Trivy, Dependency-Track, etc.).

Security updates via OTA

Algol is deployed on TorizonOS and updated over-the-air through Torizon Cloud. This provides a controlled, auditable update path for security patches throughout the product lifetime without requiring physical access to field-deployed devices.

Hardened runtime

Each module runs in its own Docker container with a read-only root filesystem. Writable storage is limited to explicitly declared volumes and tmpfs mounts (/run, /tmp):

read_only: true
tmpfs:
  - /run
  - /tmp
volumes:
  - algol-config:/run/algol/config   # persisted configs only

This minimises the attack surface and prevents persistence of malicious modifications across reboots.

Secret management

Secrets (cloud credentials, S3 keys, NATS NKey files) are never stored in plaintext in configuration files. The configuration system uses a reference-based secret model (see ADR-004): configuration values that require secrets carry a secret component reference, which is resolved at configuration-apply time by the secret manager rather than embedded in the config payload.

Versioned, traceable releases

Every production release is a tagged Git commit published as a GitHub Release with machine-generated changelogs. Each container image is pushed to ECR with an immutable content digest, and the SBOM manifest records the digest alongside the SBOM file, making every release fully traceable from binary back to source.

Customer responsibilities

Algol provides the artefacts and infrastructure listed above. The following remain the responsibility of the system integrator or product manufacturer placing the device on the EU market:

  • Defining and publishing a Vulnerability Disclosure Policy (VDP)
  • Running SBOM-based vulnerability scans against the published SBOMs and acting on findings
  • Maintaining a security contact and incident-response process
  • Ensuring the OTA update mechanism is enabled and operational on deployed devices
  • Conducting product-level risk assessment and conformity documentation as required by CRA Annex I