git: 488edce7c9 - main - Status/2026Q2: add report

The branch main has been updated by salvadore:

URL: https://cgit.FreeBSD.org/doc/commit/?id=488edce7c9a5d156146bcaf645823655b09efc7e

commit 488edce7c9a5d156146bcaf645823655b09efc7e
Author:     Pierre Pronchery <[email protected]>
AuthorDate: 2026-07-06 07:03:44 +0000
Commit:     Lorenzo Salvadore <[email protected]>
CommitDate: 2026-07-20 11:59:32 +0000

    Status/2026Q2: add report
    
    This is titled "FreeBSD, CRA, EuroBSDCon, and Security Team".
    
    Sponsored by:   The FreeBSD Foundation
    Pull Request:   https://github.com/freebsd/freebsd-doc/pull/691
---
 .../freebsd-cra-eurobsdcon-and-security-team.adoc  | 30 ++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/website/content/en/status/report-2026-04-2026-06/freebsd-cra-eurobsdcon-and-security-team.adoc b/website/content/en/status/report-2026-04-2026-06/freebsd-cra-eurobsdcon-and-security-team.adoc
new file mode 100644
index 0000000000..a0a4df599e
--- /dev/null
+++ b/website/content/en/status/report-2026-04-2026-06/freebsd-cra-eurobsdcon-and-security-team.adoc
@@ -0,0 +1,30 @@
+=== FreeBSD, CRA, EuroBSDCon, and Security Team
+
+Links: +
+link:https://alpha-omega.dev[Alpha-Omega -- Linux Foundation Project] URL: link:https://alpha-omega.dev[] +
+link:https://freebsdfoundation.org[FreeBSD Foundation] URL: link:https://freebsdfoundation.org[] +
+link:https://www.freebsd.org/security/[FreeBSD Security Information] URL: link:https://www.freebsd.org/security/[] +
+link:https://2026.eurobsdcon.org[EuroBSDCon 2026] URL: link:https://2026.eurobsdcon.org[]
+
+Contact: Pierre Pronchery <[email protected]>
+
+This quarter marked the beginning of my participation to Alpha-Omega's new initiative around AI.
+The new wave of LLM-assisted disclosures of security vulnerabilities has been hard to miss, and Alpha-Omega is now assisting prominent Open Source ecosystems facing this challenge.
+This includes FreeBSD, and given the situation, I have volunteered and been accepted into FreeBSD's security team.
+My objective there, besides helping with incoming reports where I can, is to understand existing processes and suggest improvements to facilitate and scale operations.
+This started with a new instance of link:https://requesttracker.com/rtir/[RTIR], and with an experimental instance of link:https://forgejo.org[Forgejo] for CI/CD and possible leveraging of LLM integration with the security team's workflow.
+
+On a related note, and in an effort to facilitate compliance with the European link:https://en.wikipedia.org/wiki/Cyber_Resilience_Act[Cyber Resilience Act] (CRA), link:http://pkgconf.org[pkgconf] was imported at version 2.9.93 in FreeBSD's base system.
+This now includes man:spdxtool[1], which supports the generation of link:https://en.wikipedia.org/wiki/Software_supply_chain[Software Bill of Material] (SBOM) conforming to link:https://spdx.github.io/spdx-spec/v3.0.1/[SPDX 3.0.1 specification].
+Together with Tuukka Pasanen, we are offering a framework for review to that effect in link:https://reviews.freebsd.org/D56474[D56474], which still requires polishing before import unfortunately.
+
+First, it should be updated to reflect the availability of spdxtool (a patch is already available).
+More importantly, finding the correct granularity for the amount of SBOM files to generate while fitting FreeBSD's build system was not easy.
+This explains the metadata still missing in some cases; we are working on it for an approach as consistent as possible from the start.
+Lastly, I apologize in advance for the 1.000+ files added to the coming release; hopefully, this will be mitigated by the switch to pkgbase, with which we believe it will fit perfectly.
+The SBOM files are expected to be automatically provided in the corresponding packages installed, allowing subsequent SBOM tooling to function with the exact knowledge of the system's status as installed.
+
+In this context, I am glad to announce that Alice Sowerby, Peter Hansteen, and myself are teaming up to host a workshop about CRA compliance for BSD-based systems during the coming EuroBSDCon conference in Brussels, this September 2026.
+You are welcome to join us there for practical information about CRA compliance in our ecosystem!
+
+Sponsor: Alpha-Omega, The FreeBSD Foundation