v1.0.0 First Stable Release

CRANE provides essential complete workflows for the Cyber Resilience Act.

• 📦 Product Registry
• 🏷️ Version & Release Management
• 📋 SBOM Analysis (CycloneDX & SPDX)
• 🛡️ Vulnerability Management
• 📈 EPSS Risk Prioritization
• ✅ CRA Compliance Matrix
• 📝 Audit Trail
• 🚦 Release Gates
• ⚠️ Risk Assessments
• 📂 Evidence Repository
• 👥 Team Collaboration

Thank you to everyone who tested the pre-release versions and provided feedback!

v0.1.0 — Initial Release

CRANE v0.1.0 — Initial Public Release

First open-source release of CRANE, a self-hosted compliance management platform for the EU Cyber Resilience Act.

What's included

• Product registry with release lifecycle management
• SBOM analysis — quality scoring, CRA Phase 2 validation, NTIA compliance, diff view
• Vulnerability management — PSIRT workflow, CVE tracking, EPSS scoring, VEX assessments
• Release gate workflow with evidence management
• CRA Annex I requirement coverage matrix
• Risk assessments (STRIDE / TARA / custom methodology)
• CVD policy management and security advisories
• Substantial change assessment (Article 3(4))
• Lifecycle alerts and end-of-support monitoring
• Role-based access control with LDAP / Active Directory integration
• Immutable audit trail
• One-line installer for Linux, macOS, and Windows

Quick start

First install docker Desktop and then run the following command:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/cra-norm-engine/crane/main/install.sh | bash

# Windows PowerShell
irm https://raw.githubusercontent.com/cra-norm-engine/crane/main/install.ps1 | iex