From 54f7cc2d74d56d12544b35efca6f5b65fc8056b2 Mon Sep 17 00:00:00 2001 From: Devashri Datta Date: Fri, 4 Sep 2026 20:55:17 -0700 Subject: [PATCH] docs: reference OpenChain CRA checklist --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 00a7a70d..6072d141 100644 --- a/README.md +++ b/README.md @@ -437,6 +437,8 @@ cloudsmith download --help Arbitrary JSON metadata can be attached to any package — SBOMs, JFrog BuildInfo documents, or custom payloads. Metadata is validated against the declared content type and stays with the package for its lifetime. +For teams mapping SBOM and vulnerability-handling evidence to EU Cyber Resilience Act (CRA) readiness, the [OpenChain CRA Compliance Requirements & Checklist](https://github.com/OpenChain-Project/CRA-Compliance) provides a community-maintained reference for organizing compliance evidence. This checklist is not legal advice or a conformity assessment. + Metadata can be attached at push time with `cloudsmith push` (see [Attaching Metadata During Push](#attaching-metadata-during-push)) or managed afterwards with the `cloudsmith metadata` command group. To attach metadata to an existing package: