git: fc8d331fd5 - main - Status/2026Q3/freebsd-cra-eurobsdcon-and-security-team.adoc: Add report

The branch main has been updated by salvadore:

URL: https://cgit.FreeBSD.org/doc/commit/?id=fc8d331fd5002bd28ab0b91e755e21852c25e9bf

commit fc8d331fd5002bd28ab0b91e755e21852c25e9bf
Author:     Pierre Pronchery <khorben@FreeBSD.org>
AuthorDate: 2026-10-07 02:07:41 +0000
Commit:     Lorenzo Salvadore <salvadore@FreeBSD.org>
CommitDate: 2026-10-21 11:53:31 +0000

    Status/2026Q3/freebsd-cra-eurobsdcon-and-security-team.adoc: Add report
    
    Pull Request:   https://github.com/freebsd/freebsd-doc/pull/728
---
 .../freebsd-cra-eurobsdcon-and-security-team.adoc  | 40 ++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/website/content/en/status/report-2026-07-2026-09/freebsd-cra-eurobsdcon-and-security-team.adoc b/website/content/en/status/report-2026-07-2026-09/freebsd-cra-eurobsdcon-and-security-team.adoc
new file mode 100644
index 0000000000..896e3341c5
--- /dev/null
+++ b/website/content/en/status/report-2026-07-2026-09/freebsd-cra-eurobsdcon-and-security-team.adoc
@@ -0,0 +1,40 @@
+=== FreeBSD, CRA, EuroBSDCon, and Security Team
+
+Links: +
+link:https://alpha-omega.dev[Alpha-Omega -- Linux Foundation Project] URL: link:https://alpha-omega.dev[] +
+link:https://freebsdfoundation.org[FreeBSD Foundation] URL: link:https://freebsdfoundation.org[] +
+link:https://www.freebsd.org/security/[FreeBSD Security Information] URL: link:https://www.freebsd.org/security/[] +
+
+Contact: Pierre Pronchery <pierre@freebsdfoundation.org>
+
+This is my second quarter in the FreeBSD Foundation as part of Alpha-Omega's Security Engineers In Residence (SEIRs) initiative.
+Thanks to the input received from the Security Team, I have integrated a staging instance of link:https://forgejo.org[Forgejo] with a self-hosted LLM, demonstrating the potential of new capabilities for the Security Team, without breaching any confidentiality requirements.
+This system is capable of dealing with incoming security vulnerability reports, by:
+
+* Drafting an initial response for the submitter
+* Issuing an immediate, automated analysis of the issue submitted
+* Preparing a template for an eventual Security Advisory (SA) or Errata Notice (EN)
+* Checking the SA or EN drafts for conformity
+* Automatically signing the final SA, EN, and corresponding assets
+* Uploading the outcome where appropriate
+
+This is implemented like a typical, modern CI/CD system with Forgejo's runner tool as a GitHub-compatible workflow.
+The aim is to leverage LLM capabilities for our processes, in accordance with the current workflow, without compromising on confidentiality nor on the necessity for quality review by us mortal members of the security team.
+
+Significant polishing is still required, but the corresponding instance in production should be useful even without the LLM part.
+The automation of the more repetitive tasks of the workflow is expected to help us deal with the steady amount of incoming reports, and to extend capabilities from our individual minds into the team as a whole.
+
+In parallel, I have not spared my efforts towards compliance with the European link:https://en.wikipedia.org/wiki/Cyber_Resilience_Act[Cyber Resilience Act] (CRA) for the FreeBSD Project.
+After importing link:http://pkgconf.org[pkgconf] in FreeBSD's base system during the last quarter, I went through a number of iterations for the framework generating link:https://en.wikipedia.org/wiki/Software_supply_chain[Software Bill of Material] (SBOM) artefacts during the build.
+Prepared together with Tuukka Pasanen, the framework is available for review in link:https://reviews.freebsd.org/D56474[D56474] and I now believe it to be a serious candidate for integration.
+I would like to thank everyone who has been providing feedback already!
+This has helped tremendously to find a balance that feels more right than at any time earlier -- at least to me.
+A separate request for review for the meta-data is now available as well, link:https://reviews.freebsd.org/D60352[D60352], which currently generates a total of 218 artefacts for an amd64 build.
+The balance consists of about one artefact per base package generated, as well as one artefact per library actually used during the build.
+This way, the complete chain of dependencies can be tracked, while keeping the granularity close to individual third-party projects or internal components.
+
+I would also like to extend my thanks to Alice Sowerby and to Peter Hansteen for an link:https://events.eurobsdcon.org/2026/talk/RER8UZ/[awesome workshop about CRA compliance] during link:https://2026.eurobsdcon.org[EuroBSDCon 2026] in Brussels, this past September 2026.
+If you have missed it, you may be in luck, as we are gearing up to deliver it again at a future event.
+Do not hesitate to reach out to us if you are interested, together with your rough location and flexibility for travel, so we can have a more accurate impression of the times and places we should aim for.
+
+Sponsor: Alpha-Omega, The FreeBSD Foundation