CRA Technical File

This page is for operators assembling EU Cyber Resilience Act technical documentation. The CRA technical-file export builds deterministic Annex VII-style evidence from existing Stella artifacts — SBOMs, attestations, audit slices, control references, support policy, and signed release metadata — without publishing anything or asserting a conformity route.

Claim boundary: manufacturer-customer-support for customer products and manufacturer-self when the product is Stella itself.

This surface is one of the CRA Assurance Packs. Public disclosure readiness is handled separately by the CRA publication preflight gate.

Source Docs

• CRA Technical File v1
• Assurance Evidence Export v1
• ExportCenter architecture
• CLI export command guide
• CRA technical-file CLI guide
• CRA gap-closure research

Runtime Boundary

ExportCenter owns the adapter and bundle lifecycle. The technical-file bundle is evidence-pointer-first and should preserve references to immutable Evidence Locker bundles when supplied.

The export does not publish anything publicly and does not imply a conformity route. Publication preflight and conformity-assessment overlays are separate surfaces.

The generic ExportCenter Assurance profile id is cra.technical-file, backed by adapter id cra:tech-file and the compatibility command stella export cra-tech-file.

Readiness

The export may be locally runnable with file-backed inputs, but production readiness requires configured signing and tenant or product trust roots. Missing inputs should appear as explicit blockers in the bundle, not silent omissions.

Generic readiness checks signed-export storage, signing key/provider, and tenant export trust roots. CRA live-publication preflight is reported separately and must not block local signed technical-file generation unless the operator is attempting public product-security publication.

Change Log