Compliance QA
The SBOM registry.
Machine-readable ingredient lists — CycloneDX or SPDX JSON — versioned per app release and per firmware image, vulnerability-scanned in place. Private by default; public documents are listed below. The full CRA checklist →
Documents
CRM Sync Desktop 3822575 — app, CycloneDX 1.6, 472 components, updated 2026-09-16
CRM Sync Desktop (Tauri shell) 3822575 — app, CycloneDX 1.6, 459 components, updated 2026-09-16
CRM Sync Webflow Extension 3822575 — app, CycloneDX 1.6, 30 components, updated 2026-09-16
CRM Sync PWA 1.0.0 — app, CycloneDX 1.6, 94 components, updated 2026-08-12
CRM Sync Worker 3822575 — app, CycloneDX 1.6, 38 components, updated 2026-09-16
Demo Device 1.0.0 — firmware, CycloneDX 1.6, 2 components, updated 2026-07-20
compliance-qa f0c4e085d15b9ca1031b6f85b461cadf8ed74ecf — app, CycloneDX 1.6, 0 components, updated 2026-07-29
Firmware & hardware
For a connected device the SBOM must cover the firmware image, not just the companion app. Two ways to produce it, both landing in this registry:
Build-time
You build the firmware — the build system emits the SBOM as a build artifact: Yocto (create-spdx) or Zephyr (west spdx). Most accurate: it knows every recipe and version.
Binary
Vendor-supplied image, no sources — binary analysis reconstructs the inventory: EMBA (extract + identify, CycloneDX out) or cve-bin-tool (component signatures, SPDX/CycloneDX out). Best-effort by nature; state the method in the document.
Either way the document is pushed to this registry versioned per image, and vulnerability scans (Grype, Dependency-Track) run against the registry copy — that is the “stays current” half of the CRA row.
References
Practical guidance, not legal advice. For scope questions — especially whether the CRA applies to you — confirm with counsel.