Cyber Resilience Act readiness

[thibaudcolas]

Establish what the EU Cyber Resilience Act means for Wagtail, as an upstream project in the open source software supply chain, and related security improvements that could be considered.

Intended outcome

For now the focus will be on improvements that are generally valuable for a wide range cybersecurity requirements, such as:

• Revising our security policies and docs, in particular with more information on our behind-the-scenes security team process.
• Producing SBOMs for our releases, and signing release artifacts.
• Signposting and sharing how to do this as part of the package ecosystem, via changes to our package guidelines.

More information

• Security process improvements
• Self-certification of Wagtail under the OpenSSF Best Practices Badge program