Proofwright CRA Evidence
This module generates a software bill of materials (SBOM) of your Drupal site's core, modules, and themes in CycloneDX format. It maps each component to a Composer package URL to help identify vulnerabilities and sends this inventory to your Proofwright console for Cyber Resilience Act compliance.
Proofwright CRA Evidence sends this site's software inventory — Drupal core plus every installed module and theme — to your Proofwright console as a CycloneDX SBOM, so the site can be evidenced under the EU Cyber Resilience Act.
The CRA's reporting obligations apply from 11 September 2026, with full application from 11 December 2027. Manufacturers of products with digital elements must be able to produce a software bill of materials and handle vulnerabilities across a defined support period. This module is the Drupal on-ramp for that evidence.
What it does
Builds a CycloneDX 1.5 SBOM of core, contrib and custom extensions.
Maps every component to a Composer package URL — Token 8.x-1.15 becomes pkg:composer/drupal/[email protected]. These are the identifiers the Drupal security advisories and OSV feeds match on, so known vulnerabilities are recognised automatically once the SBOM lands.
Sends it to your console over HTTPS, authenticated with a licence key. Sending is opt-in and can run on cron, or on demand from the settings form.
Produces a stable serial number for an unchanged inventory, so repeat sends are recognisable as identical rather than looking like drift.
What it does not do
No data leaves your site until you enter a licence key and console URL. There is no telemetry and no phone-home.
It sends an inventory of extension names and versions. It does not read content, user data, or configuration beyond its own settings.
It is not legal advice. Verify your CRA obligations with qualified counsel.
Requirements
Drupal 10 or 11
PHP 8.1 or later
A console endpoint to receive the SBOM. A hosted account is available at proofwright.eu, and the module works standalone against any endpoint implementing the documented ingest API.
GPL-2.0-or-later.<