[TASK] Add CRA conformity documents - #80
Merged
Merged
Conversation
Adds the security policy and the EU declaration of conformity for this release branch, taken verbatim from the wv-people/cra repository (main, 18505c5), which is the single source of truth for these documents. SECURITY.md replaces the previous version: the supported versions are a table now and carry an end of support date per major version, derived from the community support end of the highest TYPO3 version that major supports. The README gains the simplified declaration under Annex VI with the exact address of the full declaration, the supported version table, the reporting channel and the license. TER and Packagist build their product pages from the README rather than from SECURITY.md, so that is the only place reaching those channels.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the CRA documents for this branch, taken verbatim from the
wv-people/crarepository (main,18505c5), where they were reviewed andapproved. Nothing here is authored independently of that repository — it is the
single source of truth for these files.
What this branch gets
web-vision/deepl-writeFiles added or updated at the repository root:
SECURITY.md— replaces the previous version.Supported Versionsis now atable carrying an end-of-support date per major version, derived from the
community-support end of the highest TYPO3 version that major supports.
EU-Declaration-of-Conformity.mdandEU-Konformitaetserklaerung.md— thefull EU declaration of conformity under Regulation (EU) 2024/2847, English
and German, signed under
VOLLMACHT-CISO-2026-01.README.md— gains four sections at the end:Supported Versions,Security,Simplified EU Declaration of Conformity (Annex VI)andLicense. Existingcontent is untouched; a
Licensesection that already existed is kept as it is.Why the Annex VI section in the README
CRA Annex VI requires the simplified declaration to state the exact internet
address of the full declaration. TER and Packagist build their product pages
from
README.md, not fromSECURITY.md, so the README is the only place thatreaches those distribution channels.
Scope rule
A major version is covered when the highest TYPO3 version it supports is still
in regular community support — TYPO3 13 until 2027-12-31, TYPO3 14 until
2029-06-30. TYPO3 12 went ELTS on 2026-04-30, so majors capped at 12 or below
are out of scope and get no declaration.
Scope: this is phase 1
The CRA repository's
docs/TEMPLATE-README-EN.mddefines the full set ofuser-information sections required by Annex II of Regulation (EU) 2024/2847,
and explicitly says not to drop a section merely because it is short. This pull
request deliberately covers only the part that can be generated correctly and
identically for every extension:
The open sections need per-product wording and are tracked in a separate issue
on this repository. Merging this PR does not make the product Annex II
complete — it establishes the reporting channel, the declaration link and the
supported-version statement, which are the parts with a hard external
dependency (the published declaration under
/conformity/).