Repository evidence benchmark · 2026 edition

The state of CRA-relevant evidence in public software repositories.

Name: The State of CRA-Relevant Evidence in Public Software Repositories - 2026
Published: 2026-09-07
License: https://creativecommons.org/licenses/by/4.0/

How much of the evidence a manufacturer may need is already observable in a software repository?

By ConformOpsCollected 2026-09-07300 repositories · 6 ecosystems

This research does not determine whether the CRA applies to any project and does not assess legal compliance. It measures only CRA-relevant evidence observable in public repository material.

Explore the findings Download the open dataset

What the repository makes visible

Evidence signals, with their limits attached.

We inspected frozen default-branch commits from 300 popular, active GitHub repositories: 50 each in .NET, JavaScript/TypeScript, Python, Java/JVM, Go and Rust. This is a balanced, popularity-biased sample, not an estimate for all software or regulated manufacturers.

99.7%

Dependency manifest detected

299 / 300 observed · 0 unknown

48.7%

SECURITY.md detected

146 / 300 observed · 0 unknown

30.7%

Support / EOL text signal

92 / 300 observed · 52 unknown

A repository SBOM is not necessarily a shipped SBOM. A support / EOL text signal is not a validated support policy. Release assets, external sites and inherited organization policies were outside this scan.

Dependency manifest detected99.7%299/300 · 0 unknown

Lockfile detected57.0%171/300 · 2 unknown

Repository SBOM document detected0.0%0/300 · 7 unknown

CycloneDX JSON detected0.0%0/300 · 7 unknown

SPDX JSON detected0.0%0/300 · 7 unknown

SECURITY.md detected48.7%146/300 · 0 unknown

Reporting-contact text signal25.7%77/300 · 62 unknown

Disclosure-process text signal16.3%49/300 · 70 unknown

Security-update text signal10.0%30/300 · 87 unknown

Support / EOL text signal30.7%92/300 · 52 unknown

Release-process text signal22.3%67/300 · 60 unknown

CI / build configuration detected95.3%286/300 · 0 unknown

Architecture / design document detected18.3%55/300 · 4 unknown

Security-testing tool or text signal33.7%101/300 · 46 unknown

Published release reference observable (selection rule)100.0%300/300 · 0 unknown

All percentages use the full sample as denominator, including unknowns. “Not detected” means no rule matched within the defined scan, not that evidence does not exist. Text signals have not been manually validated; neither precision nor recall is estimated.

Read the SBOM result as a repository-only observation

The collector detected qualifying committed SBOM JSON in 0 repositories, with 7 repositories unknown for that metric. This does not estimate how many projects ship an SBOM: release assets and package registries were not inspected. CycloneDX XML, SPDX tag-value and unnamed JSON files were also outside the detector.

Same questions, six ecosystems

Compare observations, not compliance.

Each cell shows observed repositories out of 50, followed by unknowns (U). The strata use GitHub primary language: C# for .NET, Java/Kotlin for JVM. Language is an imperfect ecosystem proxy. Differences can reflect project mix, repository layout or detector coverage.

Observed / 50 · unknown (U), for every metric
Evidence signal	.NET	JavaScript/TypeScript	Python	Java/JVM	Go	Rust
Dependency manifest detected	50/500 U	50/500 U	49/500 U	50/500 U	50/500 U	50/500 U
Lockfile detected	13/500 U	48/500 U	25/500 U	16/502 U	22/500 U	47/500 U
Repository SBOM document detected	0/501 U	0/500 U	0/502 U	0/502 U	0/501 U	0/501 U
CycloneDX JSON detected	0/501 U	0/500 U	0/502 U	0/502 U	0/501 U	0/501 U
SPDX JSON detected	0/501 U	0/500 U	0/502 U	0/502 U	0/501 U	0/501 U
SECURITY.md detected	13/500 U	31/500 U	32/500 U	14/500 U	31/500 U	25/500 U
Reporting-contact text signal	8/502 U	16/5013 U	16/5012 U	11/505 U	16/5011 U	10/5019 U
Disclosure-process text signal	5/503 U	6/5019 U	13/5011 U	4/509 U	12/5010 U	9/5018 U
Security-update text signal	2/506 U	6/5018 U	7/5016 U	2/5011 U	7/5014 U	6/5022 U
Support / EOL text signal	14/500 U	16/5010 U	17/5012 U	7/508 U	25/507 U	13/5015 U
Release-process text signal	5/504 U	12/5015 U	12/5010 U	5/509 U	14/507 U	19/5015 U
CI / build configuration detected	42/500 U	50/500 U	48/500 U	46/500 U	50/500 U	50/500 U
Architecture / design document detected	2/501 U	14/500 U	14/500 U	5/502 U	7/501 U	13/500 U
Security-testing tool or text signal	13/503 U	15/5015 U	18/507 U	7/507 U	24/505 U	24/509 U
Published release reference observable	50/500 U	50/500 U	50/500 U	50/500 U	50/500 U	50/500 U

An auditable scope

What we measured. What remains unanswered.

1. Freeze the sample

Public, non-fork, non-archived repositories with at least 500 stars, a push in the preceding year and a stable GitHub release. Start with the top 100 by stars per language, apply a fixed hash ordering and screen names/descriptions for non-software material. Take 50 eligible repositories per ecosystem.

2. Pin the observations

Read paths at fixed Git tree hashes. Inspect up to 30 selected documents and 20 named SBOM JSON candidates per repository, at most 256 KB each. Exclude test, fixture, example and vendored directories. Keep file links, hashes and line numbers, without redistributing source content.

3. Keep uncertainty visible

Truncated trees, failed reads and collection caps leave nonpositive observations unknown. Filename detections and narrow English text rules measure signals. They do not verify policy quality, successful CI runs, dependency completeness or actual security practices.

4. Publish the limitations

Popular repositories are not representative of all software. Public evidence omits private work and external documentation. Default-branch files are not release-bound evidence. A release reference is guaranteed by selection. No readiness ranking or causal ecosystem comparison follows from these results.

This study is published by ConformOps, which sells CRA evidence-management software. It is automated publisher research, not an independent assessment. We did not establish a manually labelled validation set, so policy-related figures must be quoted as text signals.

Read the complete methodology and metric definitions

Why this question is different

The OpenSSF / Linux Foundation 2026 CRA Awareness and Readiness Report studies awareness and readiness. ENISA’s 2026 SBOM adoption study examines organizational adoption. This benchmark asks what is visible in repository material, a different unit of analysis.

Regulation (EU) 2024/2847 motivates the evidence categories, particularly vulnerability handling and technical documentation. Free and open-source software has specific treatment under the CRA. Repository visibility alone cannot establish economic activity, scope, legal role or compliance.

Frozen before collection

The 300-repository sample.

The downloads retain selection metadata and commit hashes. Expand an ecosystem to inspect its repositories at the exact commits used in this edition.

.NET50 repositories

aspnetboilerplate/aspnetboilerplate2323c13a15
Cysharp/UniTaskceac8d6946
mRemoteNG/mRemoteNGaa6d6884da
JamesNK/Newtonsoft.Json09bb545d72
d2phap/ImageGlassa8754cbade
Tyrrrz/YoutubeDownloaderff954187af
ardalis/CleanArchitecturefbdc095187
chocolatey/chocoede55876ce
bchavez/Bogus6ece18c5c2
JosefNemec/Playnite98c09dd6a1
studyzy/imewlconverter16744a12ed
files-community/Files78964ba418
wmjordan/PDFPatcher49a04400fb
MahApps/MahApps.Metro69f1c39731
Tyrrrz/DiscordChatExporter3a8ef99769
memstechtips/Winhancef23d554eb2
tui-cs/Terminal.Gui145585dd58
Jackett/Jackett4ffc7bd36a
dotnet/BenchmarkDotNet7a821666f2
huiyadanli/RevokeMsgPatcher8360fe2af7
babalae/better-genshin-impactb3e46b3004
2dust/v2rayN3d50d9f82c
SubtitleEdit/subtitleedit7bf8f7d16d
CoplayDev/unity-mcp2fcc179578
dotnet/runtimefb98b574c9
PowerShell/PowerShellb664c2e026
File-New-Project/EarTrumpetf6d864ce89
jellyfin/jellyfin882faf2b2d
MathewSachin/Captura3fdf41529b
cefsharp/CefSharp6011f2c79e
Tichau/FileConverter6c157a411f
QuestPDF/QuestPDF1b68e8f07f
lostindark/DriverStoreExplorer0518f78f15
netchx/netch9d99eb1c5a
ppy/osu6895dcb006
microsoft/garnetc84bd7ca3a
dotnet/roslynca7d6c1a04
microsoft/semantic-kernel872d29ea75
StockSharp/StockSharp4fd3058055
runcat-dev/RunCat36503b6e2b288
seerge/g-helpera4441b5d59
dotnet/orleansc7e30326b8
App-vNext/Polly482bdf824f
k1tbyte/Wand-Enhancer0898d6ecd6
dotnet/eShopb4a4087200
icsharpcode/ILSpy951ca987dd
LuckyPennySoftware/MediatR916ef1b3d6
winsw/winsw1d0ee4a91b
Sonarr/Sonarr5352e16d95
QL-Win/QuickLook60eea46ae2

JavaScript/TypeScript50 repositories

upstash/context780e681a507
tldraw/tldrawd98ea50911
siyuan-note/siyuan8641553a1f
affaan-m/ECCcf065358fb
impress/impress.jsb44b9694b4
Leaflet/Leafletd62d241812
openai/codex-plugin-ccdb52e28f4d
Dogfalo/materialize824e78248b
clash-verge-rev/clash-verge-revf8b69b5d62
Egonex-AI/Understand-Anything07edf82a04
immich-app/immich58fb1ed4a9
apache/echarts018ed39989
heygen-com/hyperframesdc9fb67320
marktext/marktext33777a7abc
naptha/tesseract.jsa1ca80d9e3
videojs/video.jsc3a7e0e6d2
react-hook-form/react-hook-formb564062c93
nocodb/nocodbe6b66e9b16
Fission-AI/OpenSpece062b9572b
DefinitelyTyped/DefinitelyTypedaf92471c4a
TanStack/querye57f8163b1
pbakaus/impeccable2bc2879276
ChromeDevTools/chrome-devtools-mcpa918b7b408
code-yeongyu/oh-my-openagenta470d3d9dd
agalwood/Motrix6f9d085851
hoppscotch/hoppscotchac145e7f75
facebook/docusaurus1434f56a07
moeru-ai/airi9a4e1da5a1
toeverything/AFFiNEb4331cbe1e
thedotmack/claude-memfd0ecf0233
paperclipai/paperclipd8b9580531
sahat/hackathon-starter7a6eb54777
supabase/supabasec2ebfebb39
KeygraphHQ/shannon4b8131fdd5
anomalyco/opencodeecbc6ccac8
sveltejs/svelte5895c637b0
career-ops-hq/career-ops8a20e491fd
gatsbyjs/gatsbye85d62f177
puppeteer/puppeteerf0dc34c9af
docsifyjs/docsify879f02e25e
bigskysoftware/htmx142b857779
typicode/husky3f0023dc10
fastapi/full-stack-fastapi-templatecb740b656d
prettier/prettier7fe4924c8a
payloadcms/payload0a3dabf0db
lovell/sharp19490e88f7
lutzroeder/netron2e6a858320
serverless/serverlessfa183f55c5
CherryHQ/cherry-studioe131f495a9
carbon-app/carbon1334429ae6

Python50 repositories

langflow-ai/langflowe3abffc1b8
browser-use/browser-use2b1f9d3779
soimort/you-get049548f3f3
ZhuLinsen/daily_stock_analysis089d9d26d6
pathwaycom/pathway2e517d846b
scikit-learn/scikit-learncfb2977609
open-webui/open-webui0a7c15832f
Graphify-Labs/graphify67f99bd005
MemPalace/mempalaced9f059076c
Comfy-Org/ComfyUI9ac7352f70
fastapi/fastapi50113da16f
ansible/ansible3827d66bfb
mem0ai/mem0dae67f74f5
Significant-Gravitas/AutoGPT98381ab27f
opendatalab/MinerU4fe4bde114
unclecode/crawl4ai862f6bccb9
apache/superset574d121cd8
hacksider/Deep-Live-Cam19f4270e30
OpenBB-finance/OpenBB3e071fcc2c
NousResearch/hermes-agent6178e9f4ee
PaddlePaddle/PaddleOCR2661c7c0ef
virattt/ai-hedge-fundfc1bf250ea
sherlock-project/sherlock9100f9d40a
keras-team/keras0e3f1a57a0
pallets/flaskd318b68347
zylon-ai/private-gpt0658140076
TauricResearch/TradingAgents9dee508c44
Textualize/rich9d8f9a372c
pytorch/pytorch938afb1366
tensorflow/modelsd598fb8b23
xtekky/gpt4free3b62a0a3a3
microsoft/autogen027ecf0a37
RVC-Boss/GPT-SoVITS48b1a0169a
ytdl-org/youtube-dl956b8c5855
AUTOMATIC1111/stable-diffusion-webui82a973c043
scrapy/scrapy544f4d2d52
vllm-project/vllm537af2c3a4
unslothai/unsloth502c4d2377
binary-husky/gpt_academicd6bde0fa54
headroomlabs-ai/headroome67b3c8a29
jingyaogong/minimind6fc918beb6
microsoft/markitdownb6e8bbdce6
huggingface/transformers8eaf75f84e
hiyouga/LlamaFactorydced5f8804
github/spec-kit4a7341a93d
D4Vinci/Scrapling28c3296714
ultralytics/yolov535b48237ae
harry0703/MoneyPrinterTurbo5ceffd02a2
ageitgey/face_recognition9f3061aaee
usestrix/strix52b1923347

Java/JVM50 repositories

iamgio/quarkdown3097d3140f
lysine-dev/retrofite27d855b7b
shadowsocks/shadowsocks-androidae28fd9193
ReVanced/revanced-manager2a88257b71
ReactiveX/RxAndroid20139bfd6f
Anuken/Mindustry37c1b6ac1e
jeecgboot/JeecgBoot7436405444
CymChad/BaseRecyclerViewAdapterHelper9948068cd9
alibaba/druidfa8dc99126
google/gsonb3f4ca2008
aistra0528/Hailbcb003810e
Tencent/tinker1b7ea02c23
infinilabs/analysis-ik6d2d70fd1a
yairm210/Uncivedcd78c5f7
skylot/jadx8f7ea4e2c4
javalin/javalin219f8c14dd
SeleniumHQ/selenium1303bd5282
Mygod/VPNHotspot6e3d4a4f9d
airbnb/lottie-android05ea92e903
bumptech/glide83f3b67128
quarkusio/quarkus504a086e0f
google-ai-edge/gallery33721326a9
JunkFood02/Seal63bd8a4d31
google/guava5fb424c43a
CeuiLiSA/Pixiv-Shafte6b3ff01b1
librepods-org/librepods53679cc902
jenkinsci/jenkins98047df8a5
alibaba/DataX80ec23d5c5
JetBrains/kotlinc5a406a065
Grasscutters/Grasscutterf373827a83
bitwarden/androidb99ad92c8b
shiaho777/web-to-appfc455d769d
termux/termux-app3b66f87996
zhanghai/MaterialFilesfc12500384
Droid-ify/client7131fe3e9a
ktlint/ktlint4c933394a3
macrozheng/mall0504e86b1f
topjohnwu/Magisk37063225d4
SukiSU-Ultra/SukiSU-Ultra9fbe8fe8ca
bazelbuild/bazel6a4878da6a
XayahSuSuSu/Android-DataBackup5b2128882e
2dust/v2rayNG2020807c25
ben-manes/caffeinea81e8e59f3
conductor-oss/conductor09786aaf21
maxrave-dev/SimpMusicbb5c750025
z-huang/InnerTunebfba5ecb16
facebook/litho55e28e5893
alibaba/nacos102d9a6f83
uber/RIBse3aff84f66
baomidou/mybatis-plusbf67d90747

Go50 repositories

harness/harnessaba5bf25b8
sipeed/picoclawbbf6893ca7
go-gitea/giteacc6fc41723
binwiederhier/ntfy10cb6506f8
opentofu/opentofu80be292a94
spf13/viper528f7416c4
esengine/DeepSeek-Reasonix401fca4057
pocketbase/pocketbase5684ee24f1
nektos/act4f41128141
tailscale/tailscale5201273aec
beego/beego939cfde380
caddyserver/caddye05f57dc7a
trufflesecurity/trufflehog166bf18f3a
k3s-io/k3sa305766d0b
glanceapp/glance372466c6d7
AlistGo/aliste1c022a9d9
abiosoft/colimac3a5f9184d
moby/moby275015b0e7
github/github-mcp-server8b3538ff8a
netbirdio/netbird15c0a2903d
netdata/netdata0f699939dd
ethereum/go-ethereum5818afe9bb
spf13/cobraadbc881390
syncthing/syncthinged8d87f251
cloudreve/cloudreve1c3fe4da3c
juanfont/headscale5f955cb4b4
gogs/gogsaec2b842cd
danielmiessler/Fabricb682dad740
charmbracelet/crush7f9a8e4ca8
goharbor/harbor3195f04fc5
charmbracelet/bubbletea73b6d91ac1
router-for-me/CLIProxyAPIba7e55836d
grafana/k6687de4dc78
microsoft/TypeScript1f70213d49
SagerNet/sing-box60b504a1c7
gastownhall/beadsc0d8da42de
labstack/echo90702e71a7
1Panel-dev/1Panelbad022f524
aquasecurity/trivy6d90892649
go-gorm/gorm1d6ce99528
v2ray/v2ray-cored80440f3d5
helm/helmfa11636b01
docker/compose75331cd042
evanw/esbuildf6058f8364
prometheus/prometheus7f48230f67
fatedier/frp832df8dff6
charmbracelet/glow7b2431d4a8
jesseduffield/lazygitc07f4d381b
wailsapp/wails397947b81f
hashicorp/consulbe5795ee6b

Rust50 repositories

rwf2/Rocket3a54d079ae
sxyazi/yazi5f901b886b
emilk/egui57160f5e9e
biomejs/biomee7b3b95484
GyulyVGC/sniffnetec3fba2e64
cloudflare/pingora09696b51bc
ruvnet/RuViewd613a576ea
qdrant/qdrant6ab21cac18
ankitects/anki5edc31694f
yewstack/yewbfa6c19af9
cjpais/Handybc7facea3a
bevyengine/bevyf65077ce99
actix/actix-webc215607f4b
zellij-org/zellijaf38660c58
iced-rs/iced2cd9197a71
surrealdb/surrealdb18971ffba7
BurntSushi/ripgrep3fce3b5bb0
Hmbown/Codewhaleaedb88b950
astral-sh/rufff6cdb46fd7
ajeetdsouza/zoxide4165849095
nautechsystems/nautilus_trader1602043deb
swc-project/swca5bd5924c1
rustdesk/rustdeske8eead5715
wezterm/weztermd2f3f05b38
pola-rs/polarsf611a6d606
astral-sh/uvdbbc4c9a1e
dandavison/delta9d730c043d
tree-sitter/tree-sitterbadf2882c6
Zackriya-Solutions/meetily0281737d87
FuelLabs/fuel-coreadd100d30d
oven-sh/bun3f2610e24a
farion1231/cc-switchf3b18df120
vercel-labs/agent-browser219c47a9da
typst/typst26e924d311
meilisearch/meilisearcha088ecc354
FuelLabs/fuels-rsd9a250a518
starship/starship864500b269
tw93/Pake24c7c67a64
sharkdp/bat7323a7514f
vercel/turborepo63797e490d
zed-industries/zed6f73c7d0a4
openinterpreter/openinterpreterf6722c8008
Schniz/fnm86adc9676c
pnpm/pnpm8760cfa9f3
zeroclaw-labs/zeroclawa6937dfe75
openai/codexb4373e53ab
firecracker-microvm/firecracker7699746649
TabbyML/tabby21b29048d7
lbjlaq/Antigravity-Managerefc3827b3f
alacritty/alacrittyd692748d3f

Open data · CC BY 4.0

Check it. Reproduce it. Cite it.

Download the frozen sample and every observation. The script uses read-only GitHub access and never executes repository code. Reproduction depends on the pinned upstream material remaining publicly available.

Frozen sample300 repositories, eligibility metadata and commit hashesrepositories.csvEvery observationStates, pinned evidence links, hashes and line numbersobservations.csvMethodologySelection, metric definitions, limitations and reproductionmethodology.mdVersioned evidence mapDetection rules, collection limits and collector digestevidence-map-version.jsonCandidate frameSelection order, exclusions and quota dispositionscandidates.csvCollection coverageTruncated trees, document limits and failed readscoverage.csvFrozen inputsExact tree hashes, search queries and release metadatasample.jsonSample digestsFreeze timestamp and SHA-256 bindingssample-freeze.jsonAggregate resultsCounts by ecosystem and observation digestresults.jsonReproduction scriptDependency-free Node.js collector; read-only GitHub accesscollector.mjs

Suggested citation

ConformOps (2026). The State of CRA-Relevant Evidence in Public Software Repositories - 2026. repository-evidence@2. Collected 2026-09-07. https://conformops.eu/research/cra-repository-evidence-benchmark-2026

Sample SHA-256: ea12c7013f554d88b166d14c4646acd7e79fe425aad56dd0e56d6208888b5542

Dataset and methodology: Creative Commons Attribution 4.0. Upstream source files retain their own licenses. To request a correction, open an issue naming the repository, metric and pinned evidence link. Corrections require an explicit version change.

CRA resources / Original research