How Ericsson Met EU Cyber Rules by Fixing Open Source Upstream

Ericsson Software Technology reshaped its development approach to satisfy the stringent demands of the EU Cyber Resilience Act, moving away from isolated private forks toward active participation in upstream open source projects. The company contributed 214 direct security fixes and more than 1,400 dependency updates to open source communities, a shift that reduced lifecycle costs while fortifying the broader software supply chain against known vulnerabilities.

This account draws from a YouTube presentation titled "Upstream Collaboration for the Win (of the CRA)!" delivered by Georg Kunz and Jan Melen, with presentation materials and additional resources available for review.

The compliance challenge posed by the Cyber Resilience Act

The EU Cyber Resilience Act imposes demanding requirements on software makers to demonstrate how they handle open source dependencies. Noncompliance carries serious consequences, potentially pushing companies to abandon open source in favor of proprietary development. Such a retreat would splinter the ecosystem and undermine the collaborative benefits that drive innovation across the industry.

Ericsson's strategy: OpenSSF principles applied to regulatory demands

Ericsson Software Technology initiated a comprehensive overhaul of its engineering practices to navigate regulatory pressures. Rather than relying on private code branches for their products, the organization committed to working directly with upstream open source communities, grounded in principles promoted by the OpenSSF.

The company's approach centered on four key operational changes:

• Phasing out private forks: The team abandoned the practice of applying temporary local patches to releases, instead committing to resolving issues at the source.
• Automating dependency management: Development teams deployed automated systems to advance pull requests, keeping projects aligned with the most current secure versions.
• Strengthening security fundamentals: The organization added TLS encryption to previously unencrypted interfaces and documented hardening practices aligned with OpenSSF guidance.
• Integrating scanning infrastructure: Upstream projects gained access to public vulnerability scanning tools, enabling maintainers to spot outdated dependencies and known security gaps automatically.

Measurable outcomes from upstream participation

Through its focus on community engagement and OpenSSF best practices, Ericsson achieved significant security gains across a substantial swath of the open source landscape.

• 214 security pull requests submitted: Community review and acceptance of vulnerability fixes ensures higher security standards and allows the entire ecosystem to receive identical patches simultaneously.
• Over 1,400 dependency bump pull requests merged: Automating transitive dependency vulnerability resolution at the source reduces compliance burden and security exposure for any manufacturer relying on those open source projects.
• Zero private forks maintained: Eliminating the need to sustain custom patches across product releases cuts engineering workload and long-term maintenance costs.

So if you want to start on this – and I hope you do – the quick win is to actually tackle those dependency bumps, scanner integrations, and documentation fixes that exist across many of the projects. OpenSSF has good guidelines on how they should be done.

Jan Melen, General Manager, Ericsson Software Technology

Additional resources

• Watch the full YouTube presentation "Upstream Collaboration for the Win (of the CRA)!" and review the accompanying slides for detailed strategies.
• Learn about OpenSSF Premier membership, which provides access to private initiatives including CRA-focused work, as well as the Best Practices group and Global Cyber Policy Working Group.
• Visit Ericsson's website to explore their software technology initiatives and open source program office.