Skip to main content
A compliance package is the set of files one regulation, auditor, or buyer asks to see, made in one click from one frozen scan. Instead of knowing that a regulation wants a CycloneDX file, a notice file, and a report, and making each, you choose the regulation. Earnie freezes the scan once, makes every file from that one freeze, and gives you a single ZIP.
A package is evidence for the clauses it cites. It never states that your product or your organisation complies with, is ready for, or is certified under anything. A scan shows what was scanned. Whether a regulation applies to you, and whether you meet it, is a judgement for you and your advisers. Each package says what its files can’t show.
A package is an export. It appears on the project’s Reports page beside your other exports, and it follows the same rules: it freezes one completed scan, it never changes afterwards, and you can delete it. Before you start:
  • The project needs a completed scan. The sheet opens on the latest one, and a list lets you choose an earlier one.
  • You need the Operator or Admin role to make a package. Viewers can see and download the exports of packages that were made.
  • Earnie offers a package only when your organisation has the scanners it needs. See What’s offered.

​
The Packages

Each package names the clauses its files are evidence for. The same links are in the README of every package ZIP.
  • EU Cyber Resilience Act. Regulation (EU) 2024/2847: Annex I, Part II, point (1), the software bill of materials; Article 13(22) and Annex VII, the technical documentation handed to a market surveillance authority on request; and Article 14, the reporting of actively exploited vulnerabilities and severe incidents. Earnie doesn’t file those reports. The obligations bind the manufacturer, and a scan doesn’t establish whether a product is in scope. The SBOM isn’t required to be public: it belongs to the technical file.
  • Export control (US EAR). 15 CFR 740.17, License Exception ENC, and the self-classification report of Supplement No. 8 to Part 742. The classification and the authorisation are the exporter’s legal conclusion. This package classifies nothing and files nothing.
  • Post-quantum inventory. OMB memorandum M-23-02, which binds federal agencies, and the NSA CNSA 2.0 algorithms, which apply to National Security Systems. Neither binds a commercial organisation. A finding in code doesn’t show the implementation is active.
  • PCI DSS 4.0. Requirements 6.3.2, the inventory of bespoke and custom software and its third-party components, and 12.3.3, the inventory of cryptographic cipher suites and protocols, in the PCI Security Standards Council document library. Check the clause numbers against the licensed standard. A repository scan can’t see the cipher suites a server negotiates.
  • Open-source distribution. ISO/IEC 5230 (OpenChain), sections 3.3.1 and 3.4.1, and Apache-2.0 section 4(d). The standard certifies a compliance program, not a file.
  • Due diligence. No regulation or standard defines this deliverable, and the package says so. A scan covers what was scanned. It isn’t a representation or a warranty.

​
Making a Package

1

Open the sheet

Select New export on the project’s Reports page, or New export… in the Dashboard’s Export menu. When your organisation can make a package, the sheet opens on For a regulation, above the choices for a single file.
2

Choose a package

Each package shows who it’s for and its files. A package marked Applies to your organization is one an Admin marked as applicable, and it’s listed first. See Marking the regulations that apply.
3

Choose the scan

Choose the scan, as for any export. The sheet then lists the package’s files instead of asking for a format, and its footer says what will happen before anything runs, for example “Freezes main (3f2a9c1d, 2 days ago) and makes 3 files: SPDX, Notice file, Report (PDF).” Under it, the footer states what the package’s files can’t show.
4

Export

Select Export. Earnie freezes the scan, makes every file, and downloads them together as one ZIP named for the package and the export, for example oss-distribution-3f2a9c1d.zip.

​
What’s in the ZIP

The files, and a README.txt that names:
  • the package and who it’s for
  • the project, the scan, when the package was generated, and by whom
  • the tool versions
  • each file, with its size and SHA-256 checksum
  • what was left out, and why
  • the clauses the files are evidence for, each with a link to its source
  • the statement that the files are evidence, not a conformity claim, an assessment, or a certification
The ZIP is deterministic: making the same download again from the same export gives the same bytes. You can download it again at any time from Download all in the export’s row on the Reports page.

​
What’s Offered, and What Is Left Out

A package is offered only when your organisation has the scanners it needs, and an API key only offers the packages its modules allow: A package that needs a scanner you don’t have isn’t listed. A scan that ran no cryptography detection can’t make a package that needs it: the sheet shows the package disabled, with “This scan ran no cryptography detection”, so you don’t find out after you export. A package’s optional part never makes it fail, and a part is never left out in silence. Without Cryptography, the EU Cyber Resilience Act package leaves out its SBOM annex. The sheet says so in the footer before you export:
CRA SBOM annex (cryptographic assets) not included: the cryptography module is not enabled for this caller.
The same sentence is in the message after you export, under the package’s name in the Reports row, and under NOT INCLUDED in the README. If a file can’t be made after the scan is frozen, the export still exists with the other files, and those four places name what was left out.

​
In the Reports Ledger

A package export reads “Package name package”, with its scan, a chip for each file, and a Download all button that downloads the ZIP. A part the package left out is written under its name. The Type filter has one Package choice for every package. A package export also matches Report, Notice, and Export control when it carries a file of that kind. See Exporting an SBOM for the rest of the page.

​
Marking the Regulations That Apply

An Admin marks the regulations that apply to the organisation in Settings → Regulations: tick the packages and save with the bar at the bottom of the page. The New export sheet then lists those packages first and marks them Applies to your organization. The choice only orders and marks packages. It never hides one, and it says nothing about whether you comply. Every role can read it. Only an Admin can change it, and Earnie records each change in the audit log as organization.regulations_updated.

​
Using the API

A package decides the formats and sections, so a request with package can’t also carry formats, include, or include_crypto (400 invalid_body). A package the caller can’t make is 422 package_not_available, and a scan that ran no cryptography detection refuses a package that needs it with 422 crypto_evidence_unavailable. The response lists any part left out in omitted_parts, each with its reason. See Using the API for authentication and scopes.

​
What’s Next

  • For a single file, such as an SBOM or a CBOM, see Exporting an SBOM.
  • For a readable report of one project, see Reports.