> ## Documentation Index > Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt > Use this file to discover all available pages before exploring further. # Compliance Packages > How to make the set of files one regulation or use case asks for in a single export, what each package holds and cites, what happens when a part can't be made, and how to mark the regulations that apply to your organisation. A **compliance package** is the set of files one regulation, auditor, or buyer asks to see, made in one click from one frozen scan. Instead of knowing that a regulation wants a CycloneDX file, a notice file, and a report, and making each, you choose the regulation. Earnie freezes the scan once, makes every file from that one freeze, and gives you a single ZIP. > [!WARNING] > > A package is **evidence for** the clauses it cites. It never states that your product or your organisation complies with, is ready for, or is certified under anything. A scan shows what was scanned. Whether a regulation applies to you, and whether you meet it, is a judgement for you and your advisers. Each package says what its files can't show. A package is an export. It appears on the project's **Reports** page beside your other exports, and it follows the same rules: it freezes one completed scan, it never changes afterwards, and you can delete it. **Before you start:** * The project needs a completed scan. The sheet opens on the latest one, and a list lets you choose an earlier one. * You need the Operator or Admin role to make a package. Viewers can see and download the exports of packages that were made. * Earnie offers a package only when your organisation has the scanners it needs. See [What's offered](#whats-offered-and-what-is-left-out). ## The Packages | Package | Who it's for | Files | | - | - | - | | **EU Cyber Resilience Act** | Manufacturers of products with digital elements placed on the EU market | CycloneDX SBOM. The CRA SBOM annex, when you have Cryptography. A Compliance report with the merge gate, vulnerabilities, and licence obligations. | | **Export control (US EAR)** | Exporters of software with encryption | CycloneDX CBOM. The export-control evidence report. | | **Post-quantum inventory** | Teams planning a migration off quantum-vulnerable cryptography | CycloneDX CBOM. A report of the assets that use quantum-vulnerable algorithms, detected in code. | | **PCI DSS 4.0** | Entities with a cardholder-data environment, and the teams that build its software | CycloneDX SBOM and CBOM, as your scanners hold them. A report with the merge gate and cryptography. | | **Open-source distribution** | Teams that ship software containing open-source components | SPDX SBOM. The notice file. A licence obligations report. | | **Due diligence** | Buyers, investors, and procurement teams reviewing software they don't own | CycloneDX bill of materials of every scanner you hold. A Compliance report with every section you can see. | Each package names the clauses its files are evidence for. The same links are in the README of every package ZIP. * **EU Cyber Resilience Act.** [Regulation (EU) 2024/2847](https://eur-lex.europa.eu/eli/reg/2024/2847/oj): Annex I, Part II, point (1), the software bill of materials; Article 13(22) and Annex VII, the technical documentation handed to a market surveillance authority on request; and Article 14, the reporting of actively exploited vulnerabilities and severe incidents. Earnie doesn't file those reports. The obligations bind the manufacturer, and a scan doesn't establish whether a product is in scope. The SBOM isn't required to be public: it belongs to the technical file. * **Export control (US EAR).** [15 CFR 740.17](https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-740/section-740.17), License Exception ENC, and the [self-classification report](https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-742/appendix-Supplement%20No.%208%20to%20Part%20742) of Supplement No. 8 to Part 742. The classification and the authorisation are the exporter's legal conclusion. This package classifies nothing and files nothing. * **Post-quantum inventory.** [OMB memorandum M-23-02](https://www.whitehouse.gov/wp-content/uploads/2022/11/M-23-02-M-Memo-on-Migrating-to-Post-Quantum-Cryptography.pdf), which binds federal agencies, and the [NSA CNSA 2.0 algorithms](https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS.PDF), which apply to National Security Systems. Neither binds a commercial organisation. A finding in code doesn't show the implementation is active. * **PCI DSS 4.0.** Requirements 6.3.2, the inventory of bespoke and custom software and its third-party components, and 12.3.3, the inventory of cryptographic cipher suites and protocols, in the [PCI Security Standards Council document library](https://www.pcisecuritystandards.org/document_library/). Check the clause numbers against the licensed standard. A repository scan can't see the cipher suites a server negotiates. * **Open-source distribution.** [ISO/IEC 5230 (OpenChain)](https://github.com/OpenChain-Project/License-Compliance-Specification/blob/master/Official/en/ISO-5230-2020/ISO-5230-2020.md), sections 3.3.1 and 3.4.1, and [Apache-2.0 section 4(d)](https://www.apache.org/licenses/LICENSE-2.0). The standard certifies a compliance program, not a file. * **Due diligence.** No regulation or standard defines this deliverable, and the package says so. A scan covers what was scanned. It isn't a representation or a warranty. ## Making a Package **1. Open the sheet** Select **New export** on the project's **Reports** page, or **New export…** in the Dashboard's **Export** menu. When your organisation can make a package, the sheet opens on **For a regulation**, above the choices for a single file. **2. Choose a package** Each package shows who it's for and its files. A package marked **Applies to your organization** is one an Admin marked as applicable, and it's listed first. See [Marking the regulations that apply](#marking-the-regulations-that-apply). **3. Choose the scan** Choose the scan, as for any export. The sheet then lists the package's files instead of asking for a format, and its footer says what will happen before anything runs, for example "Freezes main (3f2a9c1d, 2 days ago) and makes 3 files: SPDX, Notice file, Report (PDF)." Under it, the footer states what the package's files can't show. **4. Export** Select **Export**. Earnie freezes the scan, makes every file, and downloads them together as one ZIP named for the package and the export, for example `oss-distribution-3f2a9c1d.zip`. ## What's in the ZIP The files, and a `README.txt` that names: * the package and who it's for * the project, the scan, when the package was generated, and by whom * the tool versions * each file, with its size and SHA-256 checksum * what was left out, and why * the clauses the files are evidence for, each with a link to its source * the statement that the files are evidence, not a conformity claim, an assessment, or a certification The ZIP is deterministic: making the same download again from the same export gives the same bytes. You can download it again at any time from **Download all** in the export's row on the **Reports** page. ## What's Offered, and What Is Left Out A package is offered only when your organisation has the scanners it needs, and an API key only offers the packages its modules allow: | Package | Needs | | - | - | | EU Cyber Resilience Act | Open-source matching. Cryptography is optional. | | Open-source distribution | Open-source matching | | Export control (US EAR) | Cryptography | | Post-quantum inventory | Cryptography | | PCI DSS 4.0 | Open-source matching or Cryptography | | Due diligence | Any one scanner | A package that needs a scanner you don't have isn't listed. A scan that ran no cryptography detection can't make a package that needs it: the sheet shows the package disabled, with "This scan ran no cryptography detection", so you don't find out after you export. A package's optional part never makes it fail, and a part is never left out in silence. Without Cryptography, the EU Cyber Resilience Act package leaves out its SBOM annex. The sheet says so in the footer before you export: > CRA SBOM annex (cryptographic assets) not included: the cryptography module is not enabled for this caller. The same sentence is in the message after you export, under the package's name in the **Reports** row, and under **NOT INCLUDED** in the README. If a file can't be made after the scan is frozen, the export still exists with the other files, and those four places name what was left out. ## In the Reports Ledger A package export reads "*Package name* package", with its scan, a chip for each file, and a **Download all** button that downloads the ZIP. A part the package left out is written under its name. The **Type** filter has one **Package** choice for every package. A package export also matches **Report**, **Notice**, and **Export control** when it carries a file of that kind. See [Exporting an SBOM](https://docs.scanoss.com/en/latest/earnie/evidence/exporting-sboms.md) for the rest of the page. ## Marking the Regulations That Apply An Admin marks the regulations that apply to the organisation in **Settings → Regulations**: tick the packages and save with the bar at the bottom of the page. The **New export** sheet then lists those packages first and marks them **Applies to your organization**. The choice only orders and marks packages. It never hides one, and it says nothing about whether you comply. Every role can read it. Only an Admin can change it, and Earnie records each change in the [audit log](https://docs.scanoss.com/en/latest/earnie/evidence/audit-log.md) as `organization.regulations_updated`. ## Using the API | Endpoint | Does | Scope | | - | - | - | | `GET /v1/sbom/packages` | Lists the packages the caller can make, with their files, citations, and cautions | `scans:read` | | `POST /v1/sbom/scans/{scanId}:generate` | With `{"package": "oss-distribution"}`, freezes the scan once and makes every file | `scans:write` | | `GET /v1/sbom/snapshots/{snapshotId}/bundle` | Streams the ZIP of an export's files and README | `scans:read` | A package decides the formats and sections, so a request with `package` can't also carry `formats`, `include`, or `include_crypto` (`400 invalid_body`). A package the caller can't make is `422 package_not_available`, and a scan that ran no cryptography detection refuses a package that needs it with `422 crypto_evidence_unavailable`. The response lists any part left out in `omitted_parts`, each with its reason. See [Using the API](https://docs.scanoss.com/en/latest/earnie/api/using-the-api.md) for authentication and scopes. ## What's Next * For a single file, such as an SBOM or a CBOM, see [Exporting an SBOM](https://docs.scanoss.com/en/latest/earnie/evidence/exporting-sboms.md). * For a readable report of one project, see [Reports](https://docs.scanoss.com/en/latest/earnie/evidence/project-reports.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.