CRA compliance: delivery of fixes

[mrybczyn]

The CRA requires automatic delivery of fixes, secure updates and notification of available patches.

In this aspects we can clarify:

• that fixes should be delivered automatically if technically feasable
• that each project should define a way to notify about available patches (eg. a mailing list) and publish that information
• state that when the product delivers updates, they need to be delivered securely (signing, hashes)

[oej]

Security updates should be delivered automatically by default. A vendor needs good documented reasons in order not to support it. The customer should be able to turn automated updates off.