Not yet released. craclock hasn’t shipped its first build. Everything below is what the first release will do, walked through with real values instead of placeholders, including the output each command will print.
1. Install
Once released:
brew install craclock/tap/craclock2. Log in
$ craclock init
✓ Logged in as jordan@nimbus-sensors.example
✓ Org: Nimbus Sensors GmbH3. Register your product
$ craclock product create --name "Nimbus Edge Gateway" --eu-establishment-country DE
✓ Created product prod_8f3a2b1c
✓ Version 3.4.1 → pv_2c91f7ae4. Push its SBOM
$ craclock sbom push pv_2c91f7ae --file gateway-sbom.cdx.json
✓ Parsed CycloneDX 1.5: 214 components5. Push a vulnerability scan
$ craclock scan push pv_2c91f7ae --file grype-results.json
✓ Ingested 6 findings
⚠ 1 matches the CISA KEV catalog: CVE-2026-41234 in libnimbus-tls@1.2.0craclock never opens a case on its own. It flags the match and waits for you to decide.
6. Check what’s flagged
$ craclock signals --exploited
CVE COMPONENT PRODUCT VERSION FIRST SEEN
CVE-2026-41234 libnimbus-tls@1.2.0 pv_2c91f7ae 2026-01-10T08:40:00Z7. Open the case
This is the moment that matters most: recording exactly when you became aware. Everything else runs from this timestamp.
$ craclock case open --type AEV --product-version pv_2c91f7ae --awareness-at 2026-01-10T09:00:00Z --signal sig_51a2
✓ Case case_51df02 opened (AEV)
Early Warning due 2026-01-11T09:00:00Z
72h Notification due 2026-01-13T09:00:00Z
Final Report pending fix8. Generate the Early Warning package
$ craclock case package case_51df02 --stage ew
✓ Wrote case_51df02-ew.mdThat file is ready to paste into ENISA’s Single Reporting Platform, one section at a time. See What the package looks like for this exact case’s full rendered output.
What just happened
Eight commands, one file. The clock started at step 7, the instant you recorded awareness, not when you got around to filling in a form. Read Concepts for why that distinction is the whole point.