Using Dev-Doc
Download & export
Your documentation is yours to keep. Download it as one ZIP from the download icon on a project card or Download on the Overview tab. Downloading costs nothing, and source code is never included.
What is in the ZIP
- Documentation — Markdown files for Overview, Architecture, Governance (one file per canvas and one with all decision records) and, if analysed, the Codebase explanations.
- arc42 — the same material in arc42’s 12 chapters, as one Markdown file and as AsciiDoc sources laid out for docToolchain.
- Cyber Resilience Act / NIS2 — SBOMs, a supplier fact sheet, a BSI TR-03183-2 completeness report and component changes between releases.
The arc42 document
| Chapters | Filled from |
|---|---|
| 1 Introduction and goals, 2 Constraints, 10 Quality, 11 Risks | The inception and communication canvases |
| 3 Context and scope | The business context and the system context diagram |
| 4 Solution strategy | The architecture narrative and the tech stack |
| 5 Building block view | Modules, container/component/code diagrams, API surface |
| 7 Deployment, 8 Concepts | Deployment information and the data model, where found |
| 9 Architecture decisions | Your decision records, with their status |
Gaps are marked, never invented: chapters with no source say To be completed by the team. Every filled part names its source and review state.
To use the AsciiDoc sources, copy src/docs/arc42 from the arc42-doctoolchain folder into your docToolchain project and build as usual, e.g. ./dtcw generateHTML.
The CRA / NIS2 pack
| File | Contents |
|---|---|
sbom.cdx.json |
CycloneDX 1.6 SBOM of the third-party components found in your code |
sbom.spdx3.json |
The same as SPDX 3.0.1 |
supplier-fact-sheet.md |
Product overview, component table, interfaces, runtime structure, data stores, tech stack |
sbom-changes.md / .json |
Components added, removed, updated or relicensed between two analyses |
tr-03183-2-completeness.md |
The SBOM checked field by field against BSI TR-03183-2 |
Versions appear only when your code fixes them (a lock file or an exact pin); ranges and unknowns are marked as such, never guessed.
A starting point, not a compliance statement. The fact sheet ends with the commitments only you can make — security contact, vulnerability handling, support period, incident reporting. No vulnerability check is made, and TR-03183-2 also asks for build-time facts (file checksums, the dependency graph) that only your build pipeline can supply.
See also Compliance & evidence.