Menu

Software Bill of Materials (SBOM) - US.gov Executive Order May 2021

Help
Anobium
2021-05-21
2022-11-28
  • Anobium

    Anobium - 2021-05-21

    This information can be used to answer the Software Bill of Materials (SBOM) - US.gov Executive Order May 2021

    The table below show the software and the Open Source Software used in the compilation or release of Great Cow BASIC tool chain.

    Item Description Open Source or Commercial
    1 ATMEL programmer Commercial from Microchip Corp copyright 2016
    2 AVRDUDE Open Source - GPL GENERAL PUBLIC LICENSE
    3 AVRDUDESS Open Source - GNU GENERAL PUBLIC LICENSE
    4 CLCDesignerTool Commercial from Microchip Corp copyright 2011
    5 DFU-UTIL Open Source - GPL GENERAL PUBLIC LICENSE
    6 DFU-UTIL Open Source - MIT License (MIT)
    7 G+STools Open Source - GPL GENERAL PUBLIC LICENSE using FreeBASIC (uFB). See https://sourceforge.net/projects/gcbasic/files/Support%20Files/GreatCowBASICWindowsToolchain/ for the complete toolchain.
    8 FREEBASIC (uFB) Open Source - GPL GENERAL PUBLIC LICENSE. See https://sourceforge.net/projects/gcbasic/files/Support%20Files/GreatCowBASICWindowsToolchain/ for the complete toolchain.
    9 Great Cow BASIC Compiler (uFB) Open Source - GPL GENERAL PUBLIC LICENSE. See https://sourceforge.net/projects/gcbasic/files/Support%20Files/GreatCowBASICWindowsToolchain/ for the complete toolchain.
    10 Great Cow Graphical BASIC Compiler using SharpDevelop 2.3.1.xx Open Source - GPL GENERAL PUBLIC LICENSE. See https://sourceforge.net/projects/gcbasic/files/Support%20Files/GreatCowBASICWindowsToolchain/ for the complete toolchain.
    11 16f1454libkwinusb Open Source - GPL GENERAL PUBLIC LICENSE using Commercial from Microsoft Studio
    12 GAWK/AWK Open Source Free Software Foundation, Inc. 2009..2020
    13 Great Cow BASIC Converters (uFB) Open Source - GPL GENERAL PUBLIC LICENSE
    14 gcblibkwinusb Open Source - GPL GENERAL PUBLIC LICENSE using Commercial from Microsoft Studio
    15 imageconverter565 unknown license
    16 USB installers from ZADIG Open Source - LGPL GENERAL PUBLIC LICENSE
    17 SharpDevelop (uSD) Open Source - GPL GENERAL PUBLIC LICENSE
    18 Program Editor Open Source - GPL GENERAL PUBLIC LICENSE using uSD
    19 usb_libkwinusb_testrig Open Source - GPL GENERAL PUBLIC LICENSE using Commercial from Microsoft Studio
    20 Micronucleus Programmer Open Source - GPL GENERAL PUBLIC LICENSE
    21 XOJO (uX) Commerical Xojo End User License Agreement (EULA)
    22 PICINFO using uX Open Source - GPL GENERAL PUBLIC LICENSE
    23 PK2CMD Published Source by Microchip
    24 PICKit2 GUI Published Source by Microchip
    25 AUTOITSCRIPT (uA) Commercial - AUTOITSCRIPT End User License Agreement (EULA)
    26 ipe-pusher.exe usig uA Open Source - GPL GENERAL PUBLIC LICENSE
    27 PICKit3 Published Source by Microchip
    28 PICPgm Published by http://picpgm.picprojects.net/ license unspecified
    29 PPSTool Open Source - GPL GENERAL PUBLIC LICENSE using Commercial from Microsoft Studio
    30 psmcdesigner Commercial from Microchip Corp copyright 2012
    31 SynWrite Open Source Mozilla Public Licence
    32 Terminal License unknown, see https://sites.google.com/site/terminalbpp/
    33 Putty Open Soucce - MIT licence
    34 TinyBootloader Open Source - GPL GENERAL PUBLIC LICENSE
    35 XpressLoaders Open Source - GPL GENERAL PUBLIC LICENSE using Commercial from Microsoft Studio
    36 R2 Build Open Source - GPL GENERAL PUBLIC LICENSE
    37 Nullsoft Scriptable Install System Open Source - zlib/libpng
    38 DAT File Generation Open Source - GPL GENERAL PUBLIC LICENSE. Uses Microchip MPASM and PIC-AS compiler for data sources.
    39 GCStudio Open Source - GPL GENERAL PUBLIC LICENSE/MIT License (MIT)
    40 GCODE Open Source - GPL GENERAL PUBLIC LICENSE/MIT License (MIT)
    41 Visual Studio 2022 Comercial EULA from Microsoft

    This post is dated 27th Jan 2022


    Please post any errors or omissions to this thread. The moderators will keep this table up to date deleting the errors or omissions posts when this table is updated.

     

    Last edit: Angel Mier 2024-06-30
  • Anobium

    Anobium - 2021-05-21

    On May 12th President Joe Biden signed an executive order to change the US federal government cyber defense and to warn all of America that technology security is critical.

    The executive order recognized the vital importance of open-source software. It reads in part: "Within 90 days of publication of the preliminary guidelines (12th May 2021) shall issue guidance identifying practices that enhance the security of the software supply chain." Open-source software is specifically named.

    The action is: If a US.gov solution contains Open Source software then the Software Bill of Materials (SBOM) must be known.

    Developers, including Great Cow BASIC team, are required to respond if they develop open-source software. We need to respond if we want Great Cow BASIC to be used in any US.gov context.

    The US.gov stated that "to the extent practicable, to the integrity and provenance of open-source software used within any portion of a product." Specifically, software developers must provide a Software Bill of Materials (SBOM). "This is a formal record containing the details and supply chain relationships of various components used in building software."

    In the development and release of Great Cow BASIC we assemble the installers using existing open source and commercial software components. The SBOM (shown in the table above) enumerates these components.

    This SBOM is useful to those who develop or manufacture software, those who select or purchase software, and those who use Great Cow BASIC. Users can use an SBOM to perform vulnerability or license analysis, both of which can be used to evaluate risk in Great Cow BASIC. Those who operate software can use the SBOM to quickly and easily determine whether they are at potential risk of a newly discovered vulnerability.

    This is NOT a machine-readable SBOM format. This SBOMs will not be published in a repository that can be easily queried by other applications and systems until SourceForge determine the policy.


    27th Jan 2022 - Evan R. Venn on behalf of the Great Cow BASIC development team.

     

    Last edit: Anobium 2022-01-27

Log in to post a comment.

Want the latest updates on software, tech news, and AI?
Get latest updates about software, tech news, and AI from SourceForge directly in your inbox once a month.