3 ms·
Recently, President Biden put out an executive order that mandates that NIST et al work out, over the next year, an SBOM/supply chain mandate for software used
by rswail 5y ago
Recently, President Biden put out an executive order that mandates that NIST et al work out, over the next year, an SBOM/supply chain mandate for software used by Federal departments.
That's going to require the equivalent of "chain of custody" attestations along the entire build chain.
Along with SOC and PCI/DSS and other standards, this is going to require companies and developers to adopt NixOS type immutable environments.
- ffk 5y agoUnfortunately, I don't think this is going to be the outcome. We're more likely to end up with "Here is the list of filenames, subcomponents, and associated hashes" as opposed to requiring NixOS style environments. Vendors to the subcontractors will likely be required to provide the same list of filename/subcomponent/hashes, a far cry from repeatable builds.
- 1MachineElf 5y agoI doubt it will happen until NixOS or similar tool has a corresponding DISA STIG.