<!DOCTYPE html><html><head><title></title></head><body><div>On Thu, Oct 2, 2025, at 15:49, Ludovic Courtès wrote:</div><blockquote type="cite" id="qt" style=""><div>FWIW, comrades and I in Guix replied to a previous CISA request for</div><div>comments on identifying software:</div><div><br></div><div> <a href="https://guix.gnu.org/en/blog/2024/identifying-software/">https://guix.gnu.org/en/blog/2024/identifying-software/</a></div><div><br></div><div>The TLDR is:</div><div><br></div><div> 1. Source code can be identified through inherent identifiers such as</div><div> cryptographic hashes—see <<a href="https://www.swhid.org">https://www.swhid.org</a>/> in particular.</div><div><br></div><div> 2. Binary artifacts, instead, need to be the byproduct of a</div><div> verifiable build process itself available as source code.</div></blockquote><div><br></div><div>👍</div><div><br></div><blockquote type="cite" id="qt" style=""><div>CISA’s “Minimum Elements for a Software Bill of Materials (SBOM)” seems</div><div>to mean “binary artifacts” rather than “source code” when it says</div><div>“software” (correct me if I’m wrong, I only skimmed through it), and</div><div>then focuses on how to identify those binary artifacts.</div><div><br></div><div>If that interpretation is correct, I think that’s a mistake because it</div><div>would forego verifiability as provided by reproducible builds in favor</div><div>of something that looks more like paperwork.</div></blockquote><div><br></div><div>Not really: an SBOM is more meant to convey "this aggregate is constructed out of these parts". Identifying the parts (under the 'Software Identifiers' field) is sensibly left to existing schemes, and actually already references SWHID. We can recommend them to update their reference from 1.1 to 1.2 though :)</div><div><br></div><div><br></div><div><br></div><div>Kind regards.</div><div><br></div><div id="sig124436424"><div class="signature">-- </div><div class="signature">Arnout Engelen</div><div class="signature">Engelen Open Source</div><div class="signature"><a href="https://engelen.eu">https://engelen.eu</a></div></div><div><br></div></body></html>