Post by @jbm@infosec.exchange

2026-07-30 10:52 UTC

@allanfriedman@infosec.exchange I think it's a mistake to add the component license to the minimum requirements. Different concern, use cases and workflow (licenses do not change with every release nor component version), different consumers (cyber vs IP), and none of the job of the CISA nor any other orgs listed as co-authors. At work, I fight every week with people mixing SBOM for cyber and SBOM for license. I don't have time to lose with that, "if you want a license SBOM or license info in the SBOM take care of it, because I won't do it for you". So tired of that.

Replies (1)

@allanfriedman@infosec.exchange 2026-07-30 14:08

RE: https://infosec.exchange/@jbm/117008546356872659 I'm quite sympathetic to @jbm@infosec.exchange 's point. True license compliance req also means distinguishing between declared vs discovered, etc. We debated this when I was at CISA, and I was quite torn. The two security arguments are compelling but not what I would call priorities: 1) sustainability: a commercial vendor who does not adhere to licensing requirements may have trouble or legal obstacles to maintaining SW down the road. 2) responsible use of OSS. Tracking licenses can be seen as a proxy for the care an org takes in thinking through what OSS it is using. And it is healthier for the entire software ecosystem if orgs track their OSS use (and ideally contribute!).

Open ##5156059