Dan, Thanks for responding, but a "html listing of components" won't work for our particular needs.
Business Cyber Guardian works almost exclusively with the Software Consumer side to determine trustworthiness of a product before installation. We produce a "Trust Score" called a "SAGScore" that enables a consumer to make a risk based decision to install/not install a product, based on a statistically calculated SAGSCore, trust score. Our risk assessment product, SAG-PM, "needs" an SBOM, and if no SBOM is provided by the software supplier, then we create an extrapolated SBOM based on the distributed package contents. My customers want to know "What are you installing in my cyber ecosystem that could lead to cyber risk". We created an SBOM of the curl distribution package (the zip file) as part of a risk assessment where each leaf node in the zip file is represented as a component in the extrapolated SBOM file created by SAG-PM. The curl distribution Package (zip file) contains 359 independent SBOM components, based on zip file contents. These 359 components are then subjected to a "vulnerability search" using NIST NVD to determine if there are any potential "known vulnerability risks". Any discovered risks will lower the trust score (SAGScore). An html file listing components is not sufficient for the risk assessment we perform. Only an SBOM that contains all of the components contained in a "distribution package" will work for this risk assessment. I hope this helps to explain why we need an SBOM for the "distributed" (built/distributed package) in order to perform a proper, comprehensive risk assessment before installation. Thanks, Dick Brooks Active Member of the CISA Critical Manufacturing Sector, Sector Coordinating Council - A Public-Private Partnership Lifetime IEEE Member Never trust software, always verify and report! T Risk always exists, but trust must be earned and awarded.T https://businesscyberguardian.com/ Email: [email protected] Tel: +1 978-696-1788 -----Original Message----- From: curl-users <[email protected]> On Behalf Of Dan Fandrich via curl-users Sent: Tuesday, May 26, 2026 7:31 PM To: [email protected] Cc: Dan Fandrich <[email protected]> Subject: Re: curl verification On Tue, May 26, 2026 at 02:08:06PM +0100, Jeremy Nicoll via curl-users wrote: > On Tue, 26 May 2026, at 13:30, Dick Brooks via curl-users wrote: > > This SBOM is just an extrapolation based on the zip file contents > > downloaded from here: > > https://curl.se/windows/ > > Oh! That's confusing. > > If one's on the curl website & follows the obvious top-of-page-banner > "download" option ... one ends up at: https://curl.se/download.html > > If you scroll that page down there's lots of other (3rd-party?) curl > Windows binaries offered. How is someone supposed to find the page: > > https://curl.se/windows/ ? The curl-provided binaries are listed along with all the other binaries. You'll see a link to that page in the Windows 32-bit and Windows 64-bit sections with the label "the curl project". -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users Etiquette: https://curl.se/mail/etiquette.html -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users Etiquette: https://curl.se/mail/etiquette.html
