Re: [off topic] RE: Re: Country Of Origin Verification - 8944
Jason Pyeron writes: > Unless Cygwin and its packages are never to be used by business > and government, these are legitimate concerns. Just because some of > the users and volunteers do not care or understand does not mean it is > not important. Well, even if any user or volunteer does care and understand, that still does not put them into a position to provide the information that was asked. For the original question: It is clear from earlier communication on this list that Cygwin is in use by various branches of the U.S. government, so if you can get hold of the people who've done that before you'll likely be able to re-use their trail(s) and get 80…90% of your answers by copy > Supply Chain Risk is a real issue. […] > But this approach cannot work for Centos, Cygwin, and other > collections of open source. Right. For Cygwin in particular, there is the additional issue that it is very much a rolling distribution, and packages come and go and change versions all the time. So by the time you've cut through all the red tape you'll have to start over again. I use Cygwin in environments that need to be auditable. While the actual auditing thankfully has not yet been necessary, I've put in place some of the preparations for that nevertheless: 1. The install is from a local repository and setup has been modified to allow only signed installs and been outfitted with a different signing key so users can't go around the local repo and install from the internet (yes, they've tried). 2. The install will always leave you with the same set of packages when successful for each type of installation supported and the install script knows which type of installation belongs on each machine. I could nail that part down harder, but at the moment it suffices. All add-on software for Cygwin that is not in the upstream repository is properly packaged locally and put into the local repository 3. If proper auditing ever becomes necessary I can switch to a phased install model where I can keep certain machines to whatever the audited state is and keep updating the other installs as I do at the moment for all of them. Right now I just have a staging repo that I update frequently and gets copied to the live repo when I tested the staging install OK. 4. I've convinced myself that I could build all packages from source if I had to, but I've not actually done it yet. That would not be a requirement for us anyway, but as requirements change all the time it's better to have that fallback in place. Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ Waldorf MIDI Implementation & additional documentation: http://Synth.Stromeko.net/Downloads.html#WaldorfDocs -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
[off topic] RE: [cygwin] Re: Country Of Origin Verification - 8944
> -Original Message- > From: Brian Inglis > Sent: Wednesday, June 17, 2020 11:17 PM > > On 2020-06-11 11:19, Brian Inglis wrote: > > On 2020-06-11 09:59, Watson, Christian M. (GRC-V000)[Peerless Technologies > > Corp.] via Cygwin wrote: > >> My name is Christian Watson and I am a Supply Chain Risk Management > >> Coordinator at NASA Glenn > Research Center As such, I ensure that all NASA Headquarter IT purchase > requests comply with Section > 514 of the Consolidated Appropriations Act, 2018, Public Law 115-141 > (amended), enacted February 28, > 2018. To do so, the country of origin information must be obtained from the > company that develops, > produces, manufactures, or assembles the product(s). Specifically, identify > the country where each of > the following products were developed, manufactured, and assembled: > > Just checked the basis of what you are asking. > > Section 514 is about use of funds for acquisition: > Cygwin is free software so these criteria *do not apply*! Unless Cygwin and its packages are never to be used by business and government, these are legitimate concerns. Just because some of the users and volunteers do not care or understand does not mean it is not important. Supply Chain Risk is a real issue. It has nothing to do with did you pay for it or get it for free. In the case of the OP they have a Law/Regulation/Policy to comply with - which states they cannot expend money (for labor to use and install software, to operate systems with software, to supply electricity to operate the software, to pay a human to download and install, etc) unless all the parts have been evaluated. Now, in the OPs case the "investigator" was not informed by their technical POC about "what Cygwin" is. They are evaluating it like they would evaluate Microsoft Office 2016 or Microsoft Windows XP. In those cases, the vendor has warrantied the product. This approach even scales to open source software provided by a "company" like Red Hat Enterprise Linux 7. Here the packages bundled with RHEL are curated, supported, and (hopefully) reviewed by the Red Hat company. This approach also works for single open source software projects (e.g. PuttyCAC). But this approach cannot work for Centos, Cygwin, and other collections of open source. Normally the easiest path is to 1. demonstrate that there is an active and responsive community to security issues (e.g. how often are updates made, is there a security announcement list) 2. there is source code available implement security fixes if community support is unavailable - or in the alternative obtain a support contract 3. (this is critical) enumerate EACH package to be authorized, typically with a justification for each. 4. "security scan" it. With this a waiver is easily achieved. Cygwin, Centos, etc are used in sensitive environments, successfully. In some cases we have had to go an extra mile, perform actual source code review. I personally feel it would be worthwhile to assist users like this, and I am happy to do so. I have helped write US Government policy to help adopt the usage of open source more, but it is an up hill battle. Respectfully, Jason Pyeron -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
RE: [cygwin] Re: [EXTERNAL] Re: Country Of Origin Verification - 8944
> -Original Message- > From: Brian Inglis > Sent: Wednesday, June 17, 2020 11:00 PM > To: cygwin@cygwin.com > Cc: Jason Pyeron ; 'Watson, Christian M. > (GRC-V000)[Peerless Technologies Corp.]' > ; 'Pesich, Justin M. (GRC-LTF0)' > > Subject: Re: [cygwin] Re: [EXTERNAL] Re: Country Of Origin Verification - 8944 > > On 2020-06-17 18:44, Jason Pyeron wrote: > > section 508 concerns > > Accessibility? > The web site is plain XHTML, so about as vanilla as you get, but few id, alt, > name, title and no ARIA attributes. The US Government has many regulations. One of them is that the software used must be accessible. It is not about the Cygwin.com website. I have helped a few open source projects by writing a VPAT for them (https://www.section508.gov/sell/vpat). > Volunteers may respond to feedback, but have little time for niceties, and no > time for bureaucracy. Well, that’s why there are more than one type of volunteer. I personally believe it is better to use Cygwin over other closed source or fragmented tool set alternatives. -Jason -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
Re: Country Of Origin Verification - 8944
On 2020-06-11 11:19, Brian Inglis wrote: > On 2020-06-11 09:59, Watson, Christian M. (GRC-V000)[Peerless Technologies > Corp.] via Cygwin wrote: >> My name is Christian Watson and I am a Supply Chain Risk Management >> Coordinator at NASA Glenn Research Center As such, I ensure that all NASA >> Headquarter IT purchase requests comply with Section 514 of the Consolidated >> Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, >> 2018. To do so, the country of origin information must be obtained from the >> company that develops, produces, manufactures, or assembles the product(s). >> Specifically, identify the country where each of the following products were >> developed, manufactured, and assembled: Just checked the basis of what you are asking. Section 514 is about use of funds for acquisition: Cygwin is free software so these criteria *do not apply*! Products were developed and assembled by an international project team. If you are spending funds to acquire this software, ask the people who you are paying for a free product to provide the answers! If in doubt, see what answers are in the files for Linux, NTP, or similar projects. -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised. [Data in IEC units and prefixes, physical quantities in SI.] -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
Re: [cygwin] Re: [EXTERNAL] Re: Country Of Origin Verification - 8944
On 2020-06-17 18:44, Jason Pyeron wrote: > section 508 concerns Accessibility? The web site is plain XHTML, so about as vanilla as you get, but few id, alt, name, title and no ARIA attributes. Volunteers may respond to feedback, but have little time for niceties, and no time for bureaucracy. -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised. [Data in IEC units and prefixes, physical quantities in SI.] -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
RE: [cygwin] Re: [EXTERNAL] Re: Country Of Origin Verification - 8944
> -Original Message- > From: Brian Inglis > Subject: [cygwin] Re: [EXTERNAL] Re: Country Of Origin Verification - 8944 > > On 2020-06-17 13:21, Marco Atzeri via Cygwin wrote: > > On 17.06.2020 17:37, Watson, Christian M. (GRC-V000)[Peerless Technologies > > Corp.] via Cygwin wrote: > >> We appreciate the reply. We are looking to use this software on a NASA > >> facility and that is why we sent you the questions we did to comply with > >> our > >> security restrictions. If you could tell us where this software originated If it helps, I have performed the same for selected packages of Cygwin for Department of State and Department of Defense. I will send my contact information from there. I also had to address section 508 concerns. > >> from that would be all we need to move forward. We have followed the link > >> you > >> suggested and could still not find this information. > > > To make easy for you, as I did for Octave some time ago: > > https://en.wikipedia.org/wiki/Cygwin > > Cygwin was originally developed by Cygnus Solutions, which was later > > acquired by > > Red Hat (now part of IBM). > > https://en.wikipedia.org/wiki/Cygnus_Solutions > > So the original authors were located in USA. > > Also the main server is currently located in USA. > > Cygwin DLL current maintainers and contributors: > https://cygwin.com/git/?p=newlib-cygwin.git;a=blob;f=winsup/CONTRIBUTORS;hb=HEAD > > Cygwin packages current maintainers: > https://cygwin.com/cygwin-pkg-maint > > To get all Cygwin package maintainers, you would have to download the package > archives from https://sourceware.org/pipermail/cygwin-announce/1997-May.txt.gz > thru to the current archive > https://cygwin.com/pipermail/cygwin-announce/2020-June.txt.gz, unzip them all, > and get the senders of each announcement. > > For a package's country of origin, you would have to check with whom, and from > where the source code for the package originated. > > Newlib (Cygwin libc) current maintainers: > https://cygwin.com/git/?p=newlib-cygwin.git;a=blob;f=newlib/MAINTAINERS;hb=HEAD > > To get all Cygwin and Newlib contributors, you would have to clone the > repository at top, list the log, and get the authors of each change. > > You should also be aware that Cygwin and Newlib have incorporated source code > from various BSD systems: FreeBSD, NetBSD, OpenBSD. > > -- > Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada > > This email may be disturbing to some readers as it contains > too much technical detail. Reader discretion is advised. > [Data in IEC units and prefixes, physical quantities in SI.] > -- > Problem reports: https://cygwin.com/problems.html > FAQ: https://cygwin.com/faq/ > Documentation:https://cygwin.com/docs.html > Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
Re: [EXTERNAL] Re: Country Of Origin Verification - 8944
On 2020-06-17 13:21, Marco Atzeri via Cygwin wrote: > On 17.06.2020 17:37, Watson, Christian M. (GRC-V000)[Peerless Technologies > Corp.] via Cygwin wrote: >> We appreciate the reply. We are looking to use this software on a NASA >> facility and that is why we sent you the questions we did to comply with our >> security restrictions. If you could tell us where this software originated >> from that would be all we need to move forward. We have followed the link you >> suggested and could still not find this information. > To make easy for you, as I did for Octave some time ago: > https://en.wikipedia.org/wiki/Cygwin > Cygwin was originally developed by Cygnus Solutions, which was later acquired > by > Red Hat (now part of IBM). > https://en.wikipedia.org/wiki/Cygnus_Solutions > So the original authors were located in USA. > Also the main server is currently located in USA. Cygwin DLL current maintainers and contributors: https://cygwin.com/git/?p=newlib-cygwin.git;a=blob;f=winsup/CONTRIBUTORS;hb=HEAD Cygwin packages current maintainers: https://cygwin.com/cygwin-pkg-maint To get all Cygwin package maintainers, you would have to download the package archives from https://sourceware.org/pipermail/cygwin-announce/1997-May.txt.gz thru to the current archive https://cygwin.com/pipermail/cygwin-announce/2020-June.txt.gz, unzip them all, and get the senders of each announcement. For a package's country of origin, you would have to check with whom, and from where the source code for the package originated. Newlib (Cygwin libc) current maintainers: https://cygwin.com/git/?p=newlib-cygwin.git;a=blob;f=newlib/MAINTAINERS;hb=HEAD To get all Cygwin and Newlib contributors, you would have to clone the repository at top, list the log, and get the authors of each change. You should also be aware that Cygwin and Newlib have incorporated source code from various BSD systems: FreeBSD, NetBSD, OpenBSD. -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised. [Data in IEC units and prefixes, physical quantities in SI.] -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
Re: [EXTERNAL] Re: Country Of Origin Verification - 8944
On 17.06.2020 17:37, Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.] via Cygwin wrote: Hello Brian, We appreciate the reply. We are looking to use this software on a NASA facility and that is why we sent you the questions we did to comply with our security restrictions. If you could tell us where this software originated from that would be all we need to move forward. We have followed the link you suggested and could still not find this information. Thank You. To make easy for you, as I did for Octave some time ago: https://en.wikipedia.org/wiki/Cygwin Cygwin was originally developed by Cygnus Solutions, which was later acquired by Red Hat (now part of IBM). https://en.wikipedia.org/wiki/Cygnus_Solutions So the original authors were located in USA. Also the main server is currently located in USA. Regards Marco Atzeri -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
Re: [EXTERNAL] Re: Country Of Origin Verification - 8944
Greetings, Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.]! > We appreciate the reply. We are looking to use this software on a NASA > facility and that is why we sent you the questions we did to comply with our > security restrictions. If you could tell us where this software originated > from that would be all we need to move forward. We have followed the link > you suggested and could still not find this information. Please read the very first page, https://cygwin.com/ , the two paragraphs at the very top. Cygwin itself, as a software product, is one library - cygwin1.dll. And as is, it's rather useless for any applications. Cygwin as an ecosystem is a collection of opensource software originating all around the globe. -- With best regards, Andrey Repin Wednesday, June 17, 2020 20:58:23 Sorry for my terrible english... -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
Re: [EXTERNAL] Re: Country Of Origin Verification - 8944
On Wed, Jun 17, 2020 at 9:37 AM Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.] wrote: We appreciate the reply. We are looking to use this software on a NASA > facility and that is why we sent you the questions we did to comply with > our security restrictions. If you could tell us where this software > originated from that would be all we need to move forward. We have followed > the link you suggested and could still not find this information. > I doubt there is a simple direct answer to your question. Bill -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
RE: [EXTERNAL] Re: Country Of Origin Verification - 8944
Hello Brian, We appreciate the reply. We are looking to use this software on a NASA facility and that is why we sent you the questions we did to comply with our security restrictions. If you could tell us where this software originated from that would be all we need to move forward. We have followed the link you suggested and could still not find this information. Thank You. -Original Message- From: Brian Inglis Sent: Thursday, June 11, 2020 1:19 PM To: cygwin@cygwin.com Cc: Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.] ; Pesich, Justin M. (GRC-LTF0) Subject: [EXTERNAL] Re: Country Of Origin Verification - 8944 On 2020-06-11 09:59, Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.] via Cygwin wrote: > My name is Christian Watson and I am a Supply Chain Risk Management > Coordinator at NASA Glenn Research Center As such, I ensure that all NASA > Headquarter IT purchase requests comply with Section 514 of the Consolidated > Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, > 2018. To do so, the country of origin information must be obtained from the > company that develops, produces, manufactures, or assembles the product(s). > Specifically, identify the country where each of the following products were > developed, manufactured, and assembled: > > * Cygwin 3.1.5 [DISCLAIMER: the following is FYI - I am a volunteer with no status] As Cygwin is a volunteer international open source *FREE* software project, not a company, and it consists of thousands of separate packages, each maintained by international volunteers, please submit this query to the organization to whom you submitted the purchase request, who will have paid employees to do this research for you, for each of the thousands of included packages. If no one submitted a purchase request: when the software was downloaded, you received everything to which you are entitled, plus you may read the information available on the site with home page https://urldefense.proofpoint.com/v2/url?u=https-3A__cygwin.com_=DwICaQ=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk=L_8MYtRhcq5AQXqH3xNfoPGhNQbTpx_j_8nEjTzCUd4=0zUfOax9tFKJLh9rktm_xSw2E2JpKRccdXrbAhInLF4=qE8V0Uq3YERrrPfN5AkXb5lq_t7jGL9oYAUMVZ4ojYE= , to dreive the information you request. > Additionally, if the country of origin is outside the United States, please > provide any information you may have stating that testing is performed in the > United States prior to supplying products to customers. >From CYGWIN_LICENSE: "THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE." See https://urldefense.proofpoint.com/v2/url?u=https-3A__cygwin.com_licensing.html=DwICaQ=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk=L_8MYtRhcq5AQXqH3xNfoPGhNQbTpx_j_8nEjTzCUd4=0zUfOax9tFKJLh9rktm_xSw2E2JpKRccdXrbAhInLF4=kgLC8m6tzY_zRsgZbakDwfhcrIovkK3qPG0nxk86aTo= for more disclaimers in the linked licences. > Lastly, if available, please identify all authorized distributors of the > product in question. No distributors are authorize: everyone is authorized to distribute Cygwin packages as long as they meet all the applicable licensing terms. From https://urldefense.proofpoint.com/v2/url?u=https-3A__cygwin.com_licensing.html=DwICaQ=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk=L_8MYtRhcq5AQXqH3xNfoPGhNQbTpx_j_8nEjTzCUd4=0zUfOax9tFKJLh9rktm_xSw2E2JpKRccdXrbAhInLF4=kgLC8m6tzY_zRsgZbakDwfhcrIovkK3qPG0nxk86aTo= : "Does Cygwin have an [US]ECCN[Export Classification Control Number ([US]EAR[Export Administration Regulations])] number? No. Cygwin source and binary are made publicly available and free of charge to download so Cygwin is provided under [US]TSU[Technology and Software Unrestricted (EAR license exception)]/[US]TSPA[Technology and Software Publicly Available] exemption. As a result, Cygwin does not require an ECCN number." There are over a hundred known monitored sites provided by organizations around the world, and more adhoc mirror sites for distribution of the software around the world, many publicly available at universities, or internal to large organizations, and large companies. You may find NASA has one or more Cygwin mirror sites: e.g. ftp://ftp.nas.nasa.gov/mirrors/cygwin.com/pub/cygwin/ -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised. [Data in IEC units and prefixes, physical quantities in SI.] -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
Re: Country Of Origin Verification - 8944
On Thu, Jun 11, 2020 at 11:24:09AM -0600, Brian Inglis wrote: >On 2020-06-11 10:07, Watson, Christian M. (GRC-V000)[Peerless Technologies >Corp.] via Cygwin wrote: >> My name is Christian Watson and I am a Supply Chain Risk Management >> Coordinator at NASA Glenn Research Center As such, I ensure that all NASA >> Headquarter IT purchase requests comply with Section 514 of the Consolidated >> Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, >> 2018. To do so, the country of origin information must be obtained from the >> company that develops, produces, manufactures, or assembles the product(s). >> Specifically, identify the country where each of the following products were >> developed, manufactured, and assembled: >> >> * TightVNC 2.8.27 >> >> Additionally, if the country of origin is outside the United States, please >> provide any information you may have stating that testing is performed in >> the United States prior to supplying products to customers. >> Lastly, if available, please identify all authorized distributors of the >> product in question. > >This is the second email like this you have sent to the Cygwin mailing list: >if you are going to send a bunch of these to the Cygwin mailing list, you >should >save yourself time and energy, and list all the Cygwin packages in one email, >which may receive no response, unless you are spam blocked. ^^^ ...which is a very good possibility if this proves to be write-only email. cgf -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
Re: Country Of Origin Verification - 8944
On 2020-06-11 10:07, Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.] via Cygwin wrote: > My name is Christian Watson and I am a Supply Chain Risk Management > Coordinator at NASA Glenn Research Center As such, I ensure that all NASA > Headquarter IT purchase requests comply with Section 514 of the Consolidated > Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, > 2018. To do so, the country of origin information must be obtained from the > company that develops, produces, manufactures, or assembles the product(s). > Specifically, identify the country where each of the following products were > developed, manufactured, and assembled: > > * TightVNC 2.8.27 > > Additionally, if the country of origin is outside the United States, please > provide any information you may have stating that testing is performed in the > United States prior to supplying products to customers. > Lastly, if available, please identify all authorized distributors of the > product in question. This is the second emial like this you have sent to the Cygwin mailing list: if you are going to send a bunch of these to the Cygwin mailing list, you should save yourself time and energy, and list all the Cygwin packages in one email, which may receive no response, unless you are spam blocked. -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised. [Data in IEC units and prefixes, physical quantities in SI.] -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
Re: Country Of Origin Verification - 8944
On 2020-06-11 09:59, Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.] via Cygwin wrote: > My name is Christian Watson and I am a Supply Chain Risk Management > Coordinator at NASA Glenn Research Center As such, I ensure that all NASA > Headquarter IT purchase requests comply with Section 514 of the Consolidated > Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, > 2018. To do so, the country of origin information must be obtained from the > company that develops, produces, manufactures, or assembles the product(s). > Specifically, identify the country where each of the following products were > developed, manufactured, and assembled: > > * Cygwin 3.1.5 [DISCLAIMER: the following is FYI - I am a volunteer with no status] As Cygwin is a volunteer international open source *FREE* software project, not a company, and it consists of thousands of separate packages, each maintained by international volunteers, please submit this query to the organization to whom you submitted the purchase request, who will have paid employees to do this research for you, for each of the thousands of included packages. If no one submitted a purchase request: when the software was downloaded, you received everything to which you are entitled, plus you may read the information available on the site with home page https://cygwin.com/, to dreive the information you request. > Additionally, if the country of origin is outside the United States, please > provide any information you may have stating that testing is performed in the > United States prior to supplying products to customers. >From CYGWIN_LICENSE: "THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE." See https://cygwin.com/licensing.html for more disclaimers in the linked licences. > Lastly, if available, please identify all authorized distributors of the > product in question. No distributors are authorize: everyone is authorized to distribute Cygwin packages as long as they meet all the applicable licensing terms. From https://cygwin.com/licensing.html: "Does Cygwin have an [US]ECCN[Export Classification Control Number ([US]EAR[Export Administration Regulations])] number? No. Cygwin source and binary are made publicly available and free of charge to download so Cygwin is provided under [US]TSU[Technology and Software Unrestricted (EAR license exception)]/[US]TSPA[Technology and Software Publicly Available] exemption. As a result, Cygwin does not require an ECCN number." There are over a hundred known monitored sites provided by organizations around the world, and more adhoc mirror sites for distribution of the software around the world, many publicly available at universities, or internal to large organizations, and large companies. You may find NASA has one or more Cygwin mirror sites: e.g. ftp://ftp.nas.nasa.gov/mirrors/cygwin.com/pub/cygwin/ -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised. [Data in IEC units and prefixes, physical quantities in SI.] -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
Country Of Origin Verification - 8944
Hello, My name is Christian Watson and I am a Supply Chain Risk Management Coordinator at NASA Glenn Research Center As such, I ensure that all NASA Headquarter IT purchase requests comply with Section 514 of the Consolidated Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, 2018. To do so, the country of origin information must be obtained from the company that develops, produces, manufactures, or assembles the product(s). Specifically, identify the country where each of the following products were developed, manufactured, and assembled: * TightVNC 2.8.27 Additionally, if the country of origin is outside the United States, please provide any information you may have stating that testing is performed in the United States prior to supplying products to customers. Lastly, if available, please identify all authorized distributors of the product in question. Christian Watson Peerless Technologies Corporation NASA Glenn Research Center 21000 Brook Park Rd, MS 142-1 Cleveland, OH 44135 216.433.5061 -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
Country Of Origin Verification - 8944
Hello, My name is Christian Watson and I am a Supply Chain Risk Management Coordinator at NASA Glenn Research Center As such, I ensure that all NASA Headquarter IT purchase requests comply with Section 514 of the Consolidated Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, 2018. To do so, the country of origin information must be obtained from the company that develops, produces, manufactures, or assembles the product(s). Specifically, identify the country where each of the following products were developed, manufactured, and assembled: * Cygwin 3.1.5 Additionally, if the country of origin is outside the United States, please provide any information you may have stating that testing is performed in the United States prior to supplying products to customers. Lastly, if available, please identify all authorized distributors of the product in question. Christian Watson Peerless Technologies Corporation NASA Glenn Research Center 21000 Brook Park Rd, MS 142-1 Cleveland, OH 44135 216.433.5061 -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation:https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
Re: Origin (Where You From?)
Where about on the Globe do you reside? (In other words, Where You From?) Poland Artur Hefczyc
Origin (Where You From?)
Hi, Where about on the Globe do you reside? (In other words, Where You From?) Best regards, Kenny Ho This email is sent in compliance with strict anti-abuse and NO SPAM regulations. Your address was collected as a result of posting to a link, a classified ad or you are on a list that I have purchased. To remove your E-mail address, simply reply with REMOVE on SUBJECT line.
Re: Origin
On 10 Oct 2002, Robert Collins wrote: On Thu, 2002-10-10 at 16:00, [EMAIL PROTECTED] wrote: Im right here. You can't be, because I'm right here and I know that you're not. Pats self, with concerned look on face - you know, you're right, I'm *not here*. Hlp Oh, come on! I can see you standing here, plain as the nose on my ... Hey! Who took my nose!? Alright, whichever one of yous took it, cough it up! Rob -- Peter A. Castro [EMAIL PROTECTED] or [EMAIL PROTECTED] Cats are just autistic Dogs -- Dr. Tony Attwood -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Bug reporting: http://cygwin.com/bugs.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: Origin
On Thu, 2002-10-10 at 16:00, [EMAIL PROTECTED] wrote: Im right here. You can't be, because I'm right here and I know that you're not. Pats self, with concerned look on face - you know, you're right, I'm *not here*. Hlp Rob -- --- GPG key available at: http://users.bigpond.net.au/robertc/keys.txt. --- signature.asc Description: This is a digitally signed message part
Origin
Hi, Where about on the globe do you reside? Yours Sincerely, Robert Foong. -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Bug reporting: http://cygwin.com/bugs.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: Origin
On Wed, 2002-10-09 at 13:51, Robert Foong wrote: Hi, Where about on the globe do you reside? Im right here. Rob -- --- GPG key available at: http://users.bigpond.net.au/robertc/keys.txt. --- signature.asc Description: This is a digitally signed message part
Re: Origin
Hello from Gregg C Levine And who would like to know? Sorry, but I am not in the habit of releasing such information to outsiders, via e-mail. Gregg C Levine [EMAIL PROTECTED] Oh my! The Second Doctor's nearly favorite phrase. - Original Message - From: Robert Foong [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 08, 2002 11:51 PM Subject: Origin Hi, Where about on the globe do you reside? Yours Sincerely, Robert Foong. -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Bug reporting: http://cygwin.com/bugs.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/ -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Bug reporting: http://cygwin.com/bugs.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: Origin
On Wed, Oct 09, 2002 at 01:43:26PM +1000, Robert Collins wrote: On Wed, 2002-10-09 at 13:51, Robert Foong wrote: Where about on the globe do you reside? Im right here. Oh. Is that you? Sorry, I didn't recognize you. Please pass the beer. cgf -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Bug reporting: http://cygwin.com/bugs.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: Re : Origin [44824572]
Hi, please keep replies on-list. I'm not sure why you thought I'd be interested in this piece of unsolicited commercial email, but I assure you I am not. It's my fond hope that my bar mate Chris whom my arms are not quite long enough to pass the beer to will kick and ban your spammy ass from the cygwin lists, hopefully all the way back to the stone age. Yours sincerely, Rob On Wed, 2002-10-09 at 15:26, Robert Foong wrote: Hi, Thanks for replying. I am from a little dot on the Globe called Malaysia. I suppose you have heard of it. As well as becoming friends, I hope we can become business partners. I am actually representing a UK based company as an Independent Consultant. We are the largest exporter of E-LEARNING ( Online computer training ) in the world. I am working very closely with one of the top 5 highest earners within the company in the World. who started almost 2 yrs in the E-learning industry and is already financially secure for the rest of his life. Our Company has an 8yrs trading history and our courses are Certified by MICROSOFT, ICDL, ECDL, and MOUS. This will give you an indication of the power that is behind us. What we are looking for is a highly, self motivated Individual with whom we can work with. Our aim, if you're interested, is to work together and help you prosper with one of the most outstanding opportunities in the Net, all in the space of 12 months. ( Serious money, it will surpass anything you ever anticipated before. ) Please have a serious think about it. Yours Sincerely Robert Foong. -- --- GPG key available at: http://users.bigpond.net.au/robertc/keys.txt. --- signature.asc Description: This is a digitally signed message part
Re: Re : Origin [44824572]
On Wed, Oct 09, 2002 at 03:24:22PM +1000, Robert Collins wrote: Hi, please keep replies on-list. Just this once, that may not be the best advice since it isn't actually going to be possible for this person to keep anything on-list. What scum. cgf I'm not sure why you thought I'd be interested in this piece of unsolicited commercial email, but I assure you I am not. It's my fond hope that my bar mate Chris whom my arms are not quite long enough to pass the beer to will kick and ban your spammy ass from the cygwin lists, hopefully all the way back to the stone age. Yours sincerely, Rob On Wed, 2002-10-09 at 15:26, Robert Foong wrote: [highly annoying spam snipped] -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Bug reporting: http://cygwin.com/bugs.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Origin of gcc sources
Hello, guys! Could you please clarify what's the origin of gcc-2.95.3-5 is? Is it gcc CVS? Or what? I found that it strongly differs from gcc-2.95.3 release from GNU... Thank you in advance, Ildar Mulyukov -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Bug reporting: http://cygwin.com/bugs.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: Origin of gcc sources
At 06:56 AM 2/15/2002, Ildar Mulyukov wrote: Hello, guys! Could you please clarify what's the origin of gcc-2.95.3-5 is? Is it gcc CVS? Or what? I found that it strongly differs from gcc-2.95.3 release from GNU... The basis is GNU gcc-2.95.3 with added patches that haven't made it into the baseline yet. Larry Hall [EMAIL PROTECTED] RFK Partners, Inc. http://www.rfk.com 838 Washington Street (508) 893-9779 - RFK Office Holliston, MA 01746 (508) 893-9889 - FAX -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Bug reporting: http://cygwin.com/bugs.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
