Country Of Origin Verification - 8944

Country Of Origin Verification - 8944

[Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.]]

Hello,

My name is Christian Watson and I am a Supply Chain Risk Management Coordinator at NASA Glenn Research Center  As such, I ensure that all NASA Headquarter IT purchase requests comply with Section 514 of the Consolidated Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, 2018.  To do so, the country of origin information must be obtained from the company that develops, produces, manufactures, or assembles the product(s).  Specifically, identify the country where each of the following products were developed, manufactured, and assembled:

* Cygwin 3.1.5

Additionally, if the country of origin is outside the United States, please provide any information you may have stating that testing is performed in the United States prior to supplying products to customers.
Lastly, if available, please identify all authorized distributors of the product in question.




Christian Watson
Peerless Technologies Corporation
NASA Glenn Research Center
21000 Brook Park Rd, MS 142-1
Cleveland, OH 44135
216.433.5061

Re: Country Of Origin Verification - 8944

[Brian Inglis]

On 2020-06-11 09:59, Watson, Christian M. (GRC-V000)[Peerless Technologies
Corp.] via Cygwin wrote:
> My name is Christian Watson and I am a Supply Chain Risk Management Coordinator at NASA Glenn Research Center  As such, I ensure that all NASA Headquarter IT purchase requests comply with Section 514 of the Consolidated Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, 2018.  To do so, the country of origin information must be obtained from the company that develops, produces, manufactures, or assembles the product(s).  Specifically, identify the country where each of the following products were developed, manufactured, and assembled:
> 
> * Cygwin 3.1.5

[DISCLAIMER: the following is FYI - I am a volunteer with no status]

As Cygwin is a volunteer international open source *FREE* software project, not
a company, and it consists of thousands of separate packages, each maintained by
international volunteers, please submit this query to the organization to whom
you submitted the purchase request, who will have paid employees to do this
research for you, for each of the thousands of included packages.
If no one submitted a purchase request: when the software was downloaded, you
received everything to which you are entitled, plus you may read the information
available on the site with home page https://cygwin.com/, to dreive the
information you request.

> Additionally, if the country of origin is outside the United States, please provide any information you may have stating that testing is performed in the United States prior to supplying products to customers.

From CYGWIN_LICENSE:

"THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESSED OR
IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE."

See
	https://cygwin.com/licensing.html

for more disclaimers in the linked licences.

> Lastly, if available, please identify all authorized distributors of the product in question.

No distributors are authorize: everyone is authorized to distribute Cygwin
packages as long as they meet all the applicable licensing terms.

From
	https://cygwin.com/licensing.html:

"Does Cygwin have an [US]ECCN[Export Classification Control Number
([US]EAR[Export Administration Regulations])] number?

No. Cygwin source and binary are made publicly available and free of charge to
download so Cygwin is provided under [US]TSU[Technology and Software
Unrestricted (EAR license exception)]/[US]TSPA[Technology and Software Publicly
Available] exemption. As a result, Cygwin does not require an ECCN number."

There are over a hundred known monitored sites provided by organizations around
the world, and more adhoc mirror sites for distribution of the software around
the world, many publicly available at universities, or internal to large
organizations, and large companies.
You may find NASA has one or more Cygwin mirror sites: e.g.

	ftp://ftp.nas.nasa.gov/mirrors/cygwin.com/pub/cygwin/

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.
[Data in IEC units and prefixes, physical quantities in SI.]

RE: [EXTERNAL] Re: Country Of Origin Verification - 8944

[Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.]]

Hello Brian,

We appreciate the reply. We are looking to use this software on a NASA facility and that is why we sent you the questions we did to comply with our security restrictions. If you could tell us where this software originated from that would be all we need to move forward. We have followed the link you suggested and could still not find this information.


Thank You.

-----Original Message-----
From: Brian Inglis <Brian.Inglis@SystematicSw.ab.ca> 
Sent: Thursday, June 11, 2020 1:19 PM
To: cygwin@cygwin.com
Cc: Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.] <christian.m.watson@nasa.gov>; Pesich, Justin M. (GRC-LTF0) <justin.m.pesich@nasa.gov>
Subject: [EXTERNAL] Re: Country Of Origin Verification - 8944

On 2020-06-11 09:59, Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.] via Cygwin wrote:
> My name is Christian Watson and I am a Supply Chain Risk Management Coordinator at NASA Glenn Research Center  As such, I ensure that all NASA Headquarter IT purchase requests comply with Section 514 of the Consolidated Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, 2018.  To do so, the country of origin information must be obtained from the company that develops, produces, manufactures, or assembles the product(s).  Specifically, identify the country where each of the following products were developed, manufactured, and assembled:
> 
> * Cygwin 3.1.5

[DISCLAIMER: the following is FYI - I am a volunteer with no status]

As Cygwin is a volunteer international open source *FREE* software project, not a company, and it consists of thousands of separate packages, each maintained by international volunteers, please submit this query to the organization to whom you submitted the purchase request, who will have paid employees to do this research for you, for each of the thousands of included packages.
If no one submitted a purchase request: when the software was downloaded, you received everything to which you are entitled, plus you may read the information available on the site with home page https://urldefense.proofpoint.com/v2/url?u=https-3A__cygwin.com_&d=DwICaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=L_8MYtRhcq5AQXqH3xNfoPGhNQbTpx_j_8nEjTzCUd4&m=0zUfOax9tFKJLh9rktm_xSw2E2JpKRccdXrbAhInLF4&s=qE8V0Uq3YERrrPfN5AkXb5lq_t7jGL9oYAUMVZ4ojYE&e= , to dreive the information you request.

> Additionally, if the country of origin is outside the United States, please provide any information you may have stating that testing is performed in the United States prior to supplying products to customers.

From CYGWIN_LICENSE:

"THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE."

See
	https://urldefense.proofpoint.com/v2/url?u=https-3A__cygwin.com_licensing.html&d=DwICaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=L_8MYtRhcq5AQXqH3xNfoPGhNQbTpx_j_8nEjTzCUd4&m=0zUfOax9tFKJLh9rktm_xSw2E2JpKRccdXrbAhInLF4&s=kgLC8m6tzY_zRsgZbakDwfhcrIovkK3qPG0nxk86aTo&e= 

for more disclaimers in the linked licences.

> Lastly, if available, please identify all authorized distributors of the product in question.

No distributors are authorize: everyone is authorized to distribute Cygwin packages as long as they meet all the applicable licensing terms.

From
	https://urldefense.proofpoint.com/v2/url?u=https-3A__cygwin.com_licensing.html&d=DwICaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=L_8MYtRhcq5AQXqH3xNfoPGhNQbTpx_j_8nEjTzCUd4&m=0zUfOax9tFKJLh9rktm_xSw2E2JpKRccdXrbAhInLF4&s=kgLC8m6tzY_zRsgZbakDwfhcrIovkK3qPG0nxk86aTo&e= :

"Does Cygwin have an [US]ECCN[Export Classification Control Number ([US]EAR[Export Administration Regulations])] number?

No. Cygwin source and binary are made publicly available and free of charge to download so Cygwin is provided under [US]TSU[Technology and Software Unrestricted (EAR license exception)]/[US]TSPA[Technology and Software Publicly Available] exemption. As a result, Cygwin does not require an ECCN number."

There are over a hundred known monitored sites provided by organizations around the world, and more adhoc mirror sites for distribution of the software around the world, many publicly available at universities, or internal to large organizations, and large companies.
You may find NASA has one or more Cygwin mirror sites: e.g.

	ftp://ftp.nas.nasa.gov/mirrors/cygwin.com/pub/cygwin/

--
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised.
[Data in IEC units and prefixes, physical quantities in SI.]

Re: [EXTERNAL] Re: Country Of Origin Verification - 8944

[Bill Stewart]

On Wed, Jun 17, 2020 at 9:37 AM Watson, Christian M. (GRC-V000)[Peerless
Technologies Corp.] wrote:

We appreciate the reply. We are looking to use this software on a NASA
> facility and that is why we sent you the questions we did to comply with
> our security restrictions. If you could tell us where this software
> originated from that would be all we need to move forward. We have followed
> the link you suggested and could still not find this information.
>

I doubt there is a simple direct answer to your question.

Bill

Re: [EXTERNAL] Re: Country Of Origin Verification - 8944

[Andrey Repin]

Greetings, Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.]!

> We appreciate the reply. We are looking to use this software on a NASA
> facility and that is why we sent you the questions we did to comply with our
> security restrictions. If you could tell us where this software originated
> from that would be all we need to move forward. We have followed the link
> you suggested and could still not find this information.

Please read the very first page, https://cygwin.com/ , the two paragraphs at
the very top.

Cygwin itself, as a software product, is one library - cygwin1.dll.
And as is, it's rather useless for any applications.

Cygwin as an ecosystem is a collection of opensource software originating all
around the globe.


-- 
With best regards,
Andrey Repin
Wednesday, June 17, 2020 20:58:23

Sorry for my terrible english...

Re: [EXTERNAL] Re: Country Of Origin Verification - 8944

[Marco Atzeri]

On 17.06.2020 17:37, Watson, Christian M. (GRC-V000)[Peerless 
Technologies Corp.] via Cygwin wrote:
> Hello Brian,
> 
> We appreciate the reply. We are looking to use this software on a NASA facility and that is why we sent you the questions we did to comply with our security restrictions. If you could tell us where this software originated from that would be all we need to move forward. We have followed the link you suggested and could still not find this information.
> 
> 
> Thank You.



To make easy for you, as I did for Octave some time ago:

https://en.wikipedia.org/wiki/Cygwin

Cygwin was originally developed by Cygnus Solutions, which was later 
acquired by Red Hat (now part of IBM).

https://en.wikipedia.org/wiki/Cygnus_Solutions

So the original authors were located in USA.
Also the main server is currently located in USA.

Regards
Marco Atzeri

Re: [EXTERNAL] Re: Country Of Origin Verification - 8944

[Brian Inglis]

On 2020-06-17 13:21, Marco Atzeri via Cygwin wrote:
> On 17.06.2020 17:37, Watson, Christian M. (GRC-V000)[Peerless Technologies
> Corp.] via Cygwin wrote:
>> We appreciate the reply. We are looking to use this software on a NASA
>> facility and that is why we sent you the questions we did to comply with our
>> security restrictions. If you could tell us where this software originated
>> from that would be all we need to move forward. We have followed the link you
>> suggested and could still not find this information.

> To make easy for you, as I did for Octave some time ago:
> https://en.wikipedia.org/wiki/Cygwin
> Cygwin was originally developed by Cygnus Solutions, which was later acquired by
> Red Hat (now part of IBM).
> https://en.wikipedia.org/wiki/Cygnus_Solutions
> So the original authors were located in USA.
> Also the main server is currently located in USA.

Cygwin DLL current maintainers and contributors:
https://cygwin.com/git/?p=newlib-cygwin.git;a=blob;f=winsup/CONTRIBUTORS;hb=HEAD

Cygwin packages current maintainers:
https://cygwin.com/cygwin-pkg-maint

To get all Cygwin package maintainers, you would have to download the package
archives from https://sourceware.org/pipermail/cygwin-announce/1997-May.txt.gz
thru to the current archive
https://cygwin.com/pipermail/cygwin-announce/2020-June.txt.gz, unzip them all,
and get the senders of each announcement.

For a package's country of origin, you would have to check with whom, and from
where the source code for the package originated.

Newlib (Cygwin libc) current maintainers:
https://cygwin.com/git/?p=newlib-cygwin.git;a=blob;f=newlib/MAINTAINERS;hb=HEAD

To get all Cygwin and Newlib contributors, you would have to clone the
repository at top, list the log, and get the authors of each change.

You should also be aware that Cygwin and Newlib have incorporated source code
from various BSD systems: FreeBSD, NetBSD, OpenBSD.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.
[Data in IEC units and prefixes, physical quantities in SI.]

RE: [cygwin] Re: [EXTERNAL] Re: Country Of Origin Verification - 8944

[Jason Pyeron]

> -----Original Message-----
> From: Brian Inglis
> Subject: [cygwin] Re: [EXTERNAL] Re: Country Of Origin Verification - 8944
> 
> On 2020-06-17 13:21, Marco Atzeri via Cygwin wrote:
> > On 17.06.2020 17:37, Watson, Christian M. (GRC-V000)[Peerless Technologies
> > Corp.] via Cygwin wrote:
> >> We appreciate the reply. We are looking to use this software on a NASA
> >> facility and that is why we sent you the questions we did to comply with our
> >> security restrictions. If you could tell us where this software originated

If it helps, I have performed the same for selected packages of Cygwin for Department of State and Department of Defense. I will send my contact information from there. I also had to address section 508 concerns.

> >> from that would be all we need to move forward. We have followed the link you
> >> suggested and could still not find this information.
> 
> > To make easy for you, as I did for Octave some time ago:
> > https://en.wikipedia.org/wiki/Cygwin
> > Cygwin was originally developed by Cygnus Solutions, which was later acquired by
> > Red Hat (now part of IBM).
> > https://en.wikipedia.org/wiki/Cygnus_Solutions
> > So the original authors were located in USA.
> > Also the main server is currently located in USA.
> 
> Cygwin DLL current maintainers and contributors:
> https://cygwin.com/git/?p=newlib-cygwin.git;a=blob;f=winsup/CONTRIBUTORS;hb=HEAD
> 
> Cygwin packages current maintainers:
> https://cygwin.com/cygwin-pkg-maint
> 
> To get all Cygwin package maintainers, you would have to download the package
> archives from https://sourceware.org/pipermail/cygwin-announce/1997-May.txt.gz
> thru to the current archive
> https://cygwin.com/pipermail/cygwin-announce/2020-June.txt.gz, unzip them all,
> and get the senders of each announcement.
> 
> For a package's country of origin, you would have to check with whom, and from
> where the source code for the package originated.
> 
> Newlib (Cygwin libc) current maintainers:
> https://cygwin.com/git/?p=newlib-cygwin.git;a=blob;f=newlib/MAINTAINERS;hb=HEAD
> 
> To get all Cygwin and Newlib contributors, you would have to clone the
> repository at top, list the log, and get the authors of each change.
> 
> You should also be aware that Cygwin and Newlib have incorporated source code
> from various BSD systems: FreeBSD, NetBSD, OpenBSD.
> 
> --
> Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada
> 
> This email may be disturbing to some readers as it contains
> too much technical detail. Reader discretion is advised.
> [Data in IEC units and prefixes, physical quantities in SI.]
> --
> Problem reports:      https://cygwin.com/problems.html
> FAQ:                  https://cygwin.com/faq/
> Documentation:        https://cygwin.com/docs.html
> Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

Re: [cygwin] Re: [EXTERNAL] Re: Country Of Origin Verification - 8944

[Brian Inglis]

On 2020-06-17 18:44, Jason Pyeron wrote:
> section 508 concerns

Accessibility?
The web site is plain XHTML, so about as vanilla as you get, but few id, alt,
name, title and no ARIA attributes.
Volunteers may respond to feedback, but have little time for niceties, and no
time for bureaucracy.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.
[Data in IEC units and prefixes, physical quantities in SI.]

Re: Country Of Origin Verification - 8944

[Brian Inglis]

On 2020-06-11 11:19, Brian Inglis wrote:
> On 2020-06-11 09:59, Watson, Christian M. (GRC-V000)[Peerless Technologies
> Corp.] via Cygwin wrote:
>> My name is Christian Watson and I am a Supply Chain Risk Management Coordinator at NASA Glenn Research Center  As such, I ensure that all NASA Headquarter IT purchase requests comply with Section 514 of the Consolidated Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, 2018.  To do so, the country of origin information must be obtained from the company that develops, produces, manufactures, or assembles the product(s).  Specifically, identify the country where each of the following products were developed, manufactured, and assembled:

Just checked the basis of what you are asking.

Section 514 is about use of funds for acquisition:
Cygwin is free software so these criteria *do not apply*!

Products were developed and assembled by an international project team.

If you are spending funds to acquire this software, ask the people who you are
paying for a free product to provide the answers!

If in doubt, see what answers are in the files for Linux, NTP, or similar projects.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.
[Data in IEC units and prefixes, physical quantities in SI.]

RE: [cygwin] Re: [EXTERNAL] Re: Country Of Origin Verification - 8944

[Jason Pyeron]

> -----Original Message-----
> From: Brian Inglis <Brian.Inglis@systematicsw.ab.ca>
> Sent: Wednesday, June 17, 2020 11:00 PM
> To: cygwin@cygwin.com
> Cc: Jason Pyeron <jpyeron@pdinc.us>; 'Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.]'
> <christian.m.watson@nasa.gov>; 'Pesich, Justin M. (GRC-LTF0)' <justin.m.pesich@nasa.gov>
> Subject: Re: [cygwin] Re: [EXTERNAL] Re: Country Of Origin Verification - 8944
> 
> On 2020-06-17 18:44, Jason Pyeron wrote:
> > section 508 concerns
> 
> Accessibility?
> The web site is plain XHTML, so about as vanilla as you get, but few id, alt,
> name, title and no ARIA attributes.

The US Government has many regulations. One of them is that the software used must be accessible. It is not about the Cygwin.com website. I have helped a few open source projects by writing a VPAT for them (https://www.section508.gov/sell/vpat).

> Volunteers may respond to feedback, but have little time for niceties, and no
> time for bureaucracy.

Well, that’s why there are more than one type of volunteer. I personally believe it is better to use Cygwin over other closed source or fragmented tool set alternatives.

-Jason

Re: Country Of Origin Verification - 8944

[Christopher Faylor]

On Thu, Jun 11, 2020 at 11:24:09AM -0600, Brian Inglis wrote:
>On 2020-06-11 10:07, Watson, Christian M. (GRC-V000)[Peerless Technologies
>Corp.] via Cygwin wrote:
>> My name is Christian Watson and I am a Supply Chain Risk Management Coordinator at NASA Glenn Research Center  As such, I ensure that all NASA Headquarter IT purchase requests comply with Section 514 of the Consolidated Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, 2018.  To do so, the country of origin information must be obtained from the company that develops, produces, manufactures, or assembles the product(s).  Specifically, identify the country where each of the following products were developed, manufactured, and assembled:
>> 
>> * TightVNC 2.8.27
>> 
>> Additionally, if the country of origin is outside the United States, please provide any information you may have stating that testing is performed in the United States prior to supplying products to customers.
>> Lastly, if available, please identify all authorized distributors of the product in question.
>
>This is the second email like this you have sent to the Cygwin mailing list:
>if you are going to send a bunch of these to the Cygwin mailing list, you should
>save yourself time and energy, and list all the Cygwin packages in one email,
>which may receive no response, unless you are spam blocked.
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^

...which is a very good possibility if this proves to be write-only email.

cgf

Re: Country Of Origin Verification - 8944

[Brian Inglis]

On 2020-06-11 10:07, Watson, Christian M. (GRC-V000)[Peerless Technologies
Corp.] via Cygwin wrote:
> My name is Christian Watson and I am a Supply Chain Risk Management Coordinator at NASA Glenn Research Center  As such, I ensure that all NASA Headquarter IT purchase requests comply with Section 514 of the Consolidated Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, 2018.  To do so, the country of origin information must be obtained from the company that develops, produces, manufactures, or assembles the product(s).  Specifically, identify the country where each of the following products were developed, manufactured, and assembled:
> 
> * TightVNC 2.8.27
> 
> Additionally, if the country of origin is outside the United States, please provide any information you may have stating that testing is performed in the United States prior to supplying products to customers.
> Lastly, if available, please identify all authorized distributors of the product in question.

This is the second emial like this you have sent to the Cygwin mailing list:
if you are going to send a bunch of these to the Cygwin mailing list, you should
save yourself time and energy, and list all the Cygwin packages in one email,
which may receive no response, unless you are spam blocked.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.
[Data in IEC units and prefixes, physical quantities in SI.]

Country Of Origin Verification - 8944

[Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.]]

Hello,

My name is Christian Watson and I am a Supply Chain Risk Management Coordinator at NASA Glenn Research Center  As such, I ensure that all NASA Headquarter IT purchase requests comply with Section 514 of the Consolidated Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, 2018.  To do so, the country of origin information must be obtained from the company that develops, produces, manufactures, or assembles the product(s).  Specifically, identify the country where each of the following products were developed, manufactured, and assembled:

* TightVNC 2.8.27

Additionally, if the country of origin is outside the United States, please provide any information you may have stating that testing is performed in the United States prior to supplying products to customers.
Lastly, if available, please identify all authorized distributors of the product in question.




Christian Watson
Peerless Technologies Corporation
NASA Glenn Research Center
21000 Brook Park Rd, MS 142-1
Cleveland, OH 44135
216.433.5061