RE: [EXTERNAL] Re: Inquiry: Country of Origin for gfortran

["Zhang, Cynthia X. (GSFC-710.0)[TELOPHASE CORP]" <cynthia.x.zhang@nasa.gov>]

Thank you for your help!

-----Original Message-----
From: Thomas Koenig <tkoenig@netcologne.de> 
Sent: Sunday, July 17, 2022 4:55 AM
To: Zhang, Cynthia X. (GSFC-710.0)[TELOPHASE CORP] <cynthia.x.zhang@nasa.gov>; fortran@gcc.gnu.org; gcc mailing list <gcc@gcc.gnu.org>
Subject: [EXTERNAL] Re: Inquiry: Country of Origin for gfortran


Hi Cynthia,

 > Hello, my name is Cynthia and I am a Supply Chain Risk Management  > Analyst at NASA. NASA is currently conducting a supply chain  > assessment of gfortran. As stated in Sections 208 and 514 of the  > Consolidated Appropriations Act, 2022, Public Law 117-103,  > enacted March 15, 2022, a required step of our process is to  > verify the Country of Origin (CoO) information for the  > product (i.e., the country where the products were developed,  > manufactured, and assembled.)

 > As gfortran is open source, we understand that this inquiry is  > not directly applicable, as contributions may be made from  > individuals from around the world. In this case, NASA is  > interested in confirming the following information:

 > 1.  Is there an organization which sponsors/publishes the project, or  > a primary developer who audits the code for potential vulnerabilities, > errors, or malicious code? Y/N

gfortran is not an independent project, it is part of the Gnu Compiler Collection, https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgcc.gnu.org%2F&amp;data=05%7C01%7Ccynthia.x.zhang%40nasa.gov%7C6cc48038caed4c1e908a08da67d211b3%7C7005d45845be48ae8140d43da96dd17b%7C0%7C0%7C637936449313898438%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=NxQtCichrdJBdyRR6ZIlmttE72yqSXE6rIxWUEQoMHQ%3D&amp;reserved=0 .  As such, any evaluation you may already have made of gcc also should also apply to gfortran, and I am also addressing this mail to the gcc mailing list, where it is more appropriate, especially since I personally am unclear about the current relationship with the Free Software Foundation.

Regarding gfortran specifically:  Code changes are reviewed by the individuals listed in the file

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgcc.gnu.org%2Fgit%2F%3Fp%3Dgcc.git%3Ba%3Dblob_plain%3Bf%3DMAINTAINERS%3Bhb%3DHEAD&amp;data=05%7C01%7Ccynthia.x.zhang%40nasa.gov%7C6cc48038caed4c1e908a08da67d211b3%7C7005d45845be48ae8140d43da96dd17b%7C0%7C0%7C637936449313898438%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=PUhKlistyKpWB%2BvknwbesKHucw3uohnDMBqL66%2BrVkI%3D&amp;reserved=0

(where you can search for Fortran).

 > 2.  Does gfortran have an overseeing organization or individual
 >   along these lines? Y/N

See my previous reply.

 > 1.  If so, please provide the name of the organization and country
 >     they are established in

 > If the information above is unknown or cannot be provided, we  > request that you provide the country or list of countries where  > the majority of contributions originate from to satisfy Sections  > 208 and 514 of the Consolidated Appropriations Act, 2022, Public  > Law 117-103, enacted March 15, 2022.

Main contributions to gfortran, i.e. the Fortran front end to gcc and its supporting library, came (in no particular order) from the UK, the US, France, Finland, Germany, the Netherlands and the Czech Republic.
Up to 2006, there were also some contributors from China.

Best regards

Thomas