[EXTERNAL] Re: Country Of Origin Verification - 8944

Wed Jun 17 15:37:16 GMT 2020

Hello Brian,

We appreciate the reply. We are looking to use this software on a NASA facility and that is why we sent you the questions we did to comply with our security restrictions. If you could tell us where this software originated from that would be all we need to move forward. We have followed the link you suggested and could still not find this information.

Thank You.

-----Original Message-----
From: Brian Inglis <Brian.Inglis@SystematicSw.ab.ca> 
Sent: Thursday, June 11, 2020 1:19 PM
To: cygwin@cygwin.com
Cc: Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.] <christian.m.watson@nasa.gov>; Pesich, Justin M. (GRC-LTF0) <justin.m.pesich@nasa.gov>
Subject: [EXTERNAL] Re: Country Of Origin Verification - 8944

On 2020-06-11 09:59, Watson, Christian M. (GRC-V000)[Peerless Technologies Corp.] via Cygwin wrote:
> My name is Christian Watson and I am a Supply Chain Risk Management Coordinator at NASA Glenn Research Center  As such, I ensure that all NASA Headquarter IT purchase requests comply with Section 514 of the Consolidated Appropriations Act, 2018, Public Law 115-141 (amended), enacted February 28, 2018.  To do so, the country of origin information must be obtained from the company that develops, produces, manufactures, or assembles the product(s).  Specifically, identify the country where each of the following products were developed, manufactured, and assembled:
> 
> * Cygwin 3.1.5

[DISCLAIMER: the following is FYI - I am a volunteer with no status]

As Cygwin is a volunteer international open source *FREE* software project, not a company, and it consists of thousands of separate packages, each maintained by international volunteers, please submit this query to the organization to whom you submitted the purchase request, who will have paid employees to do this research for you, for each of the thousands of included packages.
If no one submitted a purchase request: when the software was downloaded, you received everything to which you are entitled, plus you may read the information available on the site with home page https://urldefense.proofpoint.com/v2/url?u=https-3A__cygwin.com_&d=DwICaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=L_8MYtRhcq5AQXqH3xNfoPGhNQbTpx_j_8nEjTzCUd4&m=0zUfOax9tFKJLh9rktm_xSw2E2JpKRccdXrbAhInLF4&s=qE8V0Uq3YERrrPfN5AkXb5lq_t7jGL9oYAUMVZ4ojYE&e= , to dreive the information you request.

> Additionally, if the country of origin is outside the United States, please provide any information you may have stating that testing is performed in the United States prior to supplying products to customers.

From CYGWIN_LICENSE:

"THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE."

See
	https://urldefense.proofpoint.com/v2/url?u=https-3A__cygwin.com_licensing.html&d=DwICaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=L_8MYtRhcq5AQXqH3xNfoPGhNQbTpx_j_8nEjTzCUd4&m=0zUfOax9tFKJLh9rktm_xSw2E2JpKRccdXrbAhInLF4&s=kgLC8m6tzY_zRsgZbakDwfhcrIovkK3qPG0nxk86aTo&e= 

for more disclaimers in the linked licences.

> Lastly, if available, please identify all authorized distributors of the product in question.

No distributors are authorize: everyone is authorized to distribute Cygwin packages as long as they meet all the applicable licensing terms.

From
	https://urldefense.proofpoint.com/v2/url?u=https-3A__cygwin.com_licensing.html&d=DwICaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=L_8MYtRhcq5AQXqH3xNfoPGhNQbTpx_j_8nEjTzCUd4&m=0zUfOax9tFKJLh9rktm_xSw2E2JpKRccdXrbAhInLF4&s=kgLC8m6tzY_zRsgZbakDwfhcrIovkK3qPG0nxk86aTo&e= :

"Does Cygwin have an [US]ECCN[Export Classification Control Number ([US]EAR[Export Administration Regulations])] number?

No. Cygwin source and binary are made publicly available and free of charge to download so Cygwin is provided under [US]TSU[Technology and Software Unrestricted (EAR license exception)]/[US]TSPA[Technology and Software Publicly Available] exemption. As a result, Cygwin does not require an ECCN number."

There are over a hundred known monitored sites provided by organizations around the world, and more adhoc mirror sites for distribution of the software around the world, many publicly available at universities, or internal to large organizations, and large companies.
You may find NASA has one or more Cygwin mirror sites: e.g.

	ftp://ftp.nas.nasa.gov/mirrors/cygwin.com/pub/cygwin/

--
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised.
[Data in IEC units and prefixes, physical quantities in SI.]