The United States government has released a summary report on last year’s Request for Information (RFI) on open source software, outlining key submissions, findings, and actionable recommendations to strengthen and secure the open source ecosystem.

The report details the following twelve activities that government agencies plan to address in the coming period:

1. Advance research and development.
2. Secure package repositories.
3. Partner with open-source software communities.
4. Promote further development and implementation of the use of Software Bill of Materials (SBOMs).
5. Strengthen the software supply chain.
6. Establish the first U.S Government Open-Source Program Office (OSPO).
7. Assign vulnerability severity metrics.
8. Increase education and training tools.
9. Expand International Collaboration.
10. Enhance security and replace components of legacy software.
11. Advance public-private partnerships.
12. Use formal methods.

“A significant step in the right direction”

In our response (submitted under the Dalewind Software name) to the RFI, we recommended that the United States establish a dedicated public fund to support the open source ecosystem, similar to the Sovereign Tech Fund in Germany, with a focus on scalability. We are pleased that the report specifically highlights our proposal in the Sustaining Open-Source Software Communities and Governance chapter.

The full report can be accessed via the following link:
Summary Of The 2023 Request For Information On Open-Source Software Security