Your Customers Will Ask What Your Software Is Made Of

In May 2021, an executive order on cybersecurity in the United States set out that software sold to the federal government should be able to come with a software bill of materials. Two months later the government published the minimum elements such a list should contain. The idea is simple. A machine readable inventory of every component inside a piece of software, with names, versions and where they came from, so that when the next serious vulnerability is announced in a popular library, buyers can find out in minutes whether they are affected.

It started with governments, but it is spreading through ordinary contracts. Large customers increasingly ask suppliers for one, and the standard formats, SPDX and CycloneDX, are now supported by many common build and scanning tools.

For an engineer, this changes a quiet assumption. For years the list of dependencies in your project was your team's private business. A file nobody outside engineering ever read. That file is becoming something a customer, an auditor or a procurement team may ask to see, and may question.

That rewards a set of habits that used to feel optional. Knowing why each dependency is there. Removing the ones nobody uses. Keeping versions current, so that the list you hand over does not include a library with a famous problem. Being able to say which of your services ship which components, without a week of digging.

It also creates a useful role. Someone on most teams will need to understand how the inventory is produced in the build, what it does and does not include, and how to answer a customer who has questions about a line in it. That person sits between engineering, security and sales, and is usually trusted by all three.

You do not need to become a supply chain specialist. But being the engineer who can produce an accurate list of what your software contains, and explain it calmly, is likely to matter more each year.

Monday: generate a software bill of materials for one of your services, and see whether anything on it surprises you.

– Asael Shinder