Home > News > Top Stories > ActiveState Enables Software Vendors to Comply with White House Orders for Securing the Software Supply Chain

Supply Chain

ActiveState Enables Software Vendors to Comply with White House Orders for Securing the Software Supply Chain

ActiveState announced the availability of open source software attestations, making it the first open source software platform to deliver this essential component of software supply chain security. The ability to obtain self-attestation for all third-party software, as well as producing a software bill of materials (SBOM), is part of sweeping guidance from the National Institute of Standards and Technology (NIST) that has been adopted by the White House. According to a recent White House order, all critical software that touches government data or systems in any way must be compliant with these new security standards no later than June 12, 2023. All software must adhere to these strict standards no later than September 14, 2023.

ActiveState builds and fervently maintains a curated catalog of trusted artifacts that meets the requirements for Supply Chain Levels for Software Artifacts (SLSA) level 4, including software bill of materials (SBOM) and attestations, to proactively secure customers' software supply chains. In addition, ActiveState's secure build service delivers isolated, ephemeral, hermetic and verifiably reproducible builds from source code, so developers no longer need to install potentially compromised binaries or deal with security issues.

The White House order applies to more than just government suppliers. Since it includes software that touches government data or systems in any way, it actually affects all upstream and downstream suppliers, as well. That means the order affects the majority of the software development market.

While some very large organizations may have the systems and processes in place to comply with the order, this will be an expensive process for everybody else because most organizations do not meticulously track open source provenance. This puts them at serious risk for missing the White House deadline for compliance. The ActiveState Platform solves this problem automatically by building every artifact from source with a cloud-scale vendoring solution to deliver:

A clear chain of custody and provenance
Attestations for all packages
SBOM that lists all software components
Automated solving and management of complex open source dependencies

As a result, employing ActiveState as a trusted vendor takes the time, hassle, and risk out of using open source, enabling software vendors to secure their supply chain and comply with even the most stringent security requirements.

"We believe the White House order signals a larger trend that will soon become industry standard. That's why today's announcement is so important. By delivering attestations for all open source packages, ActiveState enables software vendors to verify that their application has been built in a secure manner using an untampered process for producing trusted artifacts and binaries."

-Loreli Cadapan, Vice President, Product, ActiveState

Try the ActiveState Platform by signing up for a free ActiveState account. To reap the benefits of attestations, SBOM and ActiveState's secure build service, contact us to learn about our Enterprise Tier subscription.

About ActiveState
ActiveState has a 20+ year history of providing secure, scalable open source language solutions to more than 2 million developers and 97% of Fortune 1,000 enterprises. Enterprises choose ActiveState to support mission-critical systems and speed up software development while enhancing the security and integrity of their open source supply chain. Visit www.activestate.com for more information.

Spotlight

More featured news

Spotlight

Related News

Operations, Supply Chain, Transportation

CPKC Joins RailPulse Coalition Driving Innovation in Railcar Telematics

PR Newswire | February 02, 2024

Canadian Pacific Kansas City (CPKC) today announced its membership in the RailPulse Coalition. RailPulse, founded by a dynamic consortium of forward-thinking railcar owners, is working to develop, broaden and accelerate the use of GPS and other telematics technologies on railcars that increase safety, efficiency, and visibility across North America's freight rail industry. CPKC becomes the third Class I railroad and 10th member of the coalition, joining Bunge North America, GATX, Genesee & Wyoming Inc., Norfolk Southern Corporation, Railroad Development Corporation, The Greenbrier Companies, TrinityRail, Union Pacific Railroad, and Watco Companies LLC. "We are pleased to be a part of RailPulse and to contribute to accelerating adoption of railcar telemetry in North America," said John Brooks, CPKC Executive Vice President and Chief Marketing Officer. "This collaboration aligns with our commitment to innovation and will play an important role in modernizing our customer experience and provide benefits to the entire supply chain by advancing safety and improving operations." The key objectives of RailPulse include: Industry Wide Telematics Infrastructure: The initiative facilitates collaboration among industry players by creating a secure, trusted, standardized, and vendor neutral railcar telematics infrastructure that spans the entire North American freight rail industry. Data-Driven Transformation: By building an information infrastructure that harnesses data from GPS and railcar-mounted sensors and prioritizing data standardization and storage in the cloud, RailPulse focuses on delivering actionable insights enabling enhance service levels, visibility, safety, sustainability, and productivity. Enhanced Service through Visibility: Through RailPulse, the integration of telematic sensors on railcars enables the generation of valuable data, empowering shippers with real-time visibility of railcar and goods movements to make informed decisions and optimize their operations. "We welcome CPKC to the RailPulse Coalition. Together, we will drive transformative change in the rail sector by combining our strengths and fostering a culture of innovation," said David Shannon, General Manager of RailPulse. "This partnership underscores our commitment to shaping the future of rail transportation." Response from RailPulse Members: "The Board of RailPulse is very excited to welcome CPKC," said Mike McClellan, RailPulse Board Chair and Sr. VP &Chief Strategy Officer at Norfolk Southern. "CPKC brings a breadth of railroading knowledge to the table, and the insights that CPKC will be able to contribute from operating in 3 countries will be invaluable as we drive RailPulse to serve all of North America." Forward looking information This news release contains certain forward-looking information and forward-looking statements (collectively, "forward-looking information") within the meaning of applicable securities laws in both the U.S. and Canada. Forward-looking information includes, but is not limited to, statements concerning expectations, beliefs, plans, goals, objectives, assumptions and statements about possible future events, conditions, and results of operations or performance. Forward-looking information may contain statements with words or headings such as "financial expectations", "key assumptions", "will", "anticipate", "believe", "expect", "plan", "should", "commit", "outlook", "guidance" or similar words suggesting future outcomes. This news release contains forward-looking information relating, but not limited, to statements about future technology and the potential for telematics technologies to increase safety, efficiency, and visibility across North America's freight rail industry and CPKC's expected benefits from such future technology. The forward-looking information contained in this news release is based on current expectations, estimates, projections, and assumptions, having regard to CPKC's experience and its perception of historical trends. Forward-looking information involves many inherent risks and uncertainties that could cause actual results to differ materially from the forward-looking information, including but not limited to the factors that are detailed from time to time in reports filed by CPKC with securities regulators in Canada and with the U.S. Securities and Exchange Commission (SEC) in the United States. Reference should be made to "Item 1A - Risk Factors" and "Item 7 - Management's Discussion and Analysis of Financial Condition and Results of Operations - Forward-Looking Statements" in CPKC's annual and interim reports on Form 10-K and 10-Q. Any forward-looking information contained in this news release is made as of the date hereof. Except as required by law, CPKC undertakes no obligation to update publicly or otherwise revise any forward-looking information, or the foregoing assumptions and risks affecting such forward-looking information, whether as a result of new information, future events or otherwise.

Operations, Warehousing and Distribution

LA Kings Partner with Lexani Performance Tires

PR Newswire | January 26, 2024

Turbo Wholesale Tires, and two-time Stanley Cup Champions, the LA Kings have announced a powerful brand partnership. As part of the multi-year agreement, brokered by AEG Global Partnerships, Lexani Performance Tires will become an official partner of the LA Kings, reaching millions of passionate sports fans. As an official partner of the LA Kings, Lexani Performance Tires will have the unique opportunity to engage fans each week during the season as a presenting sponsor of the LA Kings "Game Preview," which will appear on the team's official social channels. Lexani Performance Tire will also benefit from in-arena signage via dasher boards and scoreboard branding during all LA Kings home games at Crypto.com Arena. "We are proud to partner with the LA Kings and their global fanbase," said Phillip Kane, CEO of Turbo Wholesale Tires. "The Kings have a strong international brand and passionate following, we look forward to introducing their supporters to Lexani Performance Tire products." Turbo Wholesale Tires has been a trusted tire supplier, leading the industry with a strong emphasis and understanding of the independent tire dealer. Turbo Wholesale Tires has evolved into a national and international supplier of its proprietary brands, Lexani Performance Tire, RBP Tires and Lionhart Tires. With nearly a million square feet of warehouse space nationwide, Turbo Wholesale Tires continues to exceed the needs of its tire customers. "We are honored to be teaming up with Lexani Performance Tires," said Josh Veilleux, senior vice president, AEG Global Partnerships. "This collaboration not only brings a renowned tire supplier into our Kings family, but also introduces new ways for our fans to interact with its brand. We look forward to the positive impact this new partnership will bring to the team, Lexani Performance Tires and our incredible community of fans."

Logistics, Supply Chain

Delta Cargo launches e-commerce solution DeliverDirect in collaboration with SmartKargo

PR Newswire | January 31, 2024

Delta Cargo is excited to announce the launch of its newest product, DeliverDirect, developed in collaboration with SmartKargo. DeliverDirect is a door-to-door delivery service for the U.S. market, offering a competitive and customizable solution for e-commerce retailers seeking to optimize their direct-to-consumer shipping solutions. With DeliverDirect, Delta Cargo pioneers an innovative domestic carrier approach, providing swift service with transparent pricing for e-commerce and small parcel delivery. From initial warehouse pickup to delivery at the end consumer's doorstep, DeliverDirect is a fast, seamless, end-to-end service that upgrades traditional ground or air shipping services utilized by most current e-tailers. Small package shippers will benefit from increased shipping speeds, an uncomplicated pricing structure, proactive alert management, transparent tracking and reporting, and access to Delta's vast domestic network. "We are thrilled to introduce DeliverDirect, our new offer for the small parcel delivery market," shared Alison Ricker, Managing Director, Delta Cargo Global Sales. "Through our strategic collaboration with SmartKargo, DeliverDirect gives e-tailers an alternative transportation solution that fits their customers' requirements, and we envision that this service will prove to be a fast, reliable and cost-effective solution." The DeliverDirect offering can be tailored to shippers' needs with a variety of service innovations that empower customers to customize according to their unique preferences. These service innovations include: personalized pick-up times, geo-fenced notifications for consumers, multiple delivery attempts, signature-required deliveries, proof of delivery with photos, and access to advanced reporting features for a complete comprehensive service that aligns seamlessly with a variety of needs. "E-commerce shippers are looking for simple, faster and more reliable alternatives to deliver their products to consumers. Delta Cargo has a vision for small package delivery that will transform the U.S. market and continue to diversify their already robust offering in the air cargo market. Their innovative approach makes them a fantastic partner for SmartKargo, and we look forward to growing this service together," stated Milind Tavshikar, CEO and Founder of SmartKargo.