Riverside Research is collaborating with custom software and AI developer Kitware, Inc., to develop capabilities to help organizations securely deploy software patches and updates to fielded software.
The organizations added native software inventory capabilities to CMake, which manages software inventories by defining components and their dependencies. The enhancements embed metadata within those inventories to support security and maintenance work.
Riverside Research also developed tools that use the metadata to help maintainers identify, update and repair fielded software while keeping systems operational. The approach generates inventory information within the build system, rather than relying on external scans or self-reported data.
“Software developers have long relied on CMake as the authoritative source for defining how applications are built and how their dependencies fit together,” said Bill Hoffman, co-founder of Kitware and lead architect of CMake.
“By integrating software inventory generation directly into the build system, we’re making that same trusted information available for security, maintenance, and risk management activities. Our collaboration with Riverside Research helps ensure organizations can understand and maintain increasingly complex software ecosystems with greater accuracy, confidence, and efficiency.”
These enhancements allow organizations in government and industry to more accurately track their cyber risk, especially as it relates to the nation’s software supply chain. Embedding software inventories into the build provides dependency information, produces consistent results tied to the build configuration and supports automation within continuous integration workflows, the company said.
“CMake’s adoption of software inventories marks a significant step toward improving software security and visibility for millions of C++ developers,” said Dr. Gordon Stewart, associate director of secure and resilient systems at Riverside Research. “We are excited by this partnership with Kitware and look forward to the further impact of E-BOSS technologies.”
The upgrades were done with funding from DARPA under the Enhanced Software Bill of Materials for the Optimized Software Sustainment program. Since DARPA’s development initiatives follow federal guidance, CMake’s software inventories support risk-informed decision-making, allowing agencies to manage cyber risk without heavy compliance overhead.