Miles Jamison 
- Riverside Research and Kitware have enhanced CMake to help organizations patch and update fielded software
- The work embeds metadata on software components and dependencies into inventories
- DARPA funded the development through its E-BOSS program
Riverside Research and Kitware have partnered to integrate native software inventory features into CMake, a widely used software build tool, under a Defense Advanced Research Projects Agency program.
The effort, funded through DARPA’s Enhanced Software Bill of Materials for the Optimized Software Sustainment program, or E-BOSS, is intended to let organizations patch and update fielded software securely and reliably, Riverside Research said Thursday.
What Does the CMake Enhancement Add?
The collaboration adds software inventory capabilities directly to CMake, allowing software components and their dependencies to be recorded with associated metadata. Riverside Research has developed tools that draw on the inventory data to support maintenance activities for software already deployed in the field.
The companies said the approach can provide dependency information without relying solely on external scanning tools or self-reported inventories.
The CMake capabilities include dependency modeling tied to software configurations, automated workflows and reproducible inventory results.
The companies said the enhancement can generate consistent inventory data based on software configurations and incorporate that information into automated development processes.
How Can the Technology Support Software Maintenance?
The embedded inventories are intended to give government and industry organizations information for tracking software supply chain risks and managing vulnerabilities. The companies said the approach can support software maintenance while limiting disruption to operational systems.
The work is part of DARPA’s E-BOSS effort, which focuses on technologies for understanding, maintaining and securing software systems over time. Riverside Research said the CMake capabilities can support risk-informed decisions without requiring additional software inventory tools or setup.
What Other Partnerships Has Riverside Research Pursued?
The Kitware collaboration follows several recent Riverside Research partnerships involving specialized technologies for defense and intelligence applications. In August, the organization partnered with Tera AI to integrate DeepSLAM into mapping and positioning capabilities designed for GPS-denied environments.
In May, Riverside Research also partnered with Plexus to develop reusable modular hardware and software for defense and intelligence customers. The organizations previously worked together on the Aegis R52L Enhanced Retransmission Device, moving the project from concept and requirements identification through prototyping and manufacturing planning in less than nine months.
