Questions? contactus@blockharbor.io
Country of origin · 791D
What they signed. What shipped.
Get the SBOM rebuilt from the shipped image, with each package tied to its maintainer's country.
Request beta accessWe reply by email.
No supplier SBOM needed
About 13 vehicle programs declared from 5 to 6 images
Findings follow the module to every program you map it to
A supplier's letter isn't evidence of what shipped
- Covered software is banned from model year 2027. Your CEO or an authorized designee signs a Declaration of Conformity saying you keep an SBOM or equivalent documentation BIS can request.
- A supplier's letter covers only what the supplier knows is in its stack.
- Off-the-shelf binary scanners expect standard builds; nearly every image we've analyzed needed hand reverse-engineering.
How the SBOM is rebuilt and attributed
01
Rebuild
Our scanning partner rebuilds the SBOM from the binary, and its engineers reverse-engineer what the tools can't parse.
02
Attribute
Each package is attributed to its maintainer and country. A match on your country list opens a risk with the files as evidence, ready for your ownership and control review.
03
Map
Findings attach to the module; once your team maps modules to vehicle programs, every program carrying that module shows the finding.
One supplier letter, contradicted by its image
~13
vehicle programs
5 to 6
analyzed images
At one OEM, declarations for about 13 vehicle programs rest on 5 to 6 analyzed images. One supplier's good-faith letter of conformance was contradicted by its image: market-variant code, switched off for the US, still sat in the binary, and was torn out.
Read: Country of origin is coming to more than cars →What happens next
Country-of-origin analysis runs in business workspaces, not on our self-serve VSEC platform, as part of our beta program.
- 1Send the form with the modules you need to declare.
- 2We reply by email to scope the images.
- 3We set up a business workspace for your team.
Do we need the supplier's SBOM or source code?
No. The SBOM is rebuilt from the shipped binary image.
What if an image can't be analyzed?
It is marked unresolved, not clean, so a blind spot shows up as an open question instead of a pass.
Request beta access
Tell us which modules you need to declare.