Does this effectively kill use of most open source software in a federal environment? I can’t imagine most maintainers can attest to complying with Federal software security requirements.