It’s like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security

(2023) It’s like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security.

Text reprobuilds2023.pdf - Published Version Download (241kB)

Abstract

The 2020 Solarwinds attack was a tipping point that caused a heightened awareness about the security of the software supply chain and in particular the large amount of trust placed in build systems. Reproducible Builds (R-Bs) provide a strong foundation to build defenses for arbitrary attacks against build systems by ensuring that given the same source code, build environment, and build instructions, bitwise-identical artifacts are created. Unfortunately, much of the software industry believes R-Bs are too far out of reach for most projects. The goal of this paper is to help identify a path for R-Bs to become a commonplace property. To this end, we conducted a series of 24 semi-structured expert interviews with participants from the Reproducible-Builds.org project, and iterated on our questions with the reproducible builds community. We identified a range of motivations that can encourage open source developers to strive for R-Bs, including indicators of quality, security benefits, and more efficient caching of artifacts. We identify experiences that help and hinder adoption, which heavily include communication with upstream projects. We conclude with recommendations on how to better integrate R-Bs with the efforts of the open source and free software community.

Item Type:	Conference or Workshop Item (A Paper) (Paper)
Divisions:	Sascha Fahl (SF)
Conference:	SP IEEE Symposium on Security and Privacy
Depositing User:	Dominik Wermke
Date Deposited:	28 Apr 2023 09:30
Last Modified:	28 Apr 2023 09:30
Primary Research Area:	NRA5: Empirical & Behavioral Security
URI:	https://publications.cispa.saarland/id/eprint/3933

Actions

Actions (login required)

View Item