It’s like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security
It’s like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security
复制标题
DOI：
10.1109/sp46215.2023.10179320
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Marcel Fourné;Dominik Wermke;W. Enck;S. Fahl;Y. Acar
中科院分区：
文献类型：
--
作者：
Marcel Fourné;Dominik Wermke;W. Enck;S. Fahl;Y. Acar
2020年太阳风的攻击是一个转折点，引起了人们对软件供应链安全性的高度认识，特别是对构建系统的大量信任。可复制构建（r - b）通过确保给定相同的源代码、构建环境和构建指令，创建位相同的工件，为构建针对构建系统的任意攻击的防御提供了坚实的基础。不幸的是，很多软件行业认为r - b对于大多数项目来说太遥不可及了。本文的目标是帮助确定r - b成为普通属性的路径。为此，我们对来自Reproducible-Builds.org项目的参与者进行了24次半结构化的专家访谈，发现高度积极的开发人员的自我有效工作以及与上游项目的协作沟通是r - b的关键贡献者。我们确定了一系列可以鼓励开源开发人员为r - b而奋斗的动机，包括质量指标、安全性好处和更有效的工件缓存。我们还确定了帮助和阻碍采用的经验，这些经验通常围绕着与上游项目的沟通。最后，我们就如何更好地将r - b与开源和自由软件社区的努力集成在一起提出了建议。
The 2020 Solarwinds attack was a tipping point that caused a heightened awareness about the security of the software supply chain and in particular the large amount of trust placed in build systems. Reproducible Builds (R-Bs) provide a strong foundation to build defenses for arbitrary attacks against build systems by ensuring that given the same source code, build environment, and build instructions, bitwise-identical artifacts are created. Unfortunately, much of the software industry believes R-Bs are too far out of reach for most projects. The goal of this paper is to help identify a path for R-Bs to become a commonplace property.To this end, we conducted a series of 24 semi-structured expert interviews with participants from the Reproducible-Builds.org project, finding that self-effective work by highly motivated developers and collaborative communication with upstream projects are key contributors to R-Bs. We identified a range of motivations that can encourage open source developers to strive for R-Bs, including indicators of quality, security benefits, and more efficient caching of artifacts. We also identify experiences that help and hinder adoption, which often revolves around communication with upstream projects. We conclude with recommendations on how to better integrate R-Bs with the efforts of the open source and free software community.