SaTC: TTP: Medium: Collaborative: Securing the Software Supply Chain

制作现代软件涉及到诸如源代码管理系统、验证/构建/打包系统以及用于分发软件和更新的存储库之类的工具。正如最近的许多事件所证明的那样，这个软件链的安全性今天被严重忽视了。现有的防御措施为单个问题提供了零碎的解决方案，当组合在一起时，无法提供端到端的保证。 该项目旨在将一个称为“in-toto”的系统过渡到广泛的实际使用，该系统提供有关软件供应链的见解和端到端保证。in-toto从开发人员编写软件的那一刻起就保护软件，并确保信任链可以一直遵循到安装在用户设备上的软件。In-toto为链中的每个步骤生成加密签名的元数据，并将这些元数据链接在一起并在整个链中携带。显着的积极影响来自于使软件开发过程透明且可公开验证。in-toto提供了一种自然的方式来使代码审查和测试实践公开可见，从而激励开发人员遵循安全的软件实践。 通过正在进行的和未来的合作，in-toto正在被集成到几个大型软件项目中，这些项目将对数百万台计算机产生积极影响。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Making modern software involves tools such as a source code management system, a verify/build/package system, and a repository for distributing software and updates. The security of this software chain is dramatically overlooked today, as many recent incidents demonstrate. Existing defenses provide piecemeal solutions to individual problems and, when combined, do not provide end-to-end guarantees. This project seeks to transition into widespread practical use a system called "in-toto", which provides insights and end-to-end guarantees about the software supply chain. in-toto protects software from the moment it is written by a developer and ensures that the chain of trust can be followed all the way to the software that gets installed on user devices. In-toto generates cryptographically signed metadata for each step in the chain, and links together and carries these metadata throughout the entire chain. The salient positive impact comes from making the software development process transparent and publicly verifiable. in-toto provides a natural way to make the code review and testing practices publicly visible, thus incentivizing developers to follow safe software practices. Through ongoing and future collaborations, in-toto is being integrated into several large software projects that will positively impact millions of computers.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.