Increasing Trust in the Open Source Supply Chain with Reproducible Builds and Functional Package Management

Julien Malka (1, 2)

1 ACES - Autonomic and Critical Embedded Systems
2 INFRES - Département Informatique et Réseaux

Functional package managers (FPMs) and reproducible builds (R-B) are technologies and methodologies that are conceptually very different from the traditional software deployment model, and that have promising properties for software supply chain security. This thesis aims to evaluate the impact of FMPs and R-B on the security of the software supply chain and propose improvements to the FPM model to further improve trust in the open source supply chain.

Keywords: Software supply chain; Reproducible builds; Functional package management

Domains: Cryptography and Security [cs.CR]; Cryptography and Security [cs.CR]

Julien Malka. Increasing Trust in the Open Source Supply Chain with Reproducible Builds and Functional Package Management. 46th International Conference on Software Engineering (ICSE 2024) - Doctoral Symposium (DS) Track, Apr 2024, Lisbonne, Portugal. ⟨10.1145/3639478.3639806⟩. ⟨hal-04482192⟩