OmniBOR: A System for Automatic, Verifiable Artifact Resolution across Software Supply Chains

arXiv:2402.08980v1 Announce Type: cross
Abstract: Software supply chain attacks, which exploit the build process or artifacts used in the process of building a software product, are increasingly of concern. To combat these attacks, one must be able to check that every artifact that a software product depends on does not contain vulnerabilities. In this paper, we introduce OmniBOR, (Universal Bill of Receipts) a minimalistic scheme for build tools to create an artifact dependency graph which can be used to track …

artifact artifacts arxiv attacks automatic build building check cs.cr cs.se exploit process product resolution software software supply chain software supply chain attacks software supply chains supply supply chain supply chain attacks supply chains system