Signing in Four Public Software Package Registries: Quantity, Quality, and Influencing Factors

arXiv:2401.14635v2 Announce Type: replace
Abstract: Many software applications incorporate open-source third-party packages distributed by public package registries. Guaranteeing authorship along this supply chain is a challenge. Package maintainers can guarantee package authorship through software signing. However, it is unclear how common this practice is, and whether the resulting signatures are created properly. Prior work has provided raw data on registry signing practices, but only measured single platforms, did not consider quality, did not consider time, and did not assess factors …

applications arxiv can challenge cs.cr cs.se distributed guarantee maintainers package packages party practice public quality signing software software applications supply supply chain third third-party