OmniBOR: A System for Automatic, Verifiable Artifact Resolution across Software Supply Chains
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866911776906412032 |
|---|---|
| author | Seshadri, Bharathi Han, Yongkui Olson, Chris Pollak, David Tomasevic, Vojislav |
| author_facet | Seshadri, Bharathi Han, Yongkui Olson, Chris Pollak, David Tomasevic, Vojislav |
| contents | Software supply chain attacks, which exploit the build process or artifacts used in the process of building a software product, are increasingly of concern. To combat these attacks, one must be able to check that every artifact that a software product depends on does not contain vulnerabilities. In this paper, we introduce OmniBOR, (Universal Bill of Receipts) a minimalistic scheme for build tools to create an artifact dependency graph which can be used to track every software artifact incorporated into a built software product. We present the architecture of OmniBOR, the underlying data representations, and two implementations that produce OmniBOR data and embed an OmniBOR Identifier into built software, including a compiler-based approach and one based on tracing the build process. We demonstrate the efficacy of this approach on benchmarks including a Linux distribution for applications such as Common Vulnerabilities and Exposures (CVE) detection and software bill of materials (SBOM) computation. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2402_08980 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | OmniBOR: A System for Automatic, Verifiable Artifact Resolution across Software Supply Chains Seshadri, Bharathi Han, Yongkui Olson, Chris Pollak, David Tomasevic, Vojislav Software Engineering Cryptography and Security Software supply chain attacks, which exploit the build process or artifacts used in the process of building a software product, are increasingly of concern. To combat these attacks, one must be able to check that every artifact that a software product depends on does not contain vulnerabilities. In this paper, we introduce OmniBOR, (Universal Bill of Receipts) a minimalistic scheme for build tools to create an artifact dependency graph which can be used to track every software artifact incorporated into a built software product. We present the architecture of OmniBOR, the underlying data representations, and two implementations that produce OmniBOR data and embed an OmniBOR Identifier into built software, including a compiler-based approach and one based on tracing the build process. We demonstrate the efficacy of this approach on benchmarks including a Linux distribution for applications such as Common Vulnerabilities and Exposures (CVE) detection and software bill of materials (SBOM) computation. |
| title | OmniBOR: A System for Automatic, Verifiable Artifact Resolution across Software Supply Chains |
| topic | Software Engineering Cryptography and Security |
| url | https://arxiv.org/abs/2402.08980 |