It's Like Flossing Your Teeth:
On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security

Publication #

First page of the publications
It's like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security
Marcel Fourné, Dominik Wermke, Will Enck, Sascha Fahl and Yasemin Acar.
44th IEEE Symposium on Security and Privacy (S&P'23), May 22-25, 2023.
Abstract

The 2020 Solarwinds attack was a tipping point that caused a heightened awareness about the security of the software supply chain and in particular the large amount of trust placed in build systems. Reproducible Builds (R-Bs) provide a strong foundation to build defenses for arbitrary attacks against build systems by ensuring that given the same source code, build environment, and build instructions, bitwiseidentical artifacts are created. Unfortunately, much of the software industry believes R-Bs are too far out of reach for most projects. The goal of this paper is to help identify a path for R-Bs to become a commonplace property.

To this end, we conducted a series of 24 semi-structured expert interviews with participants from the Reproducible-Builds.org project, finding that self-effective work by highly motivated developers and collaborative communication with upstream projects are key contributors to R-Bs. We identified a range of motivations that can encourage open source developers to strive for R-Bs, including indicators of quality, security benefits, and more efficient caching of artifacts. We also identify experiences that help and hinder adoption, which often revolves around communication with upstream projects. We conclude with recommendations on how to better integrate R-Bs with the efforts of the open source and free software community

Acknowledgements #

We want to thank all interviewees for their participation and appreciate the valuable time that they have generously given. We also want to thank the anonymous reviewers for their valuable feedback.

Artifacts #

Appendix

Cite This Work #

@inproceedings{conf-oakland-fourne23,
	title = {It’s like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security},
	author = {Marcel Fourné and Dominik Wermke and William Enck and Sascha Fahl and Yasemin Acar},
	booktitle = {Proceedings of the 44th IEEE Symposium on Security and Privacy (S\&P '23)},
	month = may,
	year = {2023},
}