Establishing Provenance Before Coding: Traditional and Next-Gen Software Signing

TL;DR

This paper discusses methods for verifying the origin of third-party software components using cryptographic signatures, highlighting traditional approaches, their challenges, and advancements in next-generation signing platforms to enhance software supply chain security.

Contribution

It introduces the evolution from traditional to next-generation signing platforms for software provenance verification, addressing existing challenges.

Findings

Traditional signing faces key management challenges.

Next-generation signing platforms improve security and usability.

Enhanced provenance verification reduces supply chain vulnerabilities.

Abstract

Software engineers integrate third-party components into their applications. The resulting software supply chain is vulnerable. To reduce the attack surface, we can verify the origin of components (provenance) before adding them. Cryptographic signatures enable this. This article describes traditional signing, its challenges, and the changes introduced by next-generation signing platforms.