Code Genome - Fingerprinting Code to Build Trustworthy SBOMs - Ian Molloy & Jiyong Jang, IBM
Channel: The Linux Foundation
Date: 2023-05-25

Code Genome - Fingerprinting Code to Build Trustworthy SBOMs - Ian Molloy & Jiyong Jang, IBM Research

Ken Thompson once wrote: "you can't trust code that you did not totally create yourself." Thirty-nine years later this is still true, and more frightening than ever. A software bill of materials (SBOM) is used to describe components and dependencies enabling users to assess risks (e.g., vulnerabilities). Tools are being developed to generate SBOMs and derive insights from them, however gaps and limitations in verification exist. Many tools rely on unreliable metadata (e.g., project dependencies) and compiled code might lack available source or reproducible builds. 

To address this problem, we introduced the Code Genome—semantically meaningful fingerprints of code functionality—at the Linux Foundation Member Summit. Since then, IBM Research has improved its capability and scalability to generate and verify SBOMs without requiring source code access by building a large knowledge graph of open source software, allowing code to be identified and verified. In this talk, we present how Code Genome can fingerprint code across source and binaries built from different compilers targeting different architectures, and identify software components to generate and verify SBOM. A public service is being planned to allow developers to scan and analyze code to secure the software supply chain.