# Distributed Software Build Assurance for Software Supply Chain Integrity
## 3 Problem Statement and Our Contribution  
### Problem Statement: Threats against Software Supply Chain  
In this section, we describe the threats against the software supply chain that motivate our work. More specifically, we describe the threats residing within the main components and entities, described in Section 2 and illustrated in Figure 1.  
**Source Code Repository:** Malicious actors can create an entirely new repository that is malicious from the creation. By doing so, victims will be downloading from a malicious repository. If it is an existing repository, malicious actors can also submit malicious merge requests that will turn into a backdoor or be exploitable by hiding the malicious intent via control characters, intentional concealing, and masking code differences [4]. This would effectively conceal malicious intent within the source code in the repository and hence compromise it. Another threat could also be to utilize configuration errors like leaked API keys in repositories and social engineering techniques that can empower a malicious actor to gain control of the source code or repository [5]. Once gaining control, malicious actors can modify the repository to carry out malicious intent. **Dependencies Repository and Build Process:** Similar to source code repositories, the build process involves retrieving dependencies from designated repositories. This is facilitated by the utilization of package managers like npm and pip. This, however, could also lead to vulnerabilities like injections of malicious code from repositories into the dependency tree [6] that would affect the build process. Another type of threat that is not related to compromise of the dependencies repository but is related to the build process would be typosquatting or package confusion [7]. This technique is where malicious actors rely on and exploit common typing errors of users based on misspelling, character substitution, and pluralization of package names to carry out the attack. As examples, 'ethereum-go' vs. 'ethereum-go', 'backdoor-pkg' vs. 'backdoor-pkg', and many more. Figure 1: Software supply chain involving SBOM and reproducible build. This diagram illustrates the distribution-platform path, while the other user-direct path without the distribution is not illustrated due to space constraint. **Distribution Platform:** While malicious actors can attempt to inject malicious code into the source code repository, which would compromise the software supply chain, the distribution platform may also often rely on third-party dependencies and if these dependencies have vulnerabilities, it is another attack vector that malicious actors may choose to exploit. **SBOM:** CISA suggests various types of SBOM, but in our case, we are focusing on the build type [8]. This means the SBOM creates a list of all the components needed for our project from the build process (b). If both the dependencies repository and the build process are compromised, it puts the accuracy of the SBOM at risk. Our Contributions: Assurance Targets Across Software Supply Chain and Blockchain for Distributed Authority  
We build a software build assurance scheme to check and assure the integrity of the various steps in the supply chain to defend against the active modification and malicious threats described in Section 3.1, More specifically, we use the software artifacts generated from the supply chain, namely, the source code (s), the build output including compilation (\(b\)), and the SBOM documentation (\(d\)), as the inputs and targets of our software assurance. We describe and explain these software artifacts as well as the software build assurance scheme in greater detail in Section 4. In addition to assuring the software in multiple stages in the supply chain, our work advances beyond the approaches requiring a centralized authority and real-time protocol interactions with the centralized server, c.f., remote code attestation. Our scheme does not involve such centralized authority and instead uses blockchain to replace the centralized server authority.