# Distributed Software Build Assurance for Software Supply Chain Integrity
## 4 Our Scheme
### Our Protocol Overview  
The software supply chain makes use of the source code \(s\) and builds/compiles the software to generate \(b\) and the documentation \(d\), as described in Section 2. Our scheme uses the SBOM to generate \(d\) and reproducible build to generate \(b\) so that \(b\), given the user's compiler and the build conditions, provides the same \(b\). Thanks to the use of reproducible build, other entities, given the same build condition and environment, also produce the same \(b\). Our scheme, described in Figures 2 & 3 executed by the user, takes these softwareartifacts, i.e., \(s,b,d\), to construct a proof \(p\). Table 1 lists these variables used in our paper, and the rest of the section describes our scheme in greater detail. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Variable** & **Description** & **Our Implementation** \\ \hline \multirow{2}{*}{\(s\)} & Source code files of the specific version of the target software downloaded by user & Source code files of the latest Ethereum software, Archanes (v1.13.4) \\ \hline \multirow{2}{*}{\(b\)} & Reproducible build compiler output from user & Geth of Archanes (v1.13.4) stored in the Ethereum repository [11] \\ \hline \multirow{2}{*}{\(d\)} & SBOM documentation of the specific version of the target software generated by user & SBOM documentation of the Ethereum software, Archanes (v1.13.4) \\ \hline \multirow{2}{*}{\(p\)} & Proof for the target software generated by the user & Proof for Archanes (v1.13.4) generated by the user \\ \hline \multirow{2}{*}{\(s^{\prime}\)} & Source code files of the specific version of the target software from authority & Source code files of the latest Ethereum software, Archanes (v1.13.4) \\ \hline \multirow{2}{*}{\(b^{\prime}\)} & Reproducible build compiler output from infrastructure from authority & Geth of Archanes (v1.13.4) stored in the Ethereum repository [11] \\ \hline \multirow{2}{*}{\(d^{\prime}\)} & SBOM documentation of the specific version of the target software from authority & SBOM documentation of the Ethereum software, Archanes (v1.13.4) \\ \hline \multirow{2}{*}{\(p^{\prime}\)} & Proof reference from blockchain & Proof stored in the Ethereum blockchain and centralized server \\ \hline \multirow{2}{*}{ID} & Index of Proof & Index of Proof, \(p^{\prime}\) in the Ethereum blockchain \\ \hline \multirow{2}{*}{\(H\)} & Hash function & SHA-256 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Variable descriptions (Section 4) and assignments for implementation (Section 5). Figure 3: Online process from source code \(s\) to build/compilation \(b\) to the generation of proof \(p\). Figure 2: Our scheme overview, including information sources and inputs from the authority (providing the assurance reference) and the repository ecosystem. The authority’s reference information delivery is implemented in blockchain in our scheme, while the centralized server approach relies on the online, real-time networking with a remote centralized server. The authority is a logical entity that provides the information to the user about what the software artifacts and the proof should be, which we call the references and use the prime variables in Table 1. The authority can be implemented in many ways as long as it is an entity that has ownership over the source code in terms of storing or distributing it to users, for example, the software vendor who developed it. The authority provides the reference build (\(b^{\prime}\)), the reference documentation (\(d^{\prime}\)), the software \(ID\) and the reference proof (\(p^{\prime}\)) to the user. \(p^{\prime}\) is generated in the same way as \(p\) but only from the authority. \(p^{\prime}\) is computed by the authority and is a deterministic function of \(s^{\prime},b^{\prime},d^{\prime}\), similarly to how \(p\) is computed by the authority and is a deterministic function of \(s,b,d\).