# Distributed Software Build Assurance for Software Supply Chain Integrity
## 8 Conclusions  
In this paper, we design and build a software build assurance scheme assuming reproducible build (for deterministic build output) and SBOM (for documentation, recording, and tracking of the software development). Our software build assurance scheme checks the integrity against (unauthorized or unintentional) changes and modifications in multiple software artifacts generated in the software supply chain. More specifically, it checks the integrity of the software artifacts of the source code (\(s\) or \(F\), the latter of which corresponds to the source code in multiple files), build or compilation output (\(b\)), and the documentation or record (\(d\)). Computing on these inputs and using cryptographic hash and Merkle tree yields the proof \(p\) in our scheme. We further use blockchain to serve as the authority providing the reference information for our scheme; this information provides the comparison reference and corresponds to what the software artifacts should be. In addition to the blockchain providing high integrity and control on the write-access, the distributed storage and automatic broadcasting strengths of the blockchain provide significant performance advancements in the online software build assurance verification processes by offloading the reference delivery to offline before the time of the software download/build.  
In addition to describing our scheme using abstraction and variables, we empirically implement our scheme targeting the Ethereum software as the object of assurance to show the correctness of our scheme (i.e., changes are detected). Our empirical performanceanalyses based on our implementation also show that our scheme is appropriate and provides small and manageable costs in the software download/build process, e.g., our scheme's online overhead is two orders of magnitude smaller than both the download and build/compilation duration. Furthermore, the blockchain-based authority is also two to three orders of magnitude quicker than the authority based on a centralized remote server.  
Conceptualization, K.L. and S.-Y.C.; Methodology, K.L. and S.-Y.C.; Software, K.L.; Validation, K.L. and S.-Y.C.; Formal analysis, K.L, A.S. ([PERSON]), S.W. ([PERSON]); Investigation, K.L. and S.-Y.C.; Resources, J.K. ([PERSON]), J.K. ([PERSON]) and S.-Y.C.; Data curation, S.W.; Writing--original draft, K.L. and S.-Y.C.; Writing--review & editing, K.L., A.S. ([PERSON]), S.W. ([PERSON]), J.K. ([PERSON]), J.K. ([PERSON]) and S.-Y.C.; Visualization, K.L. and S.W. ([PERSON]); Supervision, J.K. ([PERSON]) and S.-Y.C.; Project administration, J.K. ([PERSON]), J.K. ([PERSON]) and S.-Y.C.; Funding acquisition, J.K. ([PERSON]), J.K. ([PERSON]) and S.-Y.C. All authors have read and agreed to the published version of the manuscript.  
This work was supported in part by the National Science Foundation under Grant No. 1922410 (50%) and by an Institute of Information and Communications Technology Planning and Evaluation (IITP) grant funded by the Korean government (MSIT) (No. 2021-0-02107, with collaborative research on element Technologies for 6G Security-by-Design and standardization-based International cooperation, 50%).  
The raw data supporting the conclusions of this article will be made available by the authors on request.  
The authors declare no conflicts of interest. The funders had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript; or in the decision to publish the results.