# Distributed Software Build Assurance for Software Supply Chain Integrity
###### Abstract  
Computing and networking are increasingly implemented in software. We design and build a software build assurance scheme detecting if there have been injections or modifications in the various steps in the software supply chain, including the source code, compiling, and distribution. Building on the reproducible build and software bill of materials (SBOM), our work is distinguished from previous research in assuring multiple software artifacts across the software supply chain. Reproducible build, in particular, enables our scheme, as our scheme requires the software materials/artifacts to be consistent across machines with the same operating system/specifications. Furthermore, we use blockchain to deliver the proof reference, which enables our scheme to be distributed so that the assurance beneficiary and verifier are the same, i.e., the node downloading the software verifies its own materials, artifacts, and outputs. Blockchain also significantly improves the assurance efficiency. We first describe and explain our scheme using abstraction and then implement our scheme to assure Ethereum as the target software to provide concrete proof-of-concept implementation, validation, and experimental analyses. Our scheme enables more significant performance gains than relying on a centralized server thanks to the use of blockchain (e.g., two to three orders of magnitude quicker in verification) and adds small overheads (e.g., generating and verifying proof have an overhead of approximately one second, which is two orders of magnitude smaller than the software download or build processes). software supply chain; assurance; software integrity; applied cryptography; blockchain +
Footnote †: journal: Applied Sciences  
1
Footnote 1: email: [EMAIL_ADDRESS]  
as deterministic verifiable build because, given the source code and the build condition, it generates an identical build. Reproducible build can detect a compromise (malicious change, such as a backdoor or malware insertion at the compiler) in the build condition. Instead of advancing SBOM and reproducible build technologies themselves, we build on previous research and development for these technologies to secure their outputs. We secure the software supply chain against malicious compromise or injections in various steps in the supply chain. More specifically, we build a software build assurance scheme to detect the following compromises [2;3]: there has been a compromise and a change/insertion in the build or distribution process, the source code has been modified, or the download repository provides a different/modified code. The user downloading the software can detect such changes and verify the software integrity confirming that the software has not been modified from that by the legitimate source. To achieve such goals, the user generates a proof based on the software artifacts (code, compiler outputs, SBOM outputs) and compares it with a reference proof. We rely on the security-robust cryptographic hash function to generate the proof so that a malicious adversary cannot manipulate the proof or avoid detection, e.g., the adversary's injection or change in the software, which can occur in different parts of the software download and build processes, changes the pseudo-random proof. We use blockchain to serve as the trusted authority to provide the reference proof for verification on the user machine. Blockchain is appropriate for such purpose because it has high security in payload integrity (cannot change or modify the payload content on the blockchain ledger), resistance to a single point of failure (as long as the majority of the distributed participants follow the protocol), and high visibility and accountability (thanks to the distributed storage and easy read-access). We also utilize blockchain's strength in automatic broadcasting and distributed storage to distribute the proof offline, i.e., the reference proof can be shared any time before the software build assurance proof verification.