Reproducible Builds: Increasing the Integrity of Software Supply Chains

Chris Lamb; Stefano Zacchiroli

doi:10.1109/MS.2021.3073045

Reproducible Builds: Increasing the Integrity of Software Supply Chains

Research output: Contribution to journal › Article › peer-review

Abstract

Although it is possible to increase confidence in free and open source software by reviewing its source code, trusting code is not the same as trusting its executable counterparts. This article examines reproducible builds, an approach that can determine whether generated binaries correspond to the original source code.

Original language	English
Pages (from-to)	62-70
Number of pages	9
Journal	IEEE Software
Volume	39
Issue number	2
DOIs	https://doi.org/10.1109/MS.2021.3073045
Publication status	Published - 1 Jan 2022
Externally published	Yes

Access to Document

10.1109/MS.2021.3073045

Cite this

@article{b99c0ed4c2fb42dd87c15979e4443e0e,

title = "Reproducible Builds: Increasing the Integrity of Software Supply Chains",

abstract = "Although it is possible to increase confidence in free and open source software by reviewing its source code, trusting code is not the same as trusting its executable counterparts. This article examines reproducible builds, an approach that can determine whether generated binaries correspond to the original source code.",

author = "Chris Lamb and Stefano Zacchiroli",

note = "Publisher Copyright: {\textcopyright} 1984-2012 IEEE.",

year = "2022",

month = jan,

day = "1",

doi = "10.1109/MS.2021.3073045",

language = "English",

volume = "39",

pages = "62--70",

journal = "IEEE Software",

issn = "0740-7459",

number = "2",

}

TY - JOUR

T1 - Reproducible Builds

T2 - Increasing the Integrity of Software Supply Chains

AU - Lamb, Chris

AU - Zacchiroli, Stefano

PY - 2022/1/1

Y1 - 2022/1/1

N2 - Although it is possible to increase confidence in free and open source software by reviewing its source code, trusting code is not the same as trusting its executable counterparts. This article examines reproducible builds, an approach that can determine whether generated binaries correspond to the original source code.

AB - Although it is possible to increase confidence in free and open source software by reviewing its source code, trusting code is not the same as trusting its executable counterparts. This article examines reproducible builds, an approach that can determine whether generated binaries correspond to the original source code.

U2 - 10.1109/MS.2021.3073045

DO - 10.1109/MS.2021.3073045

M3 - Article

AN - SCOPUS:85104254005

SN - 0740-7459

VL - 39

SP - 62

EP - 70

JO - IEEE Software

JF - IEEE Software

IS - 2

ER -

Reproducible Builds: Increasing the Integrity of Software Supply Chains

Abstract

Access to Document

Fingerprint

Cite this