Cargo Sherlock: An SMT-Based Checker for Software Trust Costs

Muhammad Hassnain, Anirudh Basu, Ethan Ng +1

Supply chain attacks threaten open-source software ecosystems. This paper proposes a formal framework for quantifying trust in third-party software dependencies that is both formal…