1 citations · 1 across the 11 of their papers we have counts for
11 papers
AgOSS: A Dataset and Multi-Layer Characterization of Open-Source Agricultural Software
Vatsal Dudhaiya, Mikhail Golovenchits, Aryan Banerjee +1
Much of agriculture depends on open-source software spanning farm management platforms, cloud services, edge gateways, embedded systems, and field-deployed sensors, forming a domai…
Reproducibility is Not Enough: Artifact Verifiability in Decentralized-Build Package Ecosystems
Oreofe Solarin, Kelechi Kalu, James C. Davis +1
Reproducible and verifiable builds increase trust in distributed software artifacts by enabling independent parties to detect artifacts produced by compromised build or release pip…
Measuring Delivery Consistency in Practice: A DORA Extension from a Multi-Platform Release Setting
Luiz Parente, James C. Davis
The DevOps Research and Assessment (DORA) framework is the most widely adopted measurement system for performance measurement across engineering teams. However, every DORA metric i…
Identity-Based Signing Shifts, Not Solves, Usability: Evidence from Five Identity-Based Signing Ecosystems
Kelechi G. Kalu, Hieu Tran, Santiago Torres-Arias +2
Identity-based software signing tools aim to make software artifact provenance verifiable while reducing the burden of long-lived key management. These tools are becoming critical…
Operationalizing Research Software for Supply Chain Security
Kelechi G. Kalu, Soham Rattan, Taylor R. Schorlemmer +3
Empirical studies of research software are hard to compare because the literature operationalizes ``research software'' inconsistently. Motivated by the research software supply ch…
Why Software Signing (Still) Matters: Trust Boundaries in the Software Supply Chain
Kelechi G. Kalu, James C. Davis
Software signing provides a formal mechanism for provenance by ensuring artifact integrity and verifying producer identity. It also imposes tooling and operational costs to impleme…
ARMS: A Vision for Actor Reputation Metric Systems in the Open-Source Software Supply Chain
Kelechi G. Kalu, Sofia Okorafor, Betül Durak +4
Many critical information technology and cyber-physical systems rely on a supply chain of open-source software projects. OSS project maintainers often integrate contributions from…
Why Johnny Adopts Identity-Based Software Signing: A Usability Case Study of Sigstore
Kelechi G. Kalu, Sofia Okorafor, Tanmay Singla +3
Software signing is the most robust method for ensuring the integrity and authenticity of components in a software supply chain. Legacy key-managed signing tools (e.g., OpenPGP) bu…
Context-Aware Trust Verification for Identity-Based Software Signing
Chinenye Okafor, James C. Davis, Santiago Torres-Arias
Modern software release infrastructure uses identity-based software signing to associate software artifacts with a known identity. For example, registries such as npm and Docker Hu…
An Industry Interview Study of Software Signing for Supply Chain Security
Kelechi G. Kalu, Tanya Singla, Chinenye Okafor +2
Many software products are composed of components integrated from other teams or external parties. Each additional link in a software product's supply chain increases the risk of t…
Signing in Four Public Software Package Registries: Quantity, Quality, and Influencing Factors
Taylor R Schorlemmer, Kelechi G Kalu, Luke Chigges +5
Many software applications incorporate open-source third-party packages distributed by public package registries. Guaranteeing authorship along this supply chain is a challenge. Pa…