1 citations · 1 across the 11 of their papers we have counts for
8 papers · 1 filter
AgOSS: A Dataset and Multi-Layer Characterization of Open-Source Agricultural Software
Vatsal Dudhaiya, Mikhail Golovenchits, Aryan Banerjee +1
Much of agriculture depends on open-source software spanning farm management platforms, cloud services, edge gateways, embedded systems, and field-deployed sensors, forming a domai…
Reproducibility is Not Enough: Artifact Verifiability in Decentralized-Build Package Ecosystems
Oreofe Solarin, Kelechi Kalu, James C. Davis +1
Reproducible and verifiable builds increase trust in distributed software artifacts by enabling independent parties to detect artifacts produced by compromised build or release pip…
Measuring Delivery Consistency in Practice: A DORA Extension from a Multi-Platform Release Setting
Luiz Parente, James C. Davis
The DevOps Research and Assessment (DORA) framework is the most widely adopted measurement system for performance measurement across engineering teams. However, every DORA metric i…
Identity-Based Signing Shifts, Not Solves, Usability: Evidence from Five Identity-Based Signing Ecosystems
Kelechi G. Kalu, Hieu Tran, Santiago Torres-Arias +2
Identity-based software signing tools aim to make software artifact provenance verifiable while reducing the burden of long-lived key management. These tools are becoming critical…
Operationalizing Research Software for Supply Chain Security
Kelechi G. Kalu, Soham Rattan, Taylor R. Schorlemmer +3
Empirical studies of research software are hard to compare because the literature operationalizes ``research software'' inconsistently. Motivated by the research software supply ch…
Why Software Signing (Still) Matters: Trust Boundaries in the Software Supply Chain
Kelechi G. Kalu, James C. Davis
Software signing provides a formal mechanism for provenance by ensuring artifact integrity and verifying producer identity. It also imposes tooling and operational costs to impleme…
Why Johnny Adopts Identity-Based Software Signing: A Usability Case Study of Sigstore
Kelechi G. Kalu, Sofia Okorafor, Tanmay Singla +3
Software signing is the most robust method for ensuring the integrity and authenticity of components in a software supply chain. Legacy key-managed signing tools (e.g., OpenPGP) bu…
An Industry Interview Study of Software Signing for Supply Chain Security
Kelechi G. Kalu, Tanya Singla, Chinenye Okafor +2
Many software products are composed of components integrated from other teams or external parties. Each additional link in a software product's supply chain increases the risk of t…