1 citations · 1 across the 11 of their papers we have counts for
3 papers · 1 filter
Context-Aware Trust Verification for Identity-Based Software Signing
Chinenye Okafor, James C. Davis, Santiago Torres-Arias
Modern software release infrastructure uses identity-based software signing to associate software artifacts with a known identity. For example, registries such as npm and Docker Hu…
An Industry Interview Study of Software Signing for Supply Chain Security
Kelechi G. Kalu, Tanya Singla, Chinenye Okafor +2
Many software products are composed of components integrated from other teams or external parties. Each additional link in a software product's supply chain increases the risk of t…
Signing in Four Public Software Package Registries: Quantity, Quality, and Influencing Factors
Taylor R Schorlemmer, Kelechi G Kalu, Luke Chigges +5
Many software applications incorporate open-source third-party packages distributed by public package registries. Guaranteeing authorship along this supply chain is a challenge. Pa…