1 citations · 1 across the 11 of their papers we have counts for
3 papers · 1 filter
Why Software Signing (Still) Matters: Trust Boundaries in the Software Supply Chain
Kelechi G. Kalu, James C. Davis
Software signing provides a formal mechanism for provenance by ensuring artifact integrity and verifying producer identity. It also imposes tooling and operational costs to impleme…
ARMS: A Vision for Actor Reputation Metric Systems in the Open-Source Software Supply Chain
Kelechi G. Kalu, Sofia Okorafor, Betül Durak +4
Many critical information technology and cyber-physical systems rely on a supply chain of open-source software projects. OSS project maintainers often integrate contributions from…
Why Johnny Adopts Identity-Based Software Signing: A Usability Case Study of Sigstore
Kelechi G. Kalu, Sofia Okorafor, Tanmay Singla +3
Software signing is the most robust method for ensuring the integrity and authenticity of components in a software supply chain. Legacy key-managed signing tools (e.g., OpenPGP) bu…