38 citations · 46 across the 9 of their papers we have counts for
9 papers
Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation
Julien Malka, Aman Sharma, Martin Monperrus +2
Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regar…
Dependencies that Bundle Code and Execution
Aman Sharma, Martin Monperrus
Applications are built from many dependencies. Each dependency is distributed by package registries but it only contains compiled code and does not ship execution state, so runtime…
zkSBOM: Privacy-Preserving SBOM Sharing with Zero-Knowledge Sets
Tom Sorger, Eric Cornelissen, Aman Sharma +3
Software Bills of Materials (SBOMs) are increasingly mandated by regulators, yet existing sharing mechanisms impose a binary choice between full disclosure and full opacity. This e…
Classport: Designing Runtime Dependency Introspection for Java
Serena Cofano, Daniel Williams, Aman Sharma +1
Runtime introspection of dependencies, i.e., the ability to observe which dependencies are currently used during program execution, is fundamental for Software Supply Chain securit…
Causes and Canonicalization of Unreproducible Builds in Java
Aman Sharma, Benoit Baudry, Martin Monperrus
The increasing complexity of software supply chains and the rise of supply chain attacks have elevated concerns around software integrity. Users and stakeholders face significant c…
Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order
Frank Reyes, Federico Bono, Aman Sharma +2
Java projects frequently rely on package managers such as Maven to manage complex webs of external dependencies. While these tools streamline development, they also introduce subtl…
SBOM.EXE: Countering Dynamic Code Injection based on Software Bill of Materials in Java
Aman Sharma, Martin Wittlinger, Benoit Baudry +1
Software supply chain attacks have become a significant threat as software development increasingly relies on contributions from multiple, often unverified sources. The code from u…
Challenges of Producing Software Bill Of Materials for Java
Musard Balliu, Benoit Baudry, Sofia Bobadilla +7
Software bills of materials (SBOM) promise to become the backbone of software supply chain hardening. We deep-dive into 6 tools and the accuracy of the SBOMs they produce for compl…
Augmenting Diffs With Runtime Information
Khashayar Etemadi, Aman Sharma, Fernanda Madeiral +1
Source code diffs are used on a daily basis as part of code review, inspection, and auditing. To facilitate understanding, they are typically accompanied by explanations that descr…