6 papers
Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation
Julien Malka, Aman Sharma, Martin Monperrus +2
Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regar…
Understanding Build Reproducibility in the F-Droid Ecosystem
Denise Nanni, Julien Malka, Stefano Zacchiroli +2
The security of open source applications benefits considerably from the possibility of rebuilding their source and verifying the output. F-Droid, a prominent distribution for open…
NICE: A Framework for Declarative and Machine-Checkable Vulnerability Reproduction
Minh-Luân Nguyen, Olivier Levillain, Julien Malka +2
Reproducing software vulnerabilities is fundamental to security researchers, open-source maintainers, and educators. Yet, vulnerabilities remain hard to reproduce today, and even w…
Lila: Decentralized Build Reproducibility Monitoring for the Functional Package Management Model
Julien Malka, Arnout Engelen
Ensuring the integrity of software build artifacts is an increasingly important concern for modern software engineering, driven by increasingly sophisticated attacks on build syste…
Docker Does Not Guarantee Reproducibility
Julien Malka, Stefano Zacchiroli, Théo Zimmermann
The reproducibility of software environments is a critical concern in modern software engineering, with ramifications ranging from the effectiveness of collaboration workflows to s…
Does Functional Package Management Enable Reproducible Builds at Scale? Yes
Julien Malka, Stefano Zacchiroli, Théo Zimmermann
Reproducible Builds (R-B) guarantee that rebuilding a software package from source leads to bitwise identical artifacts. R-B is a promising approach to increase the integrity of th…