6 papers
Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation
Julien Malka, Aman Sharma, Martin Monperrus +2
Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regar…
Dependencies that Bundle Code and Execution
Aman Sharma, Martin Monperrus
Applications are built from many dependencies. Each dependency is distributed by package registries but it only contains compiled code and does not ship execution state, so runtime…
Classport: Designing Runtime Dependency Introspection for Java
Serena Cofano, Daniel Williams, Aman Sharma +1
Runtime introspection of dependencies, i.e., the ability to observe which dependencies are currently used during program execution, is fundamental for Software Supply Chain securit…
zkSBOM: Privacy-Preserving SBOM Sharing with Zero-Knowledge Sets
Tom Sorger, Eric Cornelissen, Aman Sharma +3
Software Bills of Materials (SBOMs) are increasingly mandated by regulators, yet existing sharing mechanisms impose a binary choice between full disclosure and full opacity. This e…
Causes and Canonicalization of Unreproducible Builds in Java
Aman Sharma, Benoit Baudry, Martin Monperrus
The increasing complexity of software supply chains and the rise of supply chain attacks have elevated concerns around software integrity. Users and stakeholders face significant c…
Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order
Frank Reyes, Federico Bono, Aman Sharma +2
Java projects frequently rely on package managers such as Maven to manage complex webs of external dependencies. While these tools streamline development, they also introduce subtl…