7 papers
No Snake Oil: Verifying Python Package Builds
Jens Dietrich, Spencer Sun, Tim W. White +1
Python has become the default language for interacting with AI, with packages being distributed through registries like the Python Package Index (PyPI). This creates a need to anal…
AgentHub: A Registry for Discoverable, Verifiable, and Reproducible AI Agents
Erik Pautsch, Tanmay Singla, Parv Kumar +6
LLM-based agents are rapidly proliferating, yet the infrastructure for discovering, evaluating, and governing them remains fragmented compared to mature ecosystems like software pa…
On the Variability of Source Code in Maven Package Rebuilds
Jens Dietrich, Behnaz Hassanshahi
Rebuilding packages from open source is a common practice to improve the security of software supply chains, and is now done at an industrial scale. The basic principle is to acqui…
Unlocking Reproducibility: Automating re-Build Process for Open-Source Software
Behnaz Hassanshahi, Trong Nhan Mai, Benjamin Selwyn Smith +1
Software ecosystems like Maven Central play a crucial role in modern software supply chains by providing repositories for libraries and build plugins. However, the separation betwe…
DALEQ -- Explainable Equivalence for Java Bytecode
Jens Dietrich, Behnaz Hassanshahi
The security of software builds has attracted increased attention in recent years in response to incidents like solarwinds and xz. Now, several companies including Oracle and Googl…
Practical Type-Based Taint Checking and Inference (Extended Version)
Nima Karimipour, Kanak Das, Manu Sridharan +1
Many important security properties can be formulated in terms of flows of tainted data, and improved taint analysis tools to prevent such flows are of critical need. Most existing…