An Experience Report on Producing Verifiable Builds for Large-Scale Commercial Systems

Shi, Yong; Wen, Mingzhi; Côgo, Filipe Roseiro; Chen, Boyuan; Jiang, Zhen Ming

doi:10.1109/tse.2021.3092692

Cited by 9 publications

(7 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There is interest in industry in reproducibility for software security and provenance (e.g. Chen (2018); Shi et al (2021); Hurst (2021)), but the emphasis is on the software development process. The value, or potential value, to end users of software outside the development process is articulated less often.…”

Section: Discussionmentioning

confidence: 99%

“…The finding remains current and relevant according to practitioners interviewed by Enck and Williams (2022). There is then a twofold problem when trying to create a reproducible build: firstly the causes of nondeterminism in a build process must be identified, and secondly solutions that eliminate or control the causes of nondeterminism need to be found (Ren et al, 2018(Ren et al, , 2019(Ren et al, , 2022Shi et al, 2021). Tools and techniques are being developed to support the identification of variance in build processes.…”

Section: Implementing Reproducible Buildsmentioning

confidence: 99%

“…de Carné de Carnavalet et al ( 2014) identify limitations to R-Bs, particularly with legacy OSS and closed source dependencies, and reason that a verifiable build, such as the approach described by Hurst (2021), where build differences can be accounted for, may be a necessary, pragmatic solution in some circumstances. Shi et al (2021) developed a systematic approach to creating verifiable builds that was successfully applied in large-scale commercial software systems. The approach resulted in 100% of build artefacts in three large-scale systems at Huawei being verifiable (Shi et al, 2021).…”

Section: Implementing Reproducible Buildsmentioning

confidence: 99%

“…Shi et al (2021) developed a systematic approach to creating verifiable builds that was successfully applied in large-scale commercial software systems. The approach resulted in 100% of build artefacts in three large-scale systems at Huawei being verifiable (Shi et al, 2021).…”

Section: Implementing Reproducible Buildsmentioning

confidence: 99%

“…The academic literature on R-Bs has largely focused on the technical challenges (de Carné de Carnavalet et al, 2014;Ren et al, 2018Ren et al, , 2019Shi et al, 2021), on supply chain integrity in OSS (Lamb & Zacchiroli, 2021), and on specific implementations of R-Bs such as Guix (Courtès & Wurmus, 2015;Courtès, 2017), NixOS (Dolstra et al, 2010) and in-toto (Torres-Arias et al, 2019). The grey or practitioner literature 1 contains a range of views on R-Bs and some practitioners have identified additional applications of the techniques.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

On business adoption and use of reproducible builds for open and closed source software

et al. 2022

View full text Add to dashboard Cite

Reproducible builds (R-Bs) are software engineering practices that reliably create bit-for-bit identical binary executable files from specified source code. R-Bs are applied in some open source software (OSS) projects and distributions to allow verification that the distributed binary has been built from the released source code. The use of R-Bs has been advocated in software maintenance and R-Bs are applied in the development of some OSS security applications. Nonetheless, industry application of R-Bs appears limited, and we seek to understand whether awareness is low or if significant technical and business reasons prevent wider adoption. Through interviews with software practitioners and business managers, this study explores the utility of applying R-Bs in businesses in the primary and secondary software sectors and the business and technical reasons supporting their adoption. We find businesses use R-Bs in the safety-critical and security domains, and R-Bs are valuable for traceability and support collaborative software development. We also found that R-Bs are valued as engineering processes and are seen as a badge of software quality, but without a tangible value proposition. There are good engineering reasons to use R-Bs in industrial software development, and the principle of establishing correspondence between source code and binary offers opportunities for the development of further applications.

show abstract

Section: Discussionmentioning

confidence: 99%