Research Article
Bootstrapping Trust in Community Repository Projects
@INPROCEEDINGS{10.1007/978-3-031-25538-0_24, author={Sangat Vaidya and Santiago Torres-Arias and Justin Cappos and Reza Curtmola}, title={Bootstrapping Trust in Community Repository Projects}, proceedings={Security and Privacy in Communication Networks. 18th EAI International Conference, SecureComm 2022, Virtual Event, October 2022, Proceedings}, proceedings_a={SECURECOMM}, year={2023}, month={2}, keywords={Software certification Trust establishment}, doi={10.1007/978-3-031-25538-0_24} }- Sangat Vaidya
Santiago Torres-Arias
Justin Cappos
Reza Curtmola
Year: 2023
Bootstrapping Trust in Community Repository Projects
SECURECOMM
Springer
DOI: 10.1007/978-3-031-25538-0_24
Abstract
Community repositories such as PyPI and NPM are immensely popular and collectively serve more than a billion packages per day. However, existing software certification mechanisms such as code signing, which seeks to provide to end users authenticity and integrity for a piece of software, are not suitable for community repositories and are not used in this context. This is very concerning, given the recent increase in the frequency and variety of attacks against community repositories. In this work, we propose a different approach for certifying the validity of software projects hosted on community repositories. We design and implement aSoftware Certification Service (SCS)that receives certification requests from a project owner for a specific project and then issues a project certificate once the project owner successfully completes a protocol for proving ownership of the project. The proposed certification protocol is inspired from the highly-successful ACME protocol used by Let’s Encrypt and can be fully automated on the SCS side. It is, however, fundamentally different in its attack mitigation capabilities and in how ownership is proven. It is also compatible with existing community repositories such as PyPI, RubyGems, or NPM, without requiring changes to these repositories. To support this claim, we instantiate the proposed certification service with several practical deployments.
