Building a Safer Open Source Supply Chain on top of the Software Heritage Rock

Building a Safer Open Source Supply Chain on top of the Software Heritage Rock Stefano Zacchiroli Software Heritage Télécom Paris, Polytechnic Institute of Paris 1 June 2023 Sécurité de la Supply Chain Logicielle Paris, France THE GREAT LIBRARY OF SOURC E CODE Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 1 / 19 Outline 1Introduction 2KYSW (Know Your SoftWare) 3(Open Source) Software Supply Chain 4Software Heritage 5Conclusion Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 2 / 19 About the speaker Professor of Computer Science, Télécom Paris, Polytechnic Institute of Paris Free/Open Source Software activist (20+ years) Debian Developer & Former 3x Debian Project Leader Former Open Source Initiative (OSI) director Software Heritage co-founder & CTO Reproducible Builds board member Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 2 / 19 Outline 1Introduction 2KYSW (Know Your SoftWare) 3(Open Source) Software Supply Chain 4Software Heritage 5Conclusion Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 3 / 19 How are we managing our software ? Reproducibility, maintenance in Academia (articles: here,here,here and here) Security, integrity, traceability in Industry Can they track the software that they ship, use, acquire has that bug or vulnerability awareness is raising at the level of public policy Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 3 / 19 How are we managing our software ? Reproducibility, maintenance in Academia (articles: here,here,here and here) Security, integrity, traceability in Industry Can they track the software that they ship, use, acquire has that bug or vulnerability awareness is raising at the level of public policy Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 3 / 19 How are we managing our software ? Reproducibility, maintenance in Academia (articles: here,here,here and here) Security, integrity, traceability in Industry Can they track the software that they ship, use, acquire has that bug or vulnerability awareness is raising at the level of public policy Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 3 / 19 A few basic needs for software in Open Science (and Industry) Archive Research software artifacts must be properly archived make sure we can retrieve them (reproducibility) Reference Research software artifacts must be properly referenced make sure we can identify them (reproducibility) Describe Research software artifacts must be properly described make it easy to discover and reuse them (visibility) Cite/Credit Research software artifacts must be properly cited (not the same as referenced!) to give credit to authors (evaluation!) These are also industry needs! Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 4 / 19 A few basic needs for software in Open Science (and Industry) Archive Research software artifacts must be properly archived make sure we can retrieve them (reproducibility) Reference Research software artifacts must be properly referenced make sure we can identify them (reproducibility) Describe Research software artifacts must be properly described make it easy to discover and reuse them (visibility) Cite/Credit Research software artifacts must be properly cited (not the same as referenced!) to give credit to authors (evaluation!) These are also industry needs! Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 4 / 19 Software supply chain integrity ... KYSW is coming Software supply chain attacks abound Can you track the software that... you ship you use you acquire has that bug has that vulnerability KYSW: Know Your SoftWare - like KYC in banking Sec. 4. Enhancing Software Supply Chain Security ensuring and attesting, to the extent practicable, to the integrity and provenance of open source software May 2021 POTUS Executive Order Can we fulfil together these shared needs? Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 6 / 19 Software supply chain integrity ... KYSW is coming Software supply chain attacks abound Can you track the software that... you ship you use you acquire has that bug has that vulnerability KYSW: Know Your SoftWare - like KYC in banking Sec. 4. Enhancing Software Supply Chain Security ensuring and attesting, to the extent practicable, to the integrity and provenance of open source software May 2021 POTUS Executive Order Can we fulfil together these shared needs? Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 6 / 19 Software supply chain integrity ... KYSW is coming Software supply chain attacks abound Can you track the software that... you ship you use you acquire has that bug has that vulnerability KYSW: Know Your SoftWare - like KYC in banking Sec. 4. Enhancing Software Supply Chain Security ensuring and attesting, to the extent practicable, to the integrity and provenance of open source software May 2021 POTUS Executive Order Can we fulfil together these shared needs? Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 6 / 19 Software supply chain integrity ... KYSW is coming Software supply chain attacks abound Can you track the software that... you ship you use you acquire has that bug has that vulnerability KYSW: Know Your SoftWare - like KYC in banking Sec. 4. Enhancing Software Supply Chain Security ensuring and attesting, to the extent practicable, to the integrity and provenance of open source software May 2021 POTUS Executive Order Can we fulfil together these shared needs? Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 6 / 19 Outline 1Introduction 2KYSW (Know Your SoftWare) 3(Open Source) Software Supply Chain 4Software Heritage 5Conclusion Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 7 / 19 Software supply chain and its issues Complex digital infrastructure Software supply chain in the news Software Supply Chain attacks Malicious code injection into software components to compromise downstream users March 2022 node-ipc and peacenotwar (CVE-2022-23812) Dec 2021 Apache Log4j Remote Code Execution (Log4Shell, CVE-2021-44228) Nov 2018 Attack on NPM package event-stream Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 7 / 19 Software supply chain and its issues Complex digital infrastructure Software supply chain in the news Software Supply Chain attacks Malicious code injection into software components to compromise downstream users March 2022 node-ipc and peacenotwar (CVE-2022-23812) Dec 2021 Apache Log4j Remote Code Execution (Log4Shell, CVE-2021-44228) Nov 2018 Attack on NPM package event-stream Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 7 / 19 Software supply chain and its issues Complex digital infrastructure Software supply chain in the news Software Supply Chain attacks Malicious code injection into software components to compromise downstream users March 2022 node-ipc and peacenotwar (CVE-2022-23812) Dec 2021 Apache Log4j Remote Code Execution (Log4Shell, CVE-2021-44228) Nov 2018 Attack on NPM package event-stream Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 7 / 19 Software supply chain in a picture Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 8 / 19 A long road ahead Vertical approach improve security of each component separately Horizontal approach explore the whole supply chain A few key challenging properties findability needs qualified metadata availability needs an archive and a system of identifiers integrity needs crypto traceability needs a global provenance database reproducibility needs groundbreaking tools We need a global coordinated effort... and a common, open, shared infrastructure to track all (Open Source) software! Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 9 / 19 Software Heritage, in a nutshell www.softwareheritage.org THE GREAT LIBRA RY OF SOURCE CO DE Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 11 / 19 Software Heritage, in a nutshell www.softwareheritage.org THE GREAT LIBRA RY OF SOURCE CO DE Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 11 / 19 Software Heritage, in a nutshell www.softwareheritage.org THE GREAT LIBRA RY OF SOURCE CO DE Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 11 / 19 Software Heritage, in a nutshell www.softwareheritage.org THE GREAT LIBRA RY OF SOURCE CO DE Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 11 / 19 Universal software archive, principled http://bit.ly/swhpaper One infrastructure open and shared Largest archive Technology transparency and FOSS replicas all the way down Content (billions!) intrinsic identifiers facts and provenance Organization non-profit multi-stakeholder Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 12 / 19 Universal software archive, principled http://bit.ly/swhpaper One infrastructure open and shared Largest archive Technology transparency and FOSS replicas all the way down Content (billions!) intrinsic identifiers facts and provenance Organization non-profit multi-stakeholder Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 12 / 19 Universal software archive, principled http://bit.ly/swhpaper One infrastructure open and shared Largest archive Technology transparency and FOSS replicas all the way down Content (billions!) intrinsic identifiers facts and provenance Organization non-profit multi-stakeholder Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 12 / 19 An international, non profit initiative built for the long term Sharing the vision And many more ... www.softwareheritage.org/support/testimonials Donors, members, sponsors Diamond sponsor Bronze sponsors Gold sponsors Silver sponsors Platinum sponsors Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 13 / 19 A peek under the hood: a universal archive dsc dsc hg hg hg git git git git svn svn svn tar zip software origins Package repos Forges GitHub lister GitLab lister Debian lister PyPi lister . . . Distros ... Listing (full/incremental) tar Global development history permanently archived inauniform data model over 14 billion unique source files from over 210 million software projects ~1PB (compressed) blobs, ~30 B nodes, ~400 B edges Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 14 / 19 A peek under the hood: a universal archive Git loader Mercurial loader Debian source package loader pypi source package loader . . . Software Heritage Archive Merkle DAG + blob storage Loading & deduplication dsc dsc hg hg hg git git git git svn svn svn tar zip software origins Package repos Forges GitHub lister GitLab lister Debian lister PyPi lister . . . Distros ... Scheduling Listing (full/incremental) tar origins snapshots releases revisionsrevisions directoriesdirectories contents Global development history permanently archived inauniform data model over 14 billion unique source files from over 210 million software projects ~1PB (compressed) blobs, ~30 B nodes, ~400 B edges Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 14 / 19 A quick tour Browse (e.g. Apollo 11, and your work may be already there !) Trigger archival, use the updateswh browser extension, configure the webhooks Get and use SWHIDs (full specification available online) Cite software with biblatex-software package from CTAN Overleaf ACMART template available Example in journals: article from IPOL Example with Parmap: devel on Github,archive in SWH,curated deposit in HAL Extracting all the software products for Inria,for CNRS,for CNES,for LIRMM or for Rémi Gribonval using HalTools Curated deposit in SWH via HAL, see for example: LinBox,SLALOM,Givaro, NS2DDV,SumGra,Coq proof, ... Example use in research articles: compare Fig. 1 and conclusions in the 2012 version and the updated version SWHID in a replication experiment Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 16 / 19 A revolutionary infrastructure The graph of public software development Snapshots Releases Revisions Directories Contents All software development in a single graph ... enable traceability The global ledger of public code ... a Merkle graph ensure integrity Apillar of Open Science Reference archive of Research Software reproducibility reference Reference platform for Big Code uniform data structure large scale studies machine learning, AI, ... Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 17 / 19 A revolutionary infrastructure The graph of public software development Snapshots Releases Revisions Directories Contents All software development in a single graph ... enable traceability The global ledger of public code ... a Merkle graph ensure integrity Apillar of Open Science Reference archive of Research Software reproducibility reference Reference platform for Big Code uniform data structure large scale studies machine learning, AI, ... Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 17 / 19 A revolutionary infrastructure The graph of public software development Snapshots Releases Revisions Directories Contents All software development in a single graph ... enable traceability The global ledger of public code ... a Merkle graph ensure integrity Apillar of Open Science Reference archive of Research Software reproducibility reference Reference platform for Big Code uniform data structure large scale studies machine learning, AI, ... Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 17 / 19 A revolutionary infrastructure The graph of public software development Snapshots Releases Revisions Directories Contents All software development in a single graph ... enable traceability The global ledger of public code ... a Merkle graph ensure integrity Apillar of Open Science Reference archive of Research Software reproducibility reference Reference platform for Big Code uniform data structure large scale studies machine learning, AI, ... Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 17 / 19 Industry use cases (selection) Open Source complete and corresponding source code distribution (Intel) Software Heritage members can: archive source code in Software Heritage, distribute only the SWHID Traceability and integrity (OIN for the Linux System Definition) Software Heritage members can: archive source code in Software Heritage track it and verify its integrity using its SWHID And much more! an open source, open data code scanner for open compliance (swh-scanner) security — upcoming PTCC (French CampusCyber) project SWHSec supply chain management, long term archive add your use case here Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 18 / 19 Industry use cases (selection) Open Source complete and corresponding source code distribution (Intel) Software Heritage members can: archive source code in Software Heritage, distribute only the SWHID Traceability and integrity (OIN for the Linux System Definition) Software Heritage members can: archive source code in Software Heritage track it and verify its integrity using its SWHID And much more! an open source, open data code scanner for open compliance (swh-scanner) security — upcoming PTCC (French CampusCyber) project SWHSec supply chain management, long term archive add your use case here Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 18 / 19 Industry use cases (selection) Open Source complete and corresponding source code distribution (Intel) Software Heritage members can: archive source code in Software Heritage, distribute only the SWHID Traceability and integrity (OIN for the Linux System Definition) Software Heritage members can: archive source code in Software Heritage track it and verify its integrity using its SWHID And much more! an open source, open data code scanner for open compliance (swh-scanner) security — upcoming PTCC (French CampusCyber) project SWHSec supply chain management, long term archive add your use case here Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 18 / 19 Outline 1Introduction 2KYSW (Know Your SoftWare) 3(Open Source) Software Supply Chain 4Software Heritage 5Conclusion Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 19 / 19 A rally flag for a grand vision Bring together academia, industry, governments, communities "to build a reference, global infrastructure for open and better software" Software Heritage is the first brick ... vendor neutral open source aworldwide initiative along term initiative ... that will enable archival,reference,integrity qualification,sharing and reuse aglobal software knowledge base test and deploy world class tooling You can help! fund and/or develop SWH, use SWH research, build tools softwareheritage.org Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 19 / 19 SWHSec 1 SWHSec Leveraging Software Heritage to Enhance Cybersecurity Co-porteur Nom : Barais Prénom : Olivier Email : [email protected] PTCC Axe 1 : Programme R&D Co-porteur Nom : Zacchiroli Prénom : Stefano Email : [email protected] Co-porteur Nom : Di Cosmo Prénom : Roberto Email : [email protected] Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 4 / 7 SWHSec (cont.) 7 Enjeux stratégiques du projet Aujourd’hui, seulement les hyperscalers fournissent les plateformes qui hébergent les codes sources et distribuent les binaires des logiciels Open Source ●Github (Microsoft) ●Gitlab (gitlab.com et un large ensemble de repositories privés) On assiste à la concentration des outils d’analyse de la supply chain open source entre des acteurs non européens, e.g.: -Sur les dépendances (Dependatbot https://github.com/dependabot) -Sur le code (rough-auditing-tool-for-security RATS, CodeQL by github, …) Opportunité: un outil unique au monde (SWH) qui fournit une source de données vaste et peut être outillé pour la cybersécurité Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 5 / 7 SWHSec (cont.) 10 Les objectifs du projet Construire par-dessus l’infrastructure de Software Heritage (SWH), une chaîne d’analyse et de remédiation unique scalable dédiée à la cybersécurité ●Analyseur du code source, capable de bénéficier de l’architecture de SWH ●Infrastructure de gestion des dépendances permettant une analyse temporelle de l’évolution des dépendances dans le domaine de l’open-source ●Analyse de l’impact d’une vulnérabilité à l’aide de SWH ●Remédiation sur un ensemble de projets d’une vulnérabilité découverte ●Extension de Software Heritage pour la prise en compte des outils d’analyse de sécurité Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 6 / 7 SWHSec (cont.) 13 SWHSec Leveraging Software Heritage to Enhance Cybersecurity Stefano Zacchiroli [email protected] (CC-BY-SA 4.0) A safer open source supply chain with Software Heritage 1 June 2023 7 / 7