Free/Open Source Software in the Era of AI Hype

Building a Safer Open Source Supply Chain with Software Heritage, the Great Library of Source Code Stefano Zacchiroli Télécom Paris, Institut Polytechnique de Paris [email protected] 11 June 2025 — Ada-Europe, Paris, France THE GREAT LIBRARY OF SOURC E CODE Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 1 / 34 Outline 1Preface B_ignoreheading 2Source code as knowledge 3Software Heritage 4Highlight #1: The evolution of public code 5Highlight #2: Cross-fork 1-day vulnerabilities 6Highlight #3: Efficient open compliance 7What about AI? 8Conclusion Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 2 / 34 About the speaker Professor of Computer Science, Télécom Paris, Polytechnic Institute of Paris Free/Open Source Software activist (20+ years) Debian Developer & Former 3x Debian Project Leader Former Open Source Initiative (OSI) director Software Heritage co-founder & CSO Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 2 / 34 Outline 1Preface B_ignoreheading 2Source code as knowledge 3Software Heritage 4Highlight #1: The evolution of public code 5Highlight #2: Cross-fork 1-day vulnerabilities 6Highlight #3: Efficient open compliance 7What about AI? 8Conclusion Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 3 / 34 Software is dual-form knowledge “The source code for a work means the preferred form of the work for making modifications to it." GPL Licence Hello World Program (excerpt of binary) 4004e6: 55 4004e7: 48 89 e5 4004ea: bf 84 05 40 00 4004ef: b8 00 00 00 00 4004f4: e8 c7 fe ff ff 4004f9: 90 4004fa: 5d 4004fb: c3 Program (source code) /* Hello World program */ #include<stdio.h> void main() { printf("Hello World"); } Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 3 / 34 Software is dual-form knowledge “The source code for a work means the preferred form of the work for making modifications to it." GPL Licence Hello World Program (excerpt of binary) 4004e6: 55 4004e7: 48 89 e5 4004ea: bf 84 05 40 00 4004ef: b8 00 00 00 00 4004f4: e8 c7 fe ff ff 4004f9: 90 4004fa: 5d 4004fb: c3 Program (source code) /* Hello World program */ #include<stdio.h> void main() { printf("Hello World"); } Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 3 / 34 Software is dual-form knowledge “The source code for a work means the preferred form of the work for making modifications to it." GPL Licence Hello World Program (excerpt of binary) 4004e6: 55 4004e7: 48 89 e5 4004ea: bf 84 05 40 00 4004ef: b8 00 00 00 00 4004f4: e8 c7 fe ff ff 4004f9: 90 4004fa: 5d 4004fb: c3 Program (source code) /* Hello World program */ #include<stdio.h> void main() { printf("Hello World"); } Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 3 / 34 Software is dual-form knowledge “The source code for a work means the preferred form of the work for making modifications to it." GPL Licence Hello World Program (excerpt of binary) 4004e6: 55 4004e7: 48 89 e5 4004ea: bf 84 05 40 00 4004ef: b8 00 00 00 00 4004f4: e8 c7 fe ff ff 4004f9: 90 4004fa: 5d 4004fb: c3 Program (source code) /* Hello World program */ #include<stdio.h> void main() { printf("Hello World"); } Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 3 / 34 Software source code is precious human and technical knowledge Harold Abelson, Structure and Interpretation of Computer Programs (1st ed.) 1985 “Programs must be written for people to read, and only incidentally for machines to execute.” Apollo 11 source code (excerpt)Quake III source code (excerpt) Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 4 / 34 Software source code is fragile Endangered source code ... link rot data rot platform consolidation 2015 Google Code and Gitorious.org shutdown: ~1M 2019 Bitbucket mercurial phase out: ~250.000 2022 GitLab.com: remove inactive projects? ... is endangered knowledge! broken links and missing pieces in the web of knowledge of humankind Bottomline: we need a global, long term effort to build a universal archive of all software source code Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 7 / 34 Software source code is fragile Endangered source code ... link rot data rot platform consolidation 2015 Google Code and Gitorious.org shutdown: ~1M 2019 Bitbucket mercurial phase out: ~250.000 2022 GitLab.com: remove inactive projects? ... is endangered knowledge! broken links and missing pieces in the web of knowledge of humankind Bottomline: we need a global, long term effort to build a universal archive of all software source code Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 7 / 34 Outline 1Preface B_ignoreheading 2Source code as knowledge 3Software Heritage 4Highlight #1: The evolution of public code 5Highlight #2: Cross-fork 1-day vulnerabilities 6Highlight #3: Efficient open compliance 7What about AI? 8Conclusion Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 8 / 34 Software Heritage in a nutshell www.softwareheritage.org Unveiled in 2016 THE GREAT LIBRA RY OF SO URCE CO D E Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 8 / 34 Software Heritage in a nutshell www.softwareheritage.org Unveiled in 2016 THE GREAT LIBRA RY OF SO URCE CO D E Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 8 / 34 Software Heritage in a nutshell www.softwareheritage.org Unveiled in 2016 THE GREAT LIBRA RY OF SO URCE CO D E Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 8 / 34 Software Heritage in a nutshell www.softwareheritage.org Unveiled in 2016 THE GREAT LIBRA RY OF SO URCE CO D E Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 8 / 34 Today: a universal software archive, as a shared infrastructure One infrastructure open and shared The largest archive ever built figures as of January 18 2025 Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 9 / 34 Today: a universal software archive, as a shared infrastructure One infrastructure open and shared The largest archive ever built figures as of January 18 2025 Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 9 / 34 Today: a universal software archive, as a shared infrastructure One infrastructure open and shared The largest archive ever built figures as of January 18 2025 Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 9 / 34 A peek under the hood: a universal archive Git loader Mercurial loader Debian source package loader pypi source package loader . . . Software Heritage Archive Merkle DAG + blob storage Loading & deduplication dsc dsc hg hg hg git git git git svn svn svn tar zip software origins Package repos Forges GitHub lister GitLab lister Debian lister PyPi lister . . . Distros ... Scheduling Listing (full/incremental) tar origins snapshots releases revisionsrevisions directoriesdirectories contents Global development history permanently archived inauniform data model over 24 billion unique source files from over 375 million software projects ~2PB (compressed) blobs, ~50 B nodes, ~900 B edges Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 11 / 34 Referencing all source code artifacts with SWHIDs Software Heritage Identifiers (SWHID) see swhid.org 50+B intrinsic, decentralised, cryptographic Full fledged source code references for traceability, integrity and reproducibility Linux Foundation SPDX 2.2 IANA-registered "swh:" WikiData property P6138 Examples: Apollo 11 AGC excerpt,Quake III rsqrt Guidelines available, see the HOWTO ISO/IEC 18670, see swhid.org Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 12 / 34 Referencing all source code artifacts with SWHIDs Software Heritage Identifiers (SWHID) see swhid.org 50+B intrinsic, decentralised, cryptographic Full fledged source code references for traceability, integrity and reproducibility Linux Foundation SPDX 2.2 IANA-registered "swh:" WikiData property P6138 Examples: Apollo 11 AGC excerpt,Quake III rsqrt Guidelines available, see the HOWTO ISO/IEC 18670, see swhid.org Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 12 / 34 Referencing all source code artifacts with SWHIDs Software Heritage Identifiers (SWHID) see swhid.org 50+B intrinsic, decentralised, cryptographic Full fledged source code references for traceability, integrity and reproducibility Linux Foundation SPDX 2.2 IANA-registered "swh:" WikiData property P6138 Examples: Apollo 11 AGC excerpt,Quake III rsqrt Guidelines available, see the HOWTO ISO/IEC 18670, see swhid.org Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 12 / 34 Referencing all source code artifacts with SWHIDs Software Heritage Identifiers (SWHID) see swhid.org 50+B intrinsic, decentralised, cryptographic Full fledged source code references for traceability, integrity and reproducibility Linux Foundation SPDX 2.2 IANA-registered "swh:" WikiData property P6138 Examples: Apollo 11 AGC excerpt,Quake III rsqrt Guidelines available, see the HOWTO ISO/IEC 18670, see swhid.org Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 12 / 34 The archive: a (giant) Merkle DAG origin visit https://forge.softwareheritage.org/source/helloworld.git snapshot 1 timestamp Fri Feb 9 12:38:45 2018 +0100 0861db5e… <<Revision>> a3ee21ad… +author = "Stefano Zacchiroli <zack@…>" +message = "add build toolchain …" +timestamp = Thu Feb 8 10:49:29 2018 +0100 +directory: Directory +parents: Revision list <<Directory>> b94a90cd… +entries ".gitignore" "Makefile" "hello.c" <<Content>> 225ae01b… +data = "all: hello\n\n…" <<Revision>> 43ef7dcd… +author = "Stefano Zacchiroli <zack@…>" +message = "add licensing information and README" +timestamp = Thu Feb 8 10:54:09 2018 +0100 +directory: Directory +parents: Revision list <<Directory>> fa8c0908… +entries ".gitignore" "COPYING" "Makefile" "README.md" "hello.c" <<Content>> a1afd006… +data = "…Yet another…" <<Release>> edf82f21… +author = "Stefano Zacchiroli <zack@…>" +name = "1.0" +message = "1.0 release" +timestamp = Thu Feb 8 15:51:00 2018 +0100 +target <<Snapshot>> 0861db5e… +branches HEAD refs/heads/master refs/tags/1.0 Archive content after visit 1 <<Content>> c839dea9… +data = "#include …" <<Directory>> 6ca2e444… +entries "hello.c" <<Revision>> 1886826f… +author = "Stefano Zacchiroli <zack@…>" +message = "implement a trivial …" +timestamp = Thu Feb 8 10:44:35 2018 +0100 +directory: Directory +parents: Revision list = None Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 13 / 34 The archive: a (giant) Merkle DAG origin visit https://forge.softwareheritage.org/source/helloworld.git snapshot 1 https://forge.softwareheritage.org/source/helloworld.git 2 timestamp Fri Feb 9 12:38:45 2018 +0100 Fri Feb 9 13:29:00 2018 +0100 0861db5e… 0861db5e… <<Revision>> a3ee21ad… +author = "Stefano Zacchiroli <zack@…>" +message = "add build toolchain …" +timestamp = Thu Feb 8 10:49:29 2018 +0100 +directory: Directory +parents: Revision list <<Directory>> b94a90cd… +entries ".gitignore" "Makefile" "hello.c" <<Content>> 225ae01b… +data = "all: hello\n\n…" <<Revision>> 43ef7dcd… +author = "Stefano Zacchiroli <zack@…>" +message = "add licensing information and README" +timestamp = Thu Feb 8 10:54:09 2018 +0100 +directory: Directory +parents: Revision list <<Directory>> fa8c0908… +entries ".gitignore" "COPYING" "Makefile" "README.md" "hello.c" <<Content>> a1afd006… +data = "…Yet another…" <<Release>> edf82f21… +author = "Stefano Zacchiroli <zack@…>" +name = "1.0" +message = "1.0 release" +timestamp = Thu Feb 8 15:51:00 2018 +0100 +target <<Snapshot>> 0861db5e… +branches HEAD refs/heads/master refs/tags/1.0 Archive content after visits 1 and 2 <<Content>> c839dea9… +data = "#include …" <<Directory>> 6ca2e444… +entries "hello.c" <<Revision>> 1886826f… +author = "Stefano Zacchiroli <zack@…>" +message = "implement a trivial …" +timestamp = Thu Feb 8 10:44:35 2018 +0100 +directory: Directory +parents: Revision list = None Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 13 / 34 The archive: a (giant) Merkle DAG origin visit https://forge.softwareheritage.org/source/helloworld.git snapshot 1 https://forge.softwareheritage.org/source/helloworld.git 2 timestamp Fri Feb 9 12:38:45 2018 +0100 Fri Feb 9 13:29:00 2018 +0100 https://forge.softwareheritage.org/source/helloworld.git 3Fri Feb 9 15:52:50 2018 +0100 510aa88b… 0861db5e… 0861db5e… <<Revision>> a3ee21ad… +author = "Stefano Zacchiroli <zack@…>" +message = "add build toolchain …" +timestamp = Thu Feb 8 10:49:29 2018 +0100 +directory: Directory +parents: Revision list <<Directory>> b94a90cd… +entries ".gitignore" "Makefile" "hello.c" <<Content>> 225ae01b… +data = "all: hello\n\n…" <<Revision>> 43ef7dcd… +author = "Stefano Zacchiroli <zack@…>" +message = "add licensing information and README" +timestamp = Thu Feb 8 10:54:09 2018 +0100 +directory: Directory +parents: Revision list <<Revision>> c7640e8d… +author = "Stefano Zacchiroli <zack@…>" +message = "move source code to src/\n…" +timestamp = Thu Feb 8 15:26:08 2018 +0100 +directory: Directory +parents: Revision list <<Directory>> fa8c0908… +entries ".gitignore" "COPYING" "Makefile" "README.md" "hello.c" <<Content>> a1afd006… +data = "…Yet another…" <<Directory>> 45f0c078… +entries "COPYING" "Makefile" "README.md" "src" <<Release>> edf82f21… +author = "Stefano Zacchiroli <zack@…>" +name = "1.0" +message = "1.0 release" +timestamp = Thu Feb 8 15:51:00 2018 +0100 +target <<Snapshot>> 0861db5e… +branches HEAD refs/heads/master refs/tags/1.0 <<Snapshot>> 510aa88b… +branches HEAD refs/heads/master refs/heads/doc refs/tags/1.0 Archive content after visits 1 and 2 <<Content>> c839dea9… +data = "#include …" <<Directory>> 6ca2e444… +entries "hello.c" <<Revision>> 1886826f… +author = "Stefano Zacchiroli <zack@…>" +message = "implement a trivial …" +timestamp = Thu Feb 8 10:44:35 2018 +0100 +directory: Directory +parents: Revision list = None ... Archive content after visits 1, 2 and 3 Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 13 / 34 A walkthrough General Browse the archive, get and use SWHIDs, e.g. Apollo 11 excerpt,Parcoursup excerpt Trigger archival with the browser extension or webhook forge integration Open Science Curated deposit via HAL, e.g.: LinBox,SLALOM,Givaro,SumGra,Coq proof, ... Cite software with the biblatex-software style, e.g.: article from IPOL History of software: rescuing landmark legacy software see SWHAP process,Software Stories, and SWHAP Days 2022 Public code Archived source code from code.gouv.fr Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 14 / 34 Outline 1Preface B_ignoreheading 2Source code as knowledge 3Software Heritage 4Highlight #1: The evolution of public code 5Highlight #2: Cross-fork 1-day vulnerabilities 6Highlight #3: Efficient open compliance 7What about AI? 8Conclusion Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 15 / 34 Software supply chain attacks Reusing OSS via dependencies Software dependencies: a popular way of reusing open source software. Software product Auses functionalities implemented in OSS product B...and so on. based on xkcd.com/2347 Attacking the software supply chain Attacking undermaintained "leaf" packages (e.g., D)  efficient attack strategy Many documented attacks: event-stream (2018), node-ipc (2022), XZ utils (2024), ... Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 19 / 34 Software supply chain attacks Reusing OSS via dependencies Software dependencies: a popular way of reusing open source software. Software product Auses functionalities implemented in OSS product B...and so on. based on xkcd.com/2347 Attacking the software supply chain Attacking undermaintained "leaf" packages (e.g., D)  efficient attack strategy Many documented attacks: event-stream (2018), node-ipc (2022), XZ utils (2024), ... Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 19 / 34 Securing open source with Software Heritage What does Software Heritage bring to the table? The largest archive that guarantees the: 1availability, 2integrity, and 3traceability of (OSS) source code. Auniversal, open knowledge base of facts about open source software... ...that can be leveraged by everyone (not only the big players) to secure OSS. SWHSec project swhsec.github.io 2023–2027 R&D project, funded by French national CampusCyber 8 research teams, including SWH core Axes: (1) extending SWH with security info + (2) code analysis, dependency analysis, vulnerability tracking, automatic vulnerability fixing, ... at SWH scale. Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 20 / 34 Securing open source with Software Heritage What does Software Heritage bring to the table? The largest archive that guarantees the: 1availability, 2integrity, and 3traceability of (OSS) source code. Auniversal, open knowledge base of facts about open source software... ...that can be leveraged by everyone (not only the big players) to secure OSS. SWHSec project swhsec.github.io 2023–2027 R&D project, funded by French national CampusCyber 8 research teams, including SWH core Axes: (1) extending SWH with security info + (2) code analysis, dependency analysis, vulnerability tracking, automatic vulnerability fixing, ... at SWH scale. Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 20 / 34 Securing open source with Software Heritage What does Software Heritage bring to the table? The largest archive that guarantees the: 1availability, 2integrity, and 3traceability of (OSS) source code. Auniversal, open knowledge base of facts about open source software... ...that can be leveraged by everyone (not only the big players) to secure OSS. SWHSec project swhsec.github.io 2023–2027 R&D project, funded by French national CampusCyber 8 research teams, including SWH core Axes: (1) extending SWH with security info + (2) code analysis, dependency analysis, vulnerability tracking, automatic vulnerability fixing, ... at SWH scale. Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 20 / 34 One-day vulnerabilities in open source One-day vulnerabilities Def.: vulnerabilities that are publicly known, but not fixed yet in software you use. Challenge: identify them quickly and exhaustively, then apply countermeasures. Many tools available to detect one-day vulnerabilities via declared dependencies. Reusing OSS via forks Open source is also reused via forking: (1) start from existing OSS (e.g., Teeworlds game), (2) create your own (e.g., DDnet), (3) periodically integrate changes. Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 21 / 34 One-day vulnerabilities in open source One-day vulnerabilities Def.: vulnerabilities that are publicly known, but not fixed yet in software you use. Challenge: identify them quickly and exhaustively, then apply countermeasures. Many tools available to detect one-day vulnerabilities via declared dependencies. Reusing OSS via forks Open source is also reused via forking: (1) start from existing OSS (e.g., Teeworlds game), (2) create your own (e.g., DDnet), (3) periodically integrate changes. Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 21 / 34 Vulnerability propagation through forks Any change to a piece of software (commit) can introduce a new vulnerability. Or it can fix an existing vulnerability. What happens if a project is forked between introduction and fix of a vulnerability? It inherits the vulnerability, ...until the change with the fix is integrated. Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 22 / 34 Vulnerability propagation through forks Any change to a piece of software (commit) can introduce a new vulnerability. Or it can fix an existing vulnerability. What happens if a project is forked between introduction and fix of a vulnerability? It inherits the vulnerability, ...until the change with the fix is integrated. Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 22 / 34 Vulnerability propagation through forks Any change to a piece of software (commit) can introduce a new vulnerability. Or it can fix an existing vulnerability. What happens if a project is forked between introduction and fix of a vulnerability? It inherits the vulnerability, ...until the change with the fix is integrated. Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 22 / 34 Open compliance vs Source code scanning Definition (Open Compliance) The pursuit of compliance with license obligations and other best practices for the management of open source software components, using only open technologies such as: open source software, open data information, and open access documentation. Why Reduced lock-in risks, lower total cost of ownership (TCO), crowdsourcing, alignment with FOSS community ethos. Q: Can we build an industry-grade source code scanning tool, compliant with Open Compliance principles, on top of Software Heritage? Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 26 / 34 SWH Scanner Vision swh-scanner is an open source and open data source code scanner for open compliance workflows, backed by the largest public archive of FOSS source code. Design Partition a source tree into known (= published before) v. unknown Provide provenance information on demand Software Heritage Archive as ground truth for public code Merkle DAG model and SWHIDs for maximum efficiency File-level granularity Code: gitlab.softwareheritage.org/swh/devel/swh-scanner (GPL 3+) Package: pypi.org/project/swh.scanner Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 27 / 34 Leveraging the Software Heritage data model for efficient scanning Merkle DAG Efficient scanning If a node (e.g., the root directory of a project) is known to the Software Heritage archive, all contained files and directories are known as well  no need to query for them! If a node is not known, we recurse to children and stop querying when reaching known nodes (e.g., embedded copies of 3rd party FOSS code or previous versions) Daniele Serafini, Stefano Zacchiroli Efficient Prior Publication Identification for Open Source Code OSS+OpenSym 2022. ACM 2022. https://hal.science/hal-03735961/ Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 28 / 34 Demo Setup $ pip install swh-scanner $ swh scanner setup $ swh scanner scan $PROJECT_PATH Demo Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 29 / 34 Demo Setup $ pip install swh-scanner $ swh scanner setup $ swh scanner scan $PROJECT_PATH Demo Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 29 / 34 swh-scanner demo — Efficiency $ du -sh --exclude=.git /srv/src/linux/git 4,1G /srv/src/linux/git $ time swh scanner scan /srv/src/linux Files: 78277 known: 78267 ( 99%) directories: 5085 fully-known: 5081 ( 99%) partially-known: 4 ( 0%) 38,65s user 4,71s system 81% cpu 53,127 total $ swh scanner scan --output-format ndjson /srv/src/linux/git | grep false ... {"scripts/kconfig/symbol.o": {"swhid": "swh:1:cnt:874f19...", "known": false}} ... Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 30 / 34 Outline 1Preface B_ignoreheading 2Source code as knowledge 3Software Heritage 4Highlight #1: The evolution of public code 5Highlight #2: Cross-fork 1-day vulnerabilities 6Highlight #3: Efficient open compliance 7What about AI? 8Conclusion Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 31 / 34 Can I train my AI on Software Heritage? Yes, but only in a principled way. Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 31 / 34 Can we build a state-of-the-art code-LLM that way? Anton Lozhkov et al. StarCoder 2 and The Stack v2: The Next Generation. arXiv:2402.19173, 2024 Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 32 / 34 Code Commons: A digital commons for responsible AI codecommons.org Stefano Zacchiroli Safer OSS supply chain with Software Heritage Jun 2025, Ada-Europe 33 / 34