Pith. sign in

REVIEW 2 cited by

OmniBOR: A System for Automatic, Verifiable Artifact Resolution across Software Supply Chains

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2402.08980 v1 pith:DP5MOPTE submitted 2024-02-14 cs.SE cs.CR

Bharathi Seshadri , Yongkui Han , Chris Olson , David Pollak , Vojislav Tomasevic This is my paper · ORCID
classification cs.SEcs.CR
keywords softwareomniborartifactbuildprocessproductapproachattacks
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Software supply chain attacks, which exploit the build process or artifacts used in the process of building a software product, are increasingly of concern. To combat these attacks, one must be able to check that every artifact that a software product depends on does not contain vulnerabilities. In this paper, we introduce OmniBOR, (Universal Bill of Receipts) a minimalistic scheme for build tools to create an artifact dependency graph which can be used to track every software artifact incorporated into a built software product. We present the architecture of OmniBOR, the underlying data representations, and two implementations that produce OmniBOR data and embed an OmniBOR Identifier into built software, including a compiler-based approach and one based on tracing the build process. We demonstrate the efficacy of this approach on benchmarks including a Linux distribution for applications such as Common Vulnerabilities and Exposures (CVE) detection and software bill of materials (SBOM) computation.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. When Model Release Meets Model Reuse: Producer-Consumer Misalignment in Hugging Face

    cs.SE 2026-07 conditional novelty 7.0 of 10

    Producers and consumers of pre-trained models rely on the same documentation but systematically disagree on where metadata belongs, why lineage is traced, and which governance mechanisms help.

  2. Classport: Designing Runtime Dependency Introspection for Java

    cs.SE 2025-10 conditional novelty 7.0 of 10

    Classport embeds Maven dependency coordinates into Java class files as runtime annotations and uses a Java agent to report the dependencies actually executed during a run.

Pith tools