ESSTRA: A Software Suite To Enhance Software Transparency and Traceability in Software Supply Chain
summary
ESSTRA is a GCC plugin that records source filenames and hashes during compilation and embeds structured YAML SBOM data into a dedicated .estra ELF section, extractable with the included Python utility estra-ut and already supported by Binary Analysis Next Generation (BANG). A Debian feasibility run on 187 packages shows ~350,000 source files map to only ~30,000 compiled files — about 8.8% actually included in binaries. Features include post-build update/remove via estra-ut and SPDX/SPX-compatible hashing (SHA1 default, SHA256 supported); linker-plugin and reproducible-path normalization are in progress.
AI-written summary · about
chapters (14)
- 0:00ESTRA introduction
- 1:05Project background and goals
- 3:56Software transparency challenges
- 6:26ESTRA development reasons
- 8:59ESTRA design concepts
- 10:26ESTRA compilation process
- 15:06GCC plugin technical details
- 18:21OpenSSL use case
- 22:01ESTRA impact on Debian
- 23:03ESTRA open source reasons
- 24:11Availability and Debian packaging
- 25:39Future ESTRA plans
- 28:34Acknowledgments
- 29:26Q&A
related talks
53mTooling Up for SPDX Software Package Data Exchange
49mLicensing Support by Build Systems and What Remains To Be Done- 49mLicensing Support by Build Systems and What Remains To Be Done
26mAn OSS project's attempt to secure it's supply chain
23mSupply Chain Security using Free and Open Tools
46mAdvancing Transparency and Security in Software: A Deep Dive Into SPDXv3
28mSPDX: Tackling System Risk in Modern Supply Chains
36mBuilding the Digital Commons for Software Supply Chain