An Industry Interview Study of Software Signing for Supply Chain Security
summary
Eighteen semi‑structured interviews across 13 organizations produce a refined software factory model that maps where signatures are created versus where they are verified, with saturation reached at interview 11. Findings show signatures are frequently created but often not verified, with technical, organizational, and human barriers (key management, tooling gaps, weak incentives), large firms reporting operationalization pain, and practitioners split between treating signing as crucial, secondary, or compliance‑driven. Recommendations: fix verification tooling and align incentives.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:14Supply chain security background
- 3:45Software signing state
- 7:18Research questions and method
- 8:20Data collection and demographics
- 10:46Modified signing factory model
- 12:54Signing implementation challenges
- 15:02Importance of software signing
- 16:05Recommendations and future work
- 17:14Conclusion
related talks
32mSoftware Supply Chain Security
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
08mKeynote: Approaching the SBOM: Best Practice for Software Supply Chain Security
14mKeynote: The Next Steps in Software Supply Chain Security
22mTop 5 Reasons (and 5 Myths Debunked) to Invest in Securing the Software Supply Chain
25mLet’s Talk Software Supply Chains with TAG Security
23mMastering Secure Software Supply Chains
34mFrom development to release: Protecting the software supply chain