Searcharxiv⌕ Search
Home/Archive/arXiv

arXiv · 2409.05014

Analyzing Challenges in Deployment of the SLSA Framework for Software Supply Chain Security

Mahzabin Tamanna·Sivana Hamer·Mindy Tran·Sascha Fahl·Yasemin Acar·Laurie Williams
View original source ↗Read source document ↗Export metadata ↓

Abstract

In 2023, Sonatype reported a 200\% increase in software supply chain attacks, including major build infrastructure attacks. To secure the software supply chain, practitioners can follow security framework guidance like the Supply-chain Levels for Software Artifacts (SLSA). However, recent surveys and industry summits have shown that despite growing interest, the adoption of SLSA is not widespread. To understand adoption challenges, \textit{the goal of this study is to aid framework authors and practitioners in improving the adoption and development of Supply-Chain Levels for Software Artifacts (SLSA) through a qualitative study of SLSA-related issues on GitHub}. We analyzed 1,523 SLSA-related issues extracted from 233 GitHub repositories. We conducted a topic-guided thematic analysis, leveraging the Latent Dirichlet Allocation (LDA) unsupervised machine learning algorithm, to explore the challenges of adopting SLSA and the strategies for overcoming these challenges. We identified four significant challenges and five suggested adoption strategies. The two main challenges reported are complex implementation and unclear communication, highlighting the difficulties in implementing and understanding the SLSA process across diverse ecosystems. The suggested strategies include streamlining provenance generation processes, improving the SLSA verification process, and providing specific and detailed documentation. Our findings indicate that some strategies can help mitigate multiple challenges, and some challenges need future research and tool enhancement.

Explore related subjects

cs.CEcs.SE

Keep this discovery

BibTeXRIS

Mahzabin Tamanna, Sivana Hamer, Mindy Tran, Sascha Fahl, Yasemin Acar, Laurie Williams. 2024-09-08. Analyzing Challenges in Deployment of the SLSA Framework for Software Supply Chain Security. https://arxiv.org/abs/2409.05014

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

A Framework for Discharge Time Prediction of Energy Storage Units Based on Coupled Dynamics and Multi-Factor Aging Models

This paper presents a physically interpretable framework for predicting time to empty (TTE) in portable embedded systems. The framework couples usage-driven load-power decomposition, electrical power-voltage-current closure, a semi-empirical aging model, and SOC-temperature dynamics. Smartphone telemetry is mapped to battery current through an interpretable load model and conversion-efficiency correction. Battery capacity loss is modeled by combining Arrhenius temperature dependence, SEI diffusion behavior, and cycle-related power-law degradation. The coupled dynamic model then predicts TTE under different initial SOC values, ambient temperatures, and usage profiles. Chronological hold-out evaluation on a 6.9-h smartphone discharge session yielded a current RMSE of 0.0095 $\pm$ 0.0006 A, a temperature RMSE of 2.93 $\pm$ 0.24$^\circ$C, and a TTE MAPE of 4.81 $\pm$ 0.61%. Evaluation on NASA cell B0005 produced a capacity-loss RMSE of 0.031 Ah. Baseline, ablation, and counterfactual analyses further illustrate the contributions of thermal and aging corrections and the relative influence of load features. The results demonstrate the feasibility and interpretability of the proposed framework, while broader validation across devices and batteries remains necessary.

cs.CE↗
arXiv2026

Node-Shift-Encoding Genetic Algorithm with fuzzy-enhanced reference tour to solve the bi-objective service-oriented TSP

The Travelling Salesman Problem (TSP) remains a key area of research in combinatorial optimization, with applications in logistics, manufacturing, and service delivery. This paper addresses a bi-objective service-oriented TSP in which the clients' ranks in the delivery path matter. Unlike conventional depot-based TSP formulations, the considered problem does not assume a distinguished depot or a fixed tour origin. To address this setting, we adapt the Miller--Tucker--Zemlin (MTZ)-based formulation and derive an original linearization of the resulting model, enabling its solution with off-the-shelf integer linear programming solvers. This adaptation avoids the rigid tour origin imposed by the conventional MTZ formulation, for which fixing the starting node does not affect the tour cost but can affect the objective in a customer-rank-sensitive TSP. To solve this problem, we present a Node-Shift-Encoding (NSE)-based Genetic Algorithm augmented with fuzzy reasoning to update the reference tour throughout the evolutionary process. Experimental evaluation on TSPLIB benchmarks demonstrates that the proposed method achieves improved performance compared with the classical NSE approach.

cs.CE↗
arXiv2026

Geometric organization of olfactory descriptor data in the Poincar\'e disk

Odor quality is commonly represented using high dimensional descriptor profiles, yet their low dimensional organization remains unclear. We investigated whether a two-dimensional hyperbolic embedding can provide an interpretable representation of this structure. We applied hyperbolic metric multidimensional scaling to two complementary datasets: 480 Sagar rating profiles from three participants rating 160 odorants on 15 continuous descriptors, and 4983 GoodScents--Leffingwell molecules annotated with 138 binary descriptors. The embeddings substantially preserved pairwise descriptor distances, supporting subsequent analyses of radial and angular organization. In Sagar, rating profile entropy was strongly and negatively associated with hyperbolic radius, with diffuse profiles closer to the center and concentrated profiles closer to the boundary. This radial organization emerged primarily at the level of the full descriptor profile, rather than any individual descriptor, and remained robust across alternative descriptor representations, participant specific analyses, and averaged ratings. Sweet, musky, fruity, pleasantness showed the strongest directional trends. In GoodScents--Leffingwell, active label entropy, reflecting descriptor multiplicity, increased with radius, whereas orthogonalized descriptor entropy, reflecting spread across orthogonal modes, decreased with radius. Related binary descriptors occupied coherent localized high-density regions. These findings reveal complementary radial and angular organization in the hyperbolic representation of olfactory descriptor data. They support hyperbolic mapping as an interpretable descriptive framework in which radius summarizes global profile properties, while the angular component captures continuous descriptor gradients and categorical organization.

cs.CE↗