Secure Software Compilation and Verification

Abstract

Prior to deployment, artifacts and / or binaries are generated from the dual-signed source code files by a process of compilation. Just prior to deployment, copies of the artifacts and / or binaries are created for the planned deployment and the dual-signed signatures are checked to ensure the integrity and security of the source code.

Description

[Technical field]

[0001] The present invention relates generally to the field of software compilation and also to software verification. [Background technology]

[0002] The Wikipedia entry on "compiler" (as of July 28, 2021) states that "In computing, a compiler is a computer program that translates computer code written in one programming language (the source language) into another language (the target language)." The name "compiler" is primarily used for programs that translate source code from a high-level programming language into a low-level language (e.g., assembly language, object code, or machine code) to create an executable program. There are many different kinds of compilers that produce output in different useful formats. Compilers that can run on computers with different CPUs or operating systems than the code they produce run on are called cross-compilers. Bootstrap compilers are written in the language they are intended to compile. Programs that translate from low-level to high-level languages ​​are decompilers. Programs that translate between high-level languages ​​are usually called source-to-source compilers or transcompilers. A language rewriter is a program that converts between forms of expression, usually without changing the language. The term compiler refers to the tools used to create parsers that perform syntactic analysis. A compiler is likely to perform many or all of the following operations: preprocessing, lexical analysis, syntactic analysis, semantic analysis (syntax-driven transformation), transformation of the input program into an intermediate representation, code optimization, and code generation. Compilers perform these operations in stages that promote efficient design and accurate transformation of source input to target output. Program failures caused by erroneous compiler behavior can be very difficult to track down and avoid, and thus compiler implementers expend a great deal of effort to ensure the correctness of their compilers. Compilers are not the only language processors used to transform source programs. An interpreter is computer software that translates and then executes the indicated operations. The transformation process influences computer language design, which leads to a preference for compilation or interpretation.In theory, a programming language can have both a compiler and an interpreter. In practice, programming languages ​​tend to be associated with only one (compiler or interpreter).

[0003] The Wikipedia entry on "Software Verification" (as of July 28, 2021) states, in part: "Software verification is a branch of software engineering whose goal is to ensure that software completely meets all expected requirements. It has a broad scope and classification[.]. A broad definition of verification equates it to software testing. There are then two basic approaches to verification: dynamic verification, also called experimentation, dynamic testing, or simply testing. It is suitable for finding defects (software bugs). Static verification, also called analysis or static testing, serves to prove the correctness of a program. However, it can result in false positives if there are one or more discrepancies between the processes that the software actually performs and the processes that static verification assumes."

[0004] These Wikipedia entries are made available under the Creative Commons Attribution-ShareAlike License 3.0 - https: / / en.wikipedia.org / wiki / Wikipedia:Text_of_Creative_Commons_Attribution-ShareAlike_3.0_Unported_License. Summary of the Invention

[0005] According to an aspect of the invention, there is a method, computer program product, or system, or combination thereof, for use with a compiler and a source file containing source code that performs the following operations (not necessarily in the following order): (i) signing the source file; (ii) editing the source file with a commit; (iii) in response to editing the source file with the commit, updating multiple signatures associated with the source file; (iv) receiving a request to compile at least a portion of the source code; and (v) in response to receiving the request, (a) verifying the multiple signatures; and (b) dual-signing the binaries and artifacts with the multiple signatures to compile at least a portion of the source code.

[0006] Preferred embodiments of the present invention will now be described, by way of example only, with reference to the following drawings, in which: [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a block diagram of a first embodiment of a system according to the present invention. [Diagram 2] FIG. 2 is a flow chart illustrating a first embodiment method performed at least in part by the first embodiment system. [Diagram 3] FIG. 2 is a block diagram showing the machine logic (e.g., software) portion of the system of the first embodiment. [Figure 4] FIG. 2 is a first flow chart illustrating a second embodiment of the method according to the invention; [Diagram 5] FIG. 2 is a second flow chart illustrating a second embodiment of the method according to the invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] This Detailed Description section is divided into the following subsections: (i) Hardware and Software Environment; (ii) Example Embodiments; (iii) Further Comments and / or Embodiments; and (iv) Definitions.

[0009] I. Hardware and Software Environment The invention may be a system, method, or computer program product, or combination thereof, at any possible level of technical detail of integration. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to perform aspects of the invention. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to perform aspects of the invention.

[0010] A computer readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves that allow instructions to be recorded thereon, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be construed as a transitory signal per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted through an electrical wire.

[0011] A "storage device" is defined herein as something made or adapted to store computer code in such a way that the computer code is accessible by a computer processor. A storage device typically includes a storage medium, which is the material in or on which computer code data is stored. A single "storage device" may (i) have multiple separate, spaced or distributed parts (e.g., a set of six solid-state storage devices each located in six laptop computers that collectively store a single computer program), or (ii) use multiple storage media (e.g., a set of computer code stored partially as magnetic domains in the computer's non-volatile storage and partially stored in a set of semiconductor switches in the computer's volatile memory), or both. The term "storage medium" should be interpreted to encompass situations in which multiple different types of storage media are used.

[0012] The computer readable program instructions described herein may be downloaded from the computer readable storage medium to the respective computing / processing device or to an external computer or storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer readable program instructions from the network and transfers the computer readable program instructions for storage in the computer readable storage medium in the respective computing / processing device.

[0013] The computer readable program instructions for carrying out the operations of the present invention may be either source or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, or object oriented programming languages ​​such as Smalltalk®, C++, and traditional procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer readable program instructions may execute completely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer readable program instructions by individualizing the electronic circuitry with state information of the computer readable program instructions to perform aspects of the invention.

[0014] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0015] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, generate means for performing the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions may also be stored in a computer readable storage medium such that the computer readable storage medium on which the instructions are stored comprises an article of manufacture including instructions for performing aspects of the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams, and may direct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner.

[0016] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to create a computer-implemented process, such that the instructions executing on the computer, other programmable apparatus, or other device perform the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0017] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions described in the blocks may occur out of the order described in the figures. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may be executed in the reverse order depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, may be implemented by a dedicated hardware-based system that performs the specified functions or operations, or executes a combination of dedicated hardware and computer instructions.

[0018] 1, networked computer system 100 is an embodiment of a hardware and software environment for use with various embodiments of the present invention. Networked computer system 100 includes a server subsystem 102 (sometimes more simply referred to herein as subsystem 102), client subsystems 104, 106, 108, 110, 112, and a communication network 114. Server subsystem 102 includes a server computer 200, a communication unit 202, a processor set 204, an input / output (I / O) interface set 206, a memory 208, persistent storage 210, a display 212, an external device 214, a random access memory (RAM) 230, a cache 232, and programs 300.

[0019] Subsystem 102 may be a laptop computer, a tablet computer, a netbook computer, a personal computer (PC), a desktop computer, a personal digital assistant (PDA), a smartphone, or any other type of computer (see the definition of "Computer" in the Definitions section below). Program 300 is a collection of machine-readable instructions and / or data used to create, manage, and control certain software functions described in detail below in the subsections of the Example Embodiments of this Detailed Description section.

[0020] Subsystem 102 can communicate with other computer subsystems via a communications network 114. Network 114 may be, for example, a local area network (LAN), a wide area network (WAN) such as the Internet, or a combination of the two, and may include wired, wireless, or fiber optic connections. In general, network 114 may be any combination of connections and protocols supporting communication between server and client subsystems.

[0021] Subsystem 102 is shown as a block diagram with many double-headed arrows. These double-headed arrows (without separate reference numbers) represent a communications fabric, which provides communication between various components of subsystem 102. This communications fabric may be implemented in any architecture designed to pass data and / or control information between processors (such as microprocessors, communications and network processors), system memory, peripheral devices, and any other hardware components in a computer system. For example, the communications fabric may be implemented, at least in part, with one or more buses.

[0022] Memory 208 and persistent storage 210 are computer-readable storage media. In general, memory 208 may include any suitable volatile or non-volatile computer-readable storage media. It is further noted that, currently or in the near future, or both, (i) external device 214 may be capable of providing some or all of the memory for subsystem 102, and / or (ii) devices external to subsystem 102 may be capable of providing memory to subsystem 102. Both memory 208 and persistent storage 210 (i) store data in a manner less transitory than signals in transit, and (ii) store data on tangible media (such as the magnetic or optical domain). In this embodiment, memory 208 is volatile storage and persistent storage 210 provides non-volatile storage. The media used by persistent storage 210 may also be removable. For example, a removable hard drive may be used for persistent storage 210. Other examples include optical and magnetic disks, thumb drives, and smart cards that are inserted into a drive for transfer onto another computer-readable storage medium that is also part of persistent storage 210.

[0023] The communications unit 202 provides for communication with other data processing systems or devices external to the subsystem 102. In these examples, the communications unit 202 includes one or more network interface cards. The communications unit 202 may provide communication through the use of either or both physical and wireless communications links. Any software modules described herein may be downloaded to a persistent storage device (such as persistent storage 210) through a communications unit (such as communications unit 202).

[0024] The I / O interface set 206 allows for input and output of data with other devices that may be locally connected in data communication with the server computer 200. For example, the I / O interface set 206 provides a connection to an external device set 214. The external device set 214 typically includes devices such as a keyboard, a keypad, a touch screen, or some other suitable input device, or a combination thereof. The external device set 214 may also include portable computer-readable storage media, such as, for example, thumb drives, portable optical or magnetic disks, and memory cards. Software and data used to practice embodiments of the present invention, such as the program 300, may be stored on such portable computer-readable storage media. The I / O interface set 206 also connects in data communication with a display 212. The display 212 is a display device that provides a mechanism for displaying data to a user, and may be, for example, a computer monitor or a smartphone display screen.

[0025] In this embodiment, the program 300 is stored in persistent storage 210 for access and / or execution by one or more computer processors of processor set 204, typically through one or more memories of memory 208. Those skilled in the art will appreciate that the program 300 may be stored in a more highly distributed manner during execution and / or when not executing. The program 300 may include both machine-readable and machine-executable instructions and / or tangible data (i.e., the type of data stored in a database). In this particular embodiment, persistent storage 210 includes a magnetic hard disk drive. To name a few possible variations, persistent storage 210 may include a solid-state hard drive, a semiconductor storage device, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, or any other computer-readable storage medium capable of storing program instructions or digital information.

[0026] The programs described herein are identified based on the application for which they are implemented in a particular embodiment of the invention. It should be understood, however, that any particular program name herein is used merely for convenience, and thus the invention should not be limited to use only in any particular application identified and / or suggested by such name.

[0027] The description of various embodiments of the present invention is presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terms used in this specification are selected to best explain the principles of the embodiments, practical applications, or technical improvements beyond the technology found in the market, or to enable other skilled in the art to understand the embodiments disclosed herein.

[0028] II. Example embodiments As shown in Figure 1, a networked computer system 100 is an environment in which an exemplary method in accordance with the present invention may be implemented. As shown in Figure 2, a flow chart 250 illustrates an exemplary method in accordance with the present invention. As shown in Figure 3, a program 300 performs or controls the execution of at least some of the operations of the method of flow chart 250. The method and associated software are now described in the following paragraphs with extensive reference to the blocks of Figures 1, 2, and 3.

[0029] The process begins at operation S255 where the source file signing module ("mod") 302 signs a source file that includes source code. The process proceeds to operation S260 where the source file editing module 304 edits the source file with a commit. The edit results in the generation of an updated signature associated with the source file. The process proceeds to operation S265 where the compiler 306 receives a request to compile at least a portion of the source code and validates the signature of the source file to be compiled. In response to successful validation of the signature of the source file, the process proceeds to operation S270 where the binary and artifact signing sub-module 308 dual-signs the binaries and artifacts. The process proceeds to operation S275 where the deployment module 310 receives a request to deploy copies of the binaries and artifacts. Processing continues to operation S280 where the binary and artifact signature verification submodule 312 validates the dual-signed signatures of the binaries and artifacts created for deployment to help determine that the source files are secure. Processing continues to operation S285 where, in response to validating the multiple signatures, the module 310 deploys copies of the binaries and artifacts to client subsystems 104 where the copies may be used with relative confidence regarding safety and integrity concerns.

[0030] In some embodiments of the invention, (i) a modified compiler compiles only signed source code that has a cryptographic relationship to the signature executed on the output binary to reduce scaling needs and provide strong cryptographic assurances, or (ii) signing is extended to source code files that are retrieved from a source code control system and provide output artifacts that bear the compiler's signature, or both.

[0031] III. Further Comments and / or Embodiments Some embodiments of the present invention recognize the following facts, potential problems, or possible areas of improvement, or a combination thereof, regarding the current state of the art: (i) there is a need for additional ways to reduce the attack surface for supply chain attacks, or (ii) there is a need for a way for vendors to detect attack indicators prior to shipping software to customers.

[0032] Some embodiments of the present invention may include one or more of the following operations, features, characteristics, or advantages, or combinations thereof: (i) using a modified compiler that compiles only signed source code that has a cryptographic relationship to the signature executed on the output binary; (ii) reducing the need for scaling; (iii) providing strong cryptographic assurances; (iv) enhancing signing of source code files retrieved from a source code control system; (v) outputting artifacts that bear the signature of the compiler used; or (vi) the above combined enhancements enabling greater external verification, including by customers of the resulting software after distribution, or any combination thereof.

[0033] Some embodiments of the present invention may include one or more of the following operations, features, characteristics, or advantages, or combinations thereof: (i) utilizing certificate chains and a modified compiler such that (a) source code used by the compiler may be verified as trusted, or (b) the compiler itself is trusted, or both; (ii) the process may be performed outside of a build engine; (iii) treating each source file as a separate signed entity and using that within the compiler to provide assurance that the compiled artifact is authentic and an accurate representation of the source; (iv) placing more emphasis on the path of the code after it is committed to a source code control system; or (v) a cryptographic relationship between the checked out code and the final deliverable; or combinations thereof.

[0034] A method according to an embodiment of the invention includes the following acts (not necessarily in this order): (i) protecting against supply chain attacks using a PKI (Public Key Infrastructure) where a keychain is used; (ii) signing source files to protect against tampering using a private key available only to the source control system; (iii) verifying the validity of the source file signatures by a compiler during compilation; (iv) reporting a warning in case of verification failure; (v) dual-signing binaries / executables by the compiler using a vendor compilation key; and (vi) ensuring that the compiler is trusted using a pre-built key shipped with the compiler.

[0035] Some embodiments of the present invention may include one or more of the following operations, features, characteristics, or advantages, or combinations thereof: (i) protecting source code from tampering in the build system by using a modified compiler; (ii) all source files in the system are signed using a vendor source code signing key; (iii) signatures are updated when files are edited through commits; (iv) the compiler verifies that source code has not been tampered with by checking the validity of the signature during compilation of the source code; (v) the compiler dual-signs generated binaries / artifacts using a vendor compilation signing key and a compiler built-in key; or (vi) the system checks the validity of the signature of binaries before deploying the software, or any combination thereof.

[0036] Some embodiments of the present invention may include one or more of the following operations, features, characteristics, or advantages, or combinations thereof: (i) enabling third-party verification of both the trusted compiler and the artifacts themselves resulting from the trusted source code; (ii) distributing security across multiple isolated systems such that a successful attack would require penetration of all; (iii) being usable by large companies that manufacture software for thousands of customers around the world, including large organizations and government agencies; (iv) providing protection against any malicious intrusion of software that may be harmful to customers and the company's reputation; or (v) including security practices to harden products against supply chain attacks, or any combination thereof.

[0037] Some embodiments of the invention may include one or more of the following actions, features, characteristics, or advantages or combinations thereof with respect to vendor protection: (i) a key chain is used to sign source code and resulting artifacts; or (ii) a chain is set up according to the following techniques, where each element of the chain is signed by the previous element in the chain: (a) a root - a global trusted authority; (b) intermediate - the start of an "n" successive intermediate tier; (c) intermediate - the end of an "n" successive intermediate tier; (d) vendor source code key - used to sign source code downloaded from the source code control system, where the private key for this is only available in the source code control system and signs the source code as close as possible to the first commit / push on the server side; and / or (e) vendor compilation key - used to sign compiled artifacts, where this is the only private key distributed on the build engine for access by the compiler.

[0038] Some embodiments of the invention may include one or more of the following actions, features, characteristics, or advantages, or combinations thereof, related to the compiler modification: (i) the compiler is pre-constructed with a compiler private key that is used to sign output artifacts; (ii) the compiler's public key is publicly known for verification; (iii) the compiler is configured with access to a vendor compilation key that is signed by a vendor source code key; (iv) the compiler is modified to access only source files that are signed by the same vendor source code key; (v) artifacts output by the compiler are subsequently signed by both the vendor compilation key and a compiler key; or (vi) a dual-signing process that enables verification that (a) the artifact was generated by a trusted compiler that was itself unmodified, or (b) the artifact was signed with a key derived only from unaltered signed source code files, or both, or combinations thereof.

[0039] In accordance with an embodiment of the present invention, we now describe detection of maliciously inserted code on a build machine. Consider a situation where malware such as Sunspot attempts to replace legitimate source code with malicious source code. When a compiler attempts to build a source file, it first performs a signature verification using the vendor source code public key. In case of a malicious source code file, this check will fail and the compiler will flag a warning and abort the build. Furthermore, if the compiler on the build engine is compromised and the above checks are removed, the signature verification (or lack of signature) on the output binary will identify that the output was not generated in a secure and trusted environment.

[0040] As shown in Fig. 4, a flow chart 400 of a build / CI (Continuous Integration) system with a modified compiler includes a block of build repository, a block of verifying all relevant source file signatures for each binary generated using a vendor source code public key, a block of verify failure (yes / no), a block of compiling to generate binaries and dual signing using a vendor compilation key and a compiler key, and a block of warning. The flow chart 400 in Fig. 4 is useful for understanding an embodiment of the present invention.

[0041] As shown in Figure 5, the Deploy Software (CD (Continuous Delivery)) flow chart 500 includes a Deploy Release block, a Verify Both Signatures for Each Binary using Vendor Compilation Public Key and Compiler Public Key block, a Verification Failed (Yes / No) Decision block, a Deploy Software block, and an Alert block. The flow chart 500 in Figure 5 is useful for understanding an embodiment of the present invention.

[0042] Some embodiments of the present invention may include one or more of the following operations, features, characteristics, or advantages, or combinations thereof: (i) signing source files with a private key accessible to a source code control system; (ii) providing for verification of the signature by the compiler during compilation; (iii) including dual signing of binaries by the compiler to ensure the compiler is trusted; (iv) focusing on signing source code by the source code control system at commit time; (v) verifying the signature as a prerequisite for compilation by the compiler; (vi) preventing source code tampering by ensuring that the source code is signed by a key accessible to the source code control system at commit time; (vii) the validity of the signature is verified by a compiler in the build system before compilation is performed; (viii) the compiler also dual signing artifacts to ensure a trusted compiler is used; (ix) focusing on signing source code at commit time with a key accessible to source code control; or (x) verifying the signature by the compiler before compilation, or combinations thereof.

[0043] IV. Definition The present invention: The subject matter described by the term "the present invention" should not be taken as an absolute indication that it is encompassed by either the claims as filed or the claims that may ultimately be issued after patent prosecution; the term "the present invention" is used to help the reader get a general feel for how the disclosures herein may be novel, but this understanding implied by the use of the term "the present invention" is tentative and provisional and is subject to change during the course of patent prosecution as relevant information is developed and the claims may be amended.

[0044] Embodiments: See definition of "present invention" above. An analogous remark applies to the term "embodiments."

[0045] And / or: Inclusive, or for example, A, B, "and / or" C means that at least one of A or B or C is true and applicable.

[0046] Including / Include / Includes: Unless expressly stated, means "including, but not necessarily limited to."

[0047] Module / Sub-Module: Any set of hardware, firmware, or software, or combination thereof, that operates operatively to perform any type of function, whether a module is (i) singly and locally proximate, (ii) widely distributed, (iii) singly and proximate within a larger body of software code, (iv) located within a single body of software code, (v) located in a single storage device, memory, or medium, (vi) mechanically connected, (vii) electrically connected, or (viii) connected in data communication, or any combination thereof.

[0048] Computer: Any device that has significant data processing capabilities and / or machine-readable instruction capabilities, including, but not limited to, desktop computers, mainframe computers, laptop computers, field programmable gate array (FPGA)-based devices, smart phones, personal digital assistants (PDAs), body worn or insertable computers, embedded computers, and application specific integrated circuit (ASIC)-based devices.

Claims

1. 1. A computer-implemented method for use with a compiler and a source file containing source code, comprising: signing said source file; Editing the source file by committing; updating a plurality of signatures associated with the source file in response to the editing of the source file by a commit; receiving a request to compile at least a portion of the source code; in response to said receiving said request; verifying the plurality of signatures; and and dual-signing binaries and artifacts with the multiple signatures to compile the at least some of the source code.

2. receiving a request to deploy at least one of the artifacts and the binaries generated from the source files; 2. The computer-implemented method of claim 1, further comprising validating the plurality of signatures to help determine that the source file is safe.

3. 3. The computer-implemented method of claim 2, further comprising deploying the binaries and the artifacts generated from the source files in response to the validation of the plurality of signatures.

4. 4. The computer-implemented method of claim 3, wherein the compiler is a modified compiler that compiles only signed source code that has a cryptographic relationship to a signature executed on an output binary to reduce scaling needs and provide strong cryptographic assurances.

5. 5. The computer-implemented method of claim 4, wherein signing extends to source code files retrieved from the source code control system and providing output artifacts bearing a signature of the compiler.

6. A computer program product, the computer program product being configured to cause a computer to carry out the method according to any one of claims 1 to 5.

7. 1. A computer system for use with a compiler and source files containing source code, comprising: A processor set; A set of storage devices; computer code collectively stored on said set of storage devices, said computer code including data and at least one of: signing said source file; editing said source file by committing; responsive to the editing of the source file by a commit, updating a number of signatures associated with the source file; receiving a request to compile at least a portion of the source code; in response to said receiving said request; verifying the plurality of signatures; dual-signing binaries and artifacts with the plurality of signatures and compiling the at least a portion of the source code; and instructions for causing a computer system to perform the steps of:

8. The computer code may further include: receiving a request to deploy at least one of the artifacts and the binaries generated from the source files; validating the plurality of signatures to help determine that the source file is secure; and 8. The computer system of claim 7, further comprising instructions for:

9. The computer code may further include:

10. The computer system of claim 8, further comprising instructions for performing an operation responsive to the validation of the plurality of signatures: deploying the binaries and the artifacts generated from the source files.

10. 10. The computer system of claim 9, wherein the compiler is a modified compiler that compiles only signed source code that has a cryptographic relationship to a signature executed on an output binary to reduce scaling needs and provide strong cryptographic assurances.

11. 11. The computer system of claim 10, wherein signing extends to source code files retrieved from the source code control system and providing output artifacts bearing a signature of the compiler.

Images