Secure software compilation and software verification

Abstract

Prior to deployment, artifacts and / or binaries are generated from the dual-signed source code files by a process of compilation. Just prior to deployment, copies of the artifacts and / or binaries are created for the planned deployment and the dual-signed signatures are checked to ensure the integrity and security of the source code.

Description

Technical Field

[0001] The present invention generally relates to the field of software compilation and also relates to software verification.

Background Art

[0002] The Wikipedia entry for "compiler" (as of July 28, 2021) states that "in computing, a compiler is a computer program that translates computer code written in one programming language (source language) into another language (target language)." The term "compiler" is primarily used for programs that translate source code from a high-level programming language into a low-level language (e.g., assembly language, object code, or machine code) to create an executable program. There are many different types of compilers that produce output in different useful formats. A compiler that can run on a computer with a different CPU or operating system than the one on which the code it generates runs is called a cross-compiler. A bootstrap compiler is written in the language it is intended to compile. A program that translates from a low-level language to a high-level language is a decompiler. A program that translates between high-level languages ​​is usually called a source-to-source compiler or transcompiler. A language rewriter is a program that usually translates the form of expression without changing the language. The term compiler refers to a tool used to create a parser that performs syntactic analysis. Compilers are likely to perform many or all of the following operations: preprocessing, lexical analysis, syntactic analysis, semantic analysis (syntactic-driven transformation), transformation of the input program into an intermediate representation, code optimization, and code generation. Compilers perform these operations in stages that facilitate efficient design and accurate transformation from source input to target output. Program failures resulting from compiler erroneous behavior can be extremely difficult to track down and avoid, and therefore compiler implementers expend considerable effort to ensure compiler accuracy. Compilers are not the only language processors used to transform source programs. Interpreters are computer software that translate and then execute the instructed behavior. The transformation process influences computer language design, which in turn leads to a preference for compilation or interpretation.Theoretically, a programming language can have both a compiler and an interpreter. In practice, however, programming languages ​​tend to be associated with only one or the other (either a compiler or an interpreter).

[0003] The Wikipedia entry on "software verification" (as of July 28, 2021) includes the following: "Software verification is a field of software engineering whose purpose is to ensure that software fully meets all expected requirements. It has a broad scope and classification.[.] When verification is broadly defined, it is equivalent to software testing. In that case, there are two basic approaches to verification. Dynamic verification, also called experimentation, dynamic testing, or simply testing, is suitable for finding defects (software bugs). Static verification, also called analysis or static testing, helps to prove the correctness of a program. However, if there is one or more discrepancies between the process the software actually performs and the process assumed by static verification, it can result in false positives."

[0004] These Wikipedia entries are available under the Creative Commons Attribution-ShareAlike 3.0 License (https: / / en.wikipedia.org / wiki / Wikipedia:Text_of_Creative_Commons_Attribution-ShareAlike_3.0_Unported_License). [Overview of the project]

[0005] According to aspects of the present invention, there exists a compiler, a computer program product, or a system, or a combination thereof, for use with a source file containing source code, which performs the following operations (not necessarily in the following order): (i) signing a source file; (ii) editing a source file by committing; (iii) updating multiple signatures associated with a source file in response to editing a source file by committing; (iv) receiving a request to compile at least a portion of the source code; and (v) in response to receiving the request, (a) verifying the multiple signatures and (b) compiling at least a portion of the source code by double-signing the binary and artifacts with the multiple signatures.

[0006] Herein, preferred embodiments of the present invention will be described with reference to the following drawings, merely as examples. [Brief explanation of the drawing]

[0007] [Figure 1] This is a block diagram of a first embodiment of the system according to the present invention. [Figure 2] This is a flowchart illustrating the method of the first embodiment, which is at least partially performed by the system of the first embodiment. [Figure 3] This is a block diagram showing the machine logic (e.g., software) portion of the system according to the first embodiment. [Figure 4] This is a diagram of the first flowchart showing a second embodiment of the method according to the present invention. [Figure 5] This is a second flowchart illustrating a second embodiment of the method according to the present invention. [Modes for carrying out the invention]

[0008] The section on embodiments for carrying out this invention is divided into the following sub-sections: (i) Hardware and software environments, (ii) Examples of embodiments, (iii) Further comments or embodiments or both, and (iv) Definitions.

[0009] I. Hardware and Software Environment The present invention may be a system, method, or computer program product, or a combination thereof, at any possible level of technical detail of integration. A computer program product may include a computer-readable storage medium (or more mediums) having computer-readable program instructions thereon for causing a processor to perform an aspect of the present invention.

[0010] A computer-readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer-readable storage medium may, but is not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of those described above. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random-access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random-access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disks (DVDs), memory sticks, floppy(R) disks, mechanically encoded devices such as punch cards or grooved raised structures on which instructions are recorded, and any suitable combination of those described above. The computer-readable storage media used herein should not be interpreted as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmitting media (e.g., light pulses passing through optical fiber cables), or electrical signals transmitted through wires.

[0011] A “storage device” is defined here as anything made or adapted to store computer code in such a way that the computer code is accessible by a computer processor. A storage device typically includes a storage medium, which is a substance in which computer code data is stored, or on which it is stored. A single “storage device” may have (i) multiple separate or distributed parts (e.g., a set of six solid-state storage devices, each located in six laptop computers, storing a single computer program together), or (ii) multiple storage mediums (e.g., a set of computer code partially stored as magnetic domains in the computer’s non-volatile storage and partially stored in a set of semiconductor switches in the computer’s volatile memory), or both. The term “storage medium” should be interpreted to encompass situations in which multiple different types of storage mediums are used.

[0012] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device, or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface within each computing / processing device receives computer-readable program instructions from the network and transfers the computer-readable program instructions for storage on a computer-readable storage medium within each computing / processing device.

[0013] The computer-readable program instructions for performing the operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk(R) and C++, and conventional procedural programming languages ​​such as the C programming language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (for example, via the Internet using an Internet service provider). In some embodiments, for example, an electronic circuit including a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer-readable program instructions by individualizing the electronic circuit using state information of computer-readable program instructions in order to carry out aspects of the present invention.

[0014] Aspects of the present invention are described herein with reference to flowcharts or block diagrams, or both, of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block in a flowchart or block diagram, or both, and any combination of blocks in a flowchart or block diagram, or both, can be implemented by computer-readable program instructions.

[0015] These computer-readable program instructions may be provided to a general-purpose computer, a dedicated computer, or a processor of another programmable data processing device to create a machine, such that instructions executed by the processor of a computer or other programmable data processing device generate means for performing functions / operations specified in one or more blocks of a flowchart or block diagram, or both. Furthermore, these computer-readable program instructions may be stored on a computer-readable storage medium such that the storage medium containing the instructions includes a product containing instructions that perform modes of functions / operations specified in one or more blocks of a flowchart or block diagram, or both, and can instruct a computer, a programmable data processing device, or other device, or a combination thereof, to function in a particular manner.

[0016] Furthermore, computer-readable program instructions may be loaded onto a computer, other programmable device, or other device to create a computer execution process in which instructions executed on the computer, other programmable device, or other device perform functions / operations specified in one or more blocks of a flowchart or block diagram, or both, and cause the computer, other programmable device, or other device to execute a series of operational steps.

[0017] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible embodiments of the systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or part of an instruction containing one or more executable instructions for performing a specified logical function. In some alternative embodiments, the functions described within a block may occur in an order other than that shown in the drawings. For example, two consecutively shown blocks may actually be executed substantially simultaneously, or blocks may be executed in reverse order depending on the functionality involved. It should also be noted that each block in a block diagram or flowchart, or both, and any combination of blocks in a block diagram or flowchart, or both, may be implemented by a dedicated hardware-based system that performs a specified function or operation, or executes a combination of dedicated hardware and computer instructions.

[0018] As shown in Figure 1, the networked computer system 100 is an embodiment of a hardware and software environment for use with various embodiments of the present invention. The networked computer system 100 includes a server subsystem 102 (sometimes more simply referred to as subsystem 102 herein), client subsystems 104, 106, 108, 110, 112, and a communication network 114. The server subsystem 102 includes a server computer 200, a communication unit 202, a processor set 204, an input / output (I / O) interface set 206, memory 208, persistent storage 210, a display 212, an external device 214, random access memory (RAM) 230, a cache 232, and a program 300.

[0019] Subsystem 102 may be a laptop computer, tablet computer, netbook computer, personal computer (PC), desktop computer, personal digital assistant (PDA), smartphone, or any other type of computer (see the definition of “computer” in the following section on definitions). Program 300 is a collection of machine-readable instructions and / or data used to create, manage and control a software function, which is described in detail below in the subsection of Examples of Embodiments for Carrying Out the Invention.

[0020] Subsystem 102 can communicate with other computer subsystems via a communication network 114. The network 114 may be, for example, a local area network (LAN), a wide area network (WAN) such as the Internet, or a combination of both, and may include wired, wireless, or fiber optic connections. Generally, the network 114 may be any combination of protocols that support connectivity and communication between server and client subsystems.

[0021] Subsystem 102 is shown as a block diagram with many double-headed arrows. These double-headed arrows (without separate reference numbers) represent a communication fabric, which provides communication between the various components of subsystem 102. This communication fabric can be implemented in any architecture designed to pass data or control information, or both, between processors (such as microprocessors, communication and network processors), system memory, peripheral devices, and any other hardware components in the computer system. For example, the communication fabric can be implemented in at least part by one or more buses.

[0022] Memory 208 and persistent storage 210 are computer-readable storage media. Generally, memory 208 may include any suitable volatile or non-volatile computer-readable storage media. It should be further noted that currently or in the near future or both, (i) external device 214 may be able to supply some or all of the memory for subsystem 102, or (ii) a device external to subsystem 102 may be able to provide memory to subsystem 102, or both. Both memory 208 and persistent storage 210 store data in a less transient way than signals in transit and store data on a tangible medium (such as a magnetic or optical domain). In this embodiment, memory 208 is volatile storage and persistent storage 210 provides non-volatile storage. The medium used by persistent storage 210 may also be removable. For example, a removable hard drive may be used for persistent storage 210. Other examples include optical disks and magnetic disks, thumb drives, and smart cards that are inserted into a drive for transfer onto another computer-readable storage medium that is also part of persistent storage 210.

[0023] Communication unit 202 provides communication with other data processing systems or devices external to subsystem 102. In these examples, communication unit 202 includes one or more network interface cards. Communication unit 202 may provide communication through the use of either or both physical and wireless communication links. Any software module described herein may be downloaded to a persistent storage device (such as persistent storage 210) through a communication unit (such as communication unit 202).

[0024] The I / O interface set 206 enables data input and output with other devices that may be locally connected in data communication with the server computer 200. For example, the I / O interface set 206 provides a connection to an external device set 214. The external device set 214 typically includes devices such as a keyboard, keypad, touchscreen, or several other suitable input devices, or a combination thereof. The external device set 214 may also include portable computer-readable storage media such as a thumb drive, portable optical or magnetic disk, and memory card. Software and data used to practice embodiments of the present invention, such as program 300, may be stored on such portable computer-readable storage media. The I / O interface set 206 also connects in data communication with a display 212. The display 212 is a display device that provides a mechanism for displaying data to a user, and may be, for example, a computer monitor or a smartphone display screen.

[0025] In this embodiment, the program 300 is stored in the persistent storage 210 for access or execution or both by one or more computer processors of the processor set 204, typically through one or more memories of the memory 208. It should be understood by those skilled in the art that the program 300 may be stored in a more highly distributed manner, either during execution or when not in execution or both. The program 300 may include both machine-readable instructions and machine-executable instructions or entity data (i.e., the type of data stored in a database) or both. In this particular embodiment, the persistent storage 210 includes a magnetic hard disk drive. By way of some possible variations, the persistent storage 210 may include a solid-state hard drive, a semiconductor memory device, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, or any other computer-readable storage medium capable of storing program instructions or digital information.

[0026] The programs described herein are identified based on the applications implemented in particular embodiments of the present invention. However, the name of any particular program herein is merely used for convenience, and thus, it should be understood that the present invention should not be limited to use only in any particular application that is identified or suggested or both by such name.

[0027] The description of various embodiments of the present invention is presented for purposes of illustration, but is not intended to be exhaustive or to limit the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, the practical application, or a technical improvement over technologies found in the marketplace, or to enable other skilled artisans to understand the embodiments disclosed herein.

[0028] II. Examples of Embodiments As shown in Figure 1, the networked computer system 100 is an environment in which an exemplary method according to the present invention can be performed. As shown in Figure 2, the flowchart 250 illustrates an exemplary method according to the present invention. As shown in Figure 3, the program 300 performs or controls at least some executions of the operation of the method in flowchart 250. This method and the associated software are described here in the following paragraphs with extensive reference to the blocks in Figures 1, 2, and 3.

[0029] The process begins in operation S255, where the source file signing module ("mod") 302 signs the source files containing the source code. The process proceeds to operation S260, where the source file editing module 304 edits the source files by commit. This editing results in the generation of an updated signature associated with the source files. The process proceeds to operation S265, where the compiler 306 receives a request to compile at least a portion of the source code and verifies the validity of the signatures of the source files to be compiled. In response to the successful verification of the source file signatures, the process proceeds to S270, where the binary and artifact signing submodule 308 double-signs the binaries and artifacts. The process proceeds to operation S275, where the deployment module 310 receives a request to deploy copies of the binaries and artifacts. The process proceeds to operation S280, in which the binary and artifact signature verification submodule 312 verifies the validity of the double-signed signatures of the binaries and artifacts created for deployment in order to help determine that the source files are secure. The process proceeds to operation S285, in which, in response to the validity of the multiple signatures, module 310 deploys copies of the binaries and artifacts to the client subsystem 104 where the copies may be used, with relative confidence regarding security and integrity concerns.

[0030] In some embodiments of the present invention, (i) the modified compiler compiles only signed source code that has a cryptographic relationship to a signature performed on the output binary in order to reduce the need for scaling and provide strong cryptographic guarantees, or (ii) the signing is extended to source code files that are taken from a source code management system and provide an output artifact that is signed by the compiler, or both.

[0031] III. Further comments or embodiments or both Some embodiments of the present invention recognize, as facts, potential problems, or areas for improvement, or combinations thereof, relating to the current state of the art, that (i) there is a need for further methods to reduce the attack surface for supply chain attacks, or (ii) there is a need for methods for vendors to detect attack indicators before shipping software to customers, or both.

[0032] Some embodiments of the present invention may include, as a combination of the following operations, features, characteristics, or advantages: (i) using a modified compiler that compiles only signed source code having a cryptographic relationship to the signature performed on the output binary; (ii) reducing the need for scaling; (iii) providing strong cryptographic assurance; (iv) extending the signing of source code files retrieved from a source code management system; (v) outputting artifacts having the signature of the compiler used; or (vi) enabling greater external verification, including by the customer of the resulting software after distribution, as a combination of the above combined extensions.

[0033] Some embodiments of the present invention may include, as a combination of, one or more of the following actions, features, characteristics, or advantages: (i) utilizing a certificate chain and a modified compiler so that it can verify that (a) the source code used by the compiler is trusted, or (b) the compiler itself is trusted, or both; (ii) the process may be executed outside the build engine; (iii) treating each source file as a separate signed entity and using it within the compiler to give assurance that the compiled artifact is authentic and an exact representation of the source; (iv) placing greater emphasis on the path of the code after it has been committed to a source code management system; or (v) the cryptographic relationship between the checked-out code and the final artifact being an embodiment of the present invention.

[0034] A method according to an embodiment of the present invention includes the following actions (not necessarily in the following order): (i) protecting against supply chain attacks using a PKI (Public Key Infrastructure) in which a keychain is used; (ii) signing source files to protect against tampering using a private key available only to the source control system; (iii) having the compiler verify the validity of the source file signature during compilation; (iv) reporting a warning in case of verification failure; (v) having the compiler double-sign the binary / executable file using a vendor compilation key; and (vi) ensuring that the compiler is trusted using a pre-built key provided with the compiler.

[0035] Some embodiments of the present invention may include, as a combination of the following actions, features, characteristics, or benefits: (i) protecting source code from tampering in the build system by using a modified compiler; (ii) ensuring that all source files in the system are signed using a vendor source code signing key; (iii) updating the signature when a file is edited through commits; (iv) verifying that the source code has not been tampered with by having the compiler verify the validity of the signature during compilation of the source code; (v) having the compiler double-sign the binary / artifact produced using a vendor compilation signing key and a compiler-built-in key; or (vi) having the system verify the validity of the binary's signature before deploying the software; or a combination thereof.

[0036] Some embodiments of the present invention may include, as a combination of, one or more of the following operations, features, characteristics, or benefits: (i) enabling third-party verification of both trusted compilers and the artifacts themselves arising from trusted source code; (ii) distributing security across multiple isolated systems such that all must be penetrated for an attack to succeed; (iii) being usable by large companies that manufacture software for thousands of customers worldwide, including large organizations and government agencies; (iv) providing protection against any malicious intrusion of software that could be detrimental to customer and corporate reputation; or (v) including security practices to enhance products against supply chain attacks.

[0037] Some embodiments of the present invention may include, as a combination of the following operations, features, characteristics, or advantages relating to vendor protection, one or more of the following: (i) a key chain is used to sign source code and the resulting artifacts; or (ii) the chain setup follows the following techniques, where each element of the chain is signed by the previous element in the chain: (a) root - a global trust authority; (b) intermediate - the start of "n" consecutive intermediate layers; (d) intermediate - the end of "n" consecutive intermediate layers; (d) vendor source code key - used to sign source code downloaded from a source code management system, the private key for which is available only in the source code management system, and signs the source code as close as possible to the first commit / push on the server side; and / or (e) vendor compilation key - used to sign compiled artifacts, which is the only private key distributed on the build engine for compiler access; or both.

[0038] Some embodiments of the present invention may include, as a combination of the following behaviors, features, characteristics, or advantages relating to compiler modifications: (i) the compiler is pre-built with a compiler private key and used to sign output artifacts; (ii) the compiler's public key is known for verification; (iii) the compiler consists of access to a vendor compilation key signed by a vendor source code key; (iv) the compiler is modified to access only source files signed by the same vendor source code key; (v) the artifacts output by the compiler are subsequently signed by both the vendor compilation key and the compiler key; or (vi) a dual-signing process enables verification that (a) the artifact was generated by a trusted compiler that has not been modified itself, or (b) the artifact was signed with a key derived only from an untampered signed source code file, or both; or a combination thereof.

[0039] In accordance with embodiments of the present invention, the detection of maliciously inserted code in a build machine is described here. Consider a scenario in which malware such as Sunspot attempts to replace legitimate source code with malicious source code. When a compiler attempts to build a source file, it first performs signature verification using the vendor source code public key. In the case of a malicious source code file, this check fails, the compiler flags a warning, and aborts the build. Furthermore, if the compiler on the build engine is compromised and the above check is bypassed, signature verification (or lack thereof) on the output binary identifies that the output was not generated in a secure and trusted environment.

[0040] As shown in Figure 4, flowchart 400 of a build / CI (Continuous Integration) system with a modified compiler includes a block for building the repository, a block for verifying all associated source file signatures using the vendor source code public key for each generated binary, a verification failure (yes / no) determination block, a block for compiling and generating the binary and double-signing it using the vendor compilation key and compiler key, and a warning block. Flowchart 400 in Figure 4 helps to understand embodiments of the present invention.

[0041] As shown in Figure 5, the Deployment Software (CD (Continuous Delivery)) flowchart 500 includes a block for deploying the release, a block for verifying both signatures using the vendor-compiled public key and the compiler-published public key for each binary, a verification failure (yes / no) determination block, a block for deploying the software, and a warning block. The flowchart 500 in Figure 5 helps to understand embodiments of the present invention.

[0042] Some embodiments of the present invention may include, as a combination of the following actions, features, characteristics, or advantages: (i) signing source files using a private key that has access to a source code management system; (ii) providing signature verification by the compiler during compilation; (iii) including double-signing of binaries by the compiler to ensure that the compiler is trusted; (iv) emphasizing signing source code by the source code management system at commit time; (v) verifying the signature as a requirement for compilation by the compiler; (vi) preventing tampering with source code by ensuring that the source code is signed with a key that has access to the source code management system at commit time; (vii) verifying the validity of the signature by the compiler in the build system before compilation is performed; (viii) the compiler also double-signs the artifact to ensure that a trusted compiler is used; (ix) emphasizing signing source code at commit time with a key that has access to source code management; or (x) verifying the signature by the compiler before compilation; or a combination thereof.

[0043] IV. Definition The present invention: The term “the present invention” should not be taken as an absolute indication that the subject matter described by the term “the present invention” is encompassed by either the claims at the time of filing or the claims that may ultimately be issued after patent examination. The term “the present invention” is used to help the reader get a general sense of what the disclosures herein may be novel, but this understanding indicated by the use of the term “the present invention” is temporary and provisional and may change during the patent examination process, as relevant information may be developed and the claims may be amended.

[0044] Embodiments: See the definition of "the present invention" above. Similar cautionary notes apply to the term "embodiments."

[0045] and / or: comprehensive, or for example, A, B, "and / or" C means that at least one of A, B, or C is true and applicable.

[0046] Including / include / includes: Unless explicitly stated otherwise, this means "includes, but not necessarily limited to."

[0047] Module / Submodule: Any set of hardware, firmware, or software, or any combination thereof, that is operational to perform any kind of function, regardless of whether it is (i) in local proximity on its own, (ii) widely distributed, (iii) in proximity on its own within a large part of software code, (iv) located within a single part of software code, (v) located in a single storage device, memory, or medium, (vi) mechanically connected, (vii) electrically connected, or (viii) connected by data communication.

[0048] Computer: Any device having significant data processing capabilities or machine-readable instruction reading capabilities, or both, including but not limited to desktop computers, mainframe computers, laptop computers, field-programmable gate array (FPGA)-based devices, smartphones, personal digital assistants (PDAs), wearable or implantable computers, embedded computer devices, and application-specific integrated circuit device (ASIC)-based devices.

Claims

1. A computer implementation for use with a compiler and a source file containing source code, Signing the aforementioned source file, By committing, the aforementioned source files are edited, In response to the editing of the source file by the aforementioned commit, Updating multiple signatures associated with the aforementioned source file, Receiving a request to compile at least a portion of the aforementioned source code, In response to the aforementioned receipt of the aforementioned request, Verifying the aforementioned updated multiple signatures, In response to the successful verification of the aforementioned updated multiple signatures, By compiling at least a portion of the aforementioned source code, a binary and artifacts are generated. The process involves using a vendor compilation key to perform a first signature on the binary and the artifact, The process involves using a compiler key to perform a second signature on the binary and the artifact, A computer implementation method, including

2. Receiving a request to deploy at least one of the artifact and binary generated from the source file, The computer implementation method according to claim 1, further comprising verifying the validity of the first signature and the second signature in order to help determine that the source file is secure.

3. The computer implementation method according to claim 2, further comprising deploying the binary and artifact generated from the source file in response to the validation of the first signature and the second signature.

4. The computer implementation method according to claim 3, wherein the compiler is a modified compiler that compiles only signed source code that has cryptographic relationships to signatures performed on the output binary, in order to reduce the need for scaling and provide strong cryptographic guarantees.

5. The computer implementation method according to claim 4, wherein signing is extended to a source code file that is retrieved from the source code management system and provides an output artifact having the compiler's signature.

6. A computer program for causing a computer to perform the method according to any one of claims 1 to 5.

7. A computer system for use with a compiler and a source file containing source code, Processor set and A set of memory devices, Computer code stored together in the aforementioned set of storage devices, The computer code includes data and at least the processor set, The operation of signing the aforementioned source file, The action of editing the aforementioned source file by committing, In response to the editing of the source file by the aforementioned commit, The operation of updating multiple signatures associated with the aforementioned source file, The operation of receiving a request to compile at least a portion of the aforementioned source code, In response to receiving the aforementioned request, The operation of verifying the updated multiple signatures, In response to the successful verification of the aforementioned updated multiple signatures, The operation of generating binaries and artifacts by compiling at least a portion of the aforementioned source code, An operation to perform a first signature on the binary and the artifact using a vendor compilation key, An operation to perform a second signature on the binary and the artifact using the compiler key, Including an order to carry out, Computer system.

8. The computer code is provided to the processor set, An operation to receive a request to deploy at least one of the artifact and binary generated from the source file, The computer system according to claim 7, further comprising instructions for performing an operation to verify the validity of the first signature and the second signature in order to help determine that the source file is secure.

9. The computer code is provided to the processor set, The computer system according to claim 8, further comprising instructions for causing the system to deploy the binary and artifact generated from the source file in response to the validation of the first and second signatures.

10. The computer system according to claim 9, wherein the compiler is a modified compiler that compiles only signed source code that has cryptographic relationships to signatures performed on the output binary, in order to reduce the need for scaling and to provide strong cryptographic guarantees.

11. The computer system according to claim 10, wherein signing is extended to source code files that are retrieved from the source code management system and provide output artifacts bearing the compiler's signature.

Images