分析SLSA框架在软件供应链安全部署中的挑战
Analyzing Challenges in Deployment of the SLSA Framework for Software Supply Chain Security
AI总结：
本研究通过对GitHub上1523个SLSA相关问题的定性分析，识别出实施复杂、沟通不清晰等4大采用挑战及5项应对策略，旨在帮助改进SLSA框架的采用与发展以提升软件供应链安全。
摘要：
2023年，Sonatype报告软件供应链攻击增加了200%，包括重大构建基础设施攻击。为保障软件供应链安全，从业者可遵循如软件制品供应链级别（SLSA）等安全框架指南。然而，近期调查和行业峰会显示，尽管兴趣日益浓厚，SLSA的采用并不广泛。为了解采用挑战，本研究的目标是通过对GitHub上SLSA相关问题的定性研究，帮助框架作者和从业者改进SLSA的采用与发展。我们分析了从233个GitHub仓库中提取的1523个SLSA相关问题，利用潜在狄利克雷分配（LDA）无监督机器学习算法进行主题引导的主题分析，探索SLSA采用的挑战及克服策略。我们识别出4个主要挑战和5个建议采用策略，其中报告的两大主要挑战是复杂的实施和不清晰的沟通，突显了在不同生态系统中实施和理解SLSA流程的困难；建议策略包括简化溯源生成流程、改进SLSA验证流程及提供具体详细的文档。研究结果表明，部分策略可帮助缓解多个挑战，部分挑战则需要未来研究和工具增强。
英文摘要：
In 2023, Sonatype reported a 200\% increase in software supply chain attacks, including major build infrastructure attacks. To secure the software supply chain, practitioners can follow security framework guidance like the Supply-chain Levels for Software Artifacts (SLSA). However, recent surveys and industry summits have shown that despite growing interest, the adoption of SLSA is not widespread. To understand adoption challenges, \textit{the goal of this study is to aid framework authors and practitioners in improving the adoption and development of Supply-Chain Levels for Software Artifacts (SLSA) through a qualitative study of SLSA-related issues on GitHub}. We analyzed 1,523 SLSA-related issues extracted from 233 GitHub repositories. We conducted a topic-guided thematic analysis, leveraging the Latent Dirichlet Allocation (LDA) unsupervised machine learning algorithm, to explore the challenges of adopting SLSA and the strategies for overcoming these challenges. We identified four significant challenges and five suggested adoption strategies. The two main challenges reported are complex implementation and unclear communication, highlighting the difficulties in implementing and understanding the SLSA process across diverse ecosystems. The suggested strategies include streamlining provenance generation processes, improving the SLSA verification process, and providing specific and detailed documentation. Our findings indicate that some strategies can help mitigate multiple challenges, and some challenges need future research and tool enhancement.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
