AI 中文总结
本研究通过对38名从业者的访谈，分析软件供应链中信任侵蚀的现状，提出从业者可通过自动化验证等方式应对上升的信任成本，为构建良好供应链提供概念支持。
AI 中文摘要
软件供应链正变得日益复杂，人工智能（AI）正在重塑其威胁格局，例如引发了对AI生成依赖项质量的担忧。从信任的角度来看，软件供应链中信任侵蚀的风险很高，但我们缺乏关于从业者信任的经验基准。本研究的目标是通过对38名从业者的访谈研究，帮助软件从业者在软件供应链信任演变过程中采取明智的行动。我们对工业界和开源领域的从业者进行了半结构化访谈，重点关注他们的实际偏好（即他们采用的控制措施）而非其陈述的态度，并利用社会科学中已确立的信任概念对数据进行主题分析。我们发现信任正在侵蚀，这一过程的成本越来越高：知情的从业者正在积累控制措施。为应对上升的信任成本，从业者会自动化验证流程、将信任决策委托给“信任守护者”（guardians），或考虑完全退出软件供应链。通过信任视角理解软件供应链动态，为塑造未来干预措施提供了术语和概念（例如信任守护者、系统信任、信号），以构建一个具有适当信任水平、运行良好的供应链。
英文摘要
The software supply chain is becoming more complex, and AI is reshaping its threat landscape, e.g., raising concerns about the quality of AI-generated dependencies. Seen through the lens of trust, the stakes of eroding trust in the software supply chain are high, yet we lack an empirical baseline on practitioners' trust. The goal of this study is to aid software practitioners in taking informed actions as trust in the software supply chain evolves, through an interview study with 38 practitioners. We conducted semi-structured interviews with industry and open-source practitioners, focusing on their revealed preferences (the controls they adopted) rather than their stated attitudes, and analyzed the data using thematic analysis grounded in established trust concepts from the social sciences. We find that trust is eroding, which is becoming costly: aware practitioners are accumulating controls. To cope with the rising cost of trust, practitioners automate verification, delegate trust decisions to guardians, or consider exiting the software supply chain entirely. Understanding software supply chain dynamics through the lens of trust provides the vocabulary and concepts (e.g., guardians of trust, system trust, signals) to shape future interventions for a well-functioning supply chain with appropriate levels of trust.
