AgOSS：开源农业软件的数据集与多层表征

中文摘要 AI 辅助

农业很大程度上依赖开源软件，涵盖农场管理平台、云服务、边缘网关、嵌入式系统及现场部署的传感器，形成了一个领域特定的软件供应链，却很少受到实证安全关注。目前尚不明确该生态系统的供应链安全态势是否与同类非农业软件存在差异，若存在差异，该差异是反映农业领域特性还是项目的规模与成熟度所致。为推进开源农业软件的安全保障，我们构建了AgOSS，这是一个包含6个架构类别的66个仓库的数据集。我们通过OpenSSF Scorecard、治理指标、基于SBOM的依赖分析及KEV匹配，评估该数据集内的供应链安全，并与匹配的非农业对照组进行比较。我们报告两项发现：第一，治理在很大程度上独立于继承的依赖风险；Scorecard追踪社区活动，但我们未检测其与漏洞数量、漏洞密度或已知被利用漏洞数量存在关联，回归分析中，暴露信号加载于架构类别而非领域。第二，农业项目在原始Scorecard上得分低得多，但规模和成熟度混淆了这一差距：匹配和回归后，残差失去显著性。保障该生态系统的安全需要投入贡献者能力和依赖卫生，而非农业特定的控制措施。

英文摘要

Much of agriculture depends on open-source software spanning farm management platforms, cloud services, edge gateways, embedded systems, and field-deployed sensors, forming a domain-specific software supply chain that has drawn little empirical security attention. It is unknown whether this ecosystem's supply chain security posture differs from that of comparable non-agricultural software, and if it does, whether the difference reflects the agricultural domain or the size and maturity of the projects within it. As a step towards securing agricultural open-source software, we present AgOSS, a dataset of 66 repositories across six architectural categories. We assess supply chain security within the dataset via OpenSSF Scorecard, governance metrics, SBOM-based dependency analysis, and KEV matching, and compare against matched non-agricultural controls. We report two findings. First, governance is largely independent of inherited dependency risk. Scorecard tracks community activity, but we detect no association with vulnerability count, density, or known-exploited count, and in regression the exposure signal loads on architectural category rather than domain. Second, agricultural projects score far lower on raw Scorecard, but size and maturity confound the gap: the residual loses significance under matching and regression. Securing this ecosystem means investing in contributor capacity and dependency hygiene, not agriculture-specific controls.

发表机构

• Purdue University（普渡大学）

机构由 AI 辅助整理，请以论文原文为准。