SWHSec: Leveraging Software Heritage to Enhance Cybersecurity
Abstract
Software Heritage collects publicly available source code from numerous software projects and tracks their ongoing development. The annual Software Heritage Summit and Symposium, which took place on January 29, 2025, at UNESCO Headquarters in Paris, provides a unique platform for academia, industry, and policymakers to discuss critical issues at the intersection of software, artificial intelligence, and society. Cybersecurity and regulationIn the era of heightened regulation, including the European Union’s Cyber Resilience Act (CRA), ensuring a robust and open infrastructure for software preservation and traceability is vital. Stricter global cybersecurity and compliance requirements pose challenges to the software ecosystem but also open pathways for innovation. Software Heritage, in partnership with UNESCO, provides the transparency, reliability, and long-term accessibility required to navigate these regulatory landscapes. This track will explore the intersection of policy, regulation, and technology, highlighting how open infrastructures safeguard public and private digital ecosystems.
Full text
SWHSec Leveraging Software Heritage to Enhance Cybersecurity R. Lefeuvre, C. Reux, Stefano Zacchiroli, O. Barais, B. Combemale Polytechnic Institute of Paris [email protected] 29 Jan 2025 Software Heritage Symposium UNESCO, Paris Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 1 / 8
Outline 1Open source supply chain security 2SWHSec 3Chasing one-day vulnerabilities across open source forks 4Conclusion Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 2 / 8
Open source security Open source software can be freely used, copied, and modified. Open Source Software (OSS) is everywhere Huge boost for innovation! (e.g., reduced time to market) 96% of (non-open) software products depend on open source (2022). Open source is at the heart of the global digital infrastructure. With great exposure comes great scrutiny... ...by both good and bad actors. OSS is more and more targeted by attackers. Increased policy attention to secure OSS, e.g.: US: Biden’s executive orders (2022, Jan 2025!) EU: CRA, progressively coming into effect Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 2 / 8
Open source security Open source software can be freely used, copied, and modified. Open Source Software (OSS) is everywhere Huge boost for innovation! (e.g., reduced time to market) 96% of (non-open) software products depend on open source (2022). Open source is at the heart of the global digital infrastructure. With great exposure comes great scrutiny... ...by both good and bad actors. OSS is more and more targeted by attackers. Increased policy attention to secure OSS, e.g.: US: Biden’s executive orders (2022, Jan 2025!) EU: CRA, progressively coming into effect Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 2 / 8
Software supply chain attacks Reusing OSS via dependencies Software dependencies: a popular way of reusing open source software. Software product Auses functionalities implemented in OSS product B...and so on. based on xkcd.com/2347 Attacking the software supply chain Attacking undermaintained "leaf" packages (e.g., D) efficient attack strategy Many documented attacks: event-stream (2018), node-ipc (2022), XZ utils (2024), ... Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 3 / 8
Software supply chain attacks Reusing OSS via dependencies Software dependencies: a popular way of reusing open source software. Software product Auses functionalities implemented in OSS product B...and so on. based on xkcd.com/2347 Attacking the software supply chain Attacking undermaintained "leaf" packages (e.g., D) efficient attack strategy Many documented attacks: event-stream (2018), node-ipc (2022), XZ utils (2024), ... Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 3 / 8
Outline 1Open source supply chain security 2SWHSec 3Chasing one-day vulnerabilities across open source forks 4Conclusion Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 4 / 8
Securing open source with Software Heritage What does Software Heritage bring to the table? The largest archive that guarantees the: 1availability, 2integrity, and 3traceability of (OSS) source code. Auniversal, open knowledge base of facts about open source software... ...that can be leveraged by everyone (not only the big players) to secure OSS. SWHSec project swhsec.github.io 2023–2027 R&D project, funded by French national CampusCyber 8 research teams, including SWH core Axes: (1) extending SWH with security info + (2) code analysis, dependency analysis, vulnerability tracking, automatic vulnerability fixing, ... at SWH scale. Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 4 / 8
Securing open source with Software Heritage What does Software Heritage bring to the table? The largest archive that guarantees the: 1availability, 2integrity, and 3traceability of (OSS) source code. Auniversal, open knowledge base of facts about open source software... ...that can be leveraged by everyone (not only the big players) to secure OSS. SWHSec project swhsec.github.io 2023–2027 R&D project, funded by French national CampusCyber 8 research teams, including SWH core Axes: (1) extending SWH with security info + (2) code analysis, dependency analysis, vulnerability tracking, automatic vulnerability fixing, ... at SWH scale. Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 4 / 8
Vulnerability propagation through forks Any change to a piece of software (commit) can introduce a new vulnerability. Or it can fix an existing vulnerability. What happens if a project is forked between introduction and fix of a vulnerability? It inherits the vulnerability, ...until the change with the fix is integrated. Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 6 / 8
swh-vuln: chasing one-day vulnerabilities across forks... at SWH scale Approach 1Start from a public DB of vuln. introduced/fixed in public commits (e.g., OSV.dev). 2"Color" the entire graph of public code development history with vulnerability info. Software Heritage is the only place where this can be done at the scale of all forks, across all public code, independently of specific development platforms. 3Inform maintainers of vulnerable forks. (After validation.) Early results Identified 2.2 M (million) forks of repositories referenced by OSV.dev, containing vulnerable commits; 1.3 M forks vulnerable in their most recent commit. 86.6 M vulnerable commits were specific to forks, not findable with current tools. Among 66 manually vetted cases, 5 confirmed vulnerabilities (1 critical). Romain Lefeuvre, Charly Reux, Stefano Zacchiroli, Olivier Barais, Benoit Combemale Chasing One-day Vulnerabilities Across Open Source Forks To appear, 2025. Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 7 / 8
swh-vuln: chasing one-day vulnerabilities across forks... at SWH scale Approach 1Start from a public DB of vuln. introduced/fixed in public commits (e.g., OSV.dev). 2"Color" the entire graph of public code development history with vulnerability info. Software Heritage is the only place where this can be done at the scale of all forks, across all public code, independently of specific development platforms. 3Inform maintainers of vulnerable forks. (After validation.) Early results Identified 2.2 M (million) forks of repositories referenced by OSV.dev, containing vulnerable commits; 1.3 M forks vulnerable in their most recent commit. 86.6 M vulnerable commits were specific to forks, not findable with current tools. Among 66 manually vetted cases, 5 confirmed vulnerabilities (1 critical). Romain Lefeuvre, Charly Reux, Stefano Zacchiroli, Olivier Barais, Benoit Combemale Chasing One-day Vulnerabilities Across Open Source Forks To appear, 2025. Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 7 / 8
Outline 1Open source supply chain security 2SWHSec 3Chasing one-day vulnerabilities across open source forks 4Conclusion Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 8 / 8
Conclusion Takeaways Open source software is everywhere and increasingly targeted by attackers. State-of-the-art tooling for identifying known vulnerability is limited in scope (specific platforms, specific ways of reusing code). We can leverage Software Heritage to discover unfixed vulnerabilities and improve open source security for everyone. The SWHSec project is working on this. Next steps: integration with the Software Heritage archive, public API. Contact Stefano Zacchiroli /stefano[email protected] /@[email protected] Stefano Zacchiroli SWHSec 2025-01-29, Software Heritage Symposium, UNESCO 8 / 8