Securing the Software Supply Chain with Software Heritage
Modern software is built on open source: an estimated 96% of products ship open source components. This ubiquity has turned the open source supply chain into a prime target for attackers, who increasingly compromise “leaf packages” - under-maintained, indirect dependencies buried deep in dependency trees, often looked after by lone volunteers without institutional backing. Incidents like the xz-utils backdoor have shown how fragile this foundation can be, and how high the stakes are for public administrations and critical infrastructure alike.
Software Heritage, the largest public archive of software source code, offers a unique vantage point on this problem: a universal, persistent, and independent record of the world’s source code and its complete development history. This talk presents the Software Heritage Security initiative (SWHSec), which leverages the archive as open infrastructure for supply chain security research and tooling: reliable software identification through intrinsic identifiers (SWHIDs), provenance tracking and integrity verification across code hosting platforms, and detection of malicious code injected into open source packages.
Attendees will leave with a concrete understanding of the current threat landscape of the open source supply chain, of how a universal source code archive changes what is possible in defending it, and of the open datasets and tools they can use today - whether they are researchers, maintainers, or public sector practitioners responsible for securing the software their organizations depend on.
Stefano Zacchiroli is full professor of computer science at Télécom Paris, Polytechnic Institute of Paris.
His current research interests span digital commons, open source software engineering, computer security, and the software supply chain.
He is co-founder and Chief Scientific Officer of Software Heritage, the largest public archive of software source code.
He is a former 3-times Debian project leader and a former board director of the Open Source Initiative (OSI).
He is recipient of several awards, including: the 2026 European Open Source Award, the 2022 Google Award for Inclusion Research, and the 2015 O'Reilly Open Source Award.