DECENTRALIZED, IMMUTABLE, TAMPER-EVIDENT, DIRECTED ACYCLIC GRAPHS DOCUMENTING SOFTWARE SUPPLY-CHAINS WITH CRYPTOGRAPHICALLY SIGNED RECORDS OF SOFTWARE-DEVELOPMENT LIFE CYCLE STATE AND CRYPTOGRAPHIC DIGESTS OF EXECUTABLE CODE

摘要

Provided is a process that includes: traversing, with one or more processors, a constituency graph of a software asset and accessing corresponding trust records of a plurality of the software assets of the constituency graph visited by traversing the constituency graph, the trust records being published to a tamper-evident, immutable, decentralized data store; and for each respective constituent software asset among the plurality of constituent software assets visited by traversing, assessing, with one or more processors, trustworthiness of the respective software asset based on the corresponding trust record of the respective software asset.