Supply-Chain-Aligned Software Auditing and Usage Justification via Distributed Ledgers

We present a concept to document audit results of software artifacts, like compliance with standards or specifications, and usage justifications for dependencies as humanreadable and machine-evaluable policies in software bills of materials (SBOMs). To ensure that auditing results are readily available and reusable, we anchor policy-augmented SBOMs on a distributed ledger. We perform an empiric evaluation of the latency and costs involved in writing and reading anchoring data to and from Ethereum. Reading latency is mainly determined by the degree of optimization of the Ethereum node being queried, but remains mostly below 40 seconds.