ARMS: A Vision for Actor Reputation Metric Systems in the Open-Source Software Supply Chain
Abstract
Many critical information technology and cyber-physical systems rely on a supply chain of open-source software projects. OSS project maintainers often integrate contributions from external actors. While maintainers can assess the correctness of a pull request, assessing a pull request's cybersecurity implications is challenging. To help maintainers make this decision, we propose that the open-source ecosystem should incorporate Actor Reputation Metrics (ARMS). This capability would enable OSS maintainers to assess a prospective contributor's cybersecurity reputation. To support the future instantiation of ARMS, we identify seven generic security signals from industry standards; map concrete metrics from prior work and available security tools, describe study designs to refine and assess the utility of ARMS, and finally weigh its pros and cons.
Keywords
Cite
@article{arxiv.2505.18760,
title = {ARMS: A Vision for Actor Reputation Metric Systems in the Open-Source Software Supply Chain},
author = {Kelechi G. Kalu and Sofia Okorafor and Betül Durak and Kim Laine and Radames C. Moreno and Santiago Torres-Arias and James C. Davis},
journal= {arXiv preprint arXiv:2505.18760},
year = {2026}
}