A Longitudinal Study of Usability in Identity-Based Software Signing

• URL: http://arxiv.org/abs/2603.17133v1
• Date: Tue, 17 Mar 2026 20:53:46 GMT
• Title: A Longitudinal Study of Usability in Identity-Based Software Signing
• Abstract summary: Identity-based software signing tools aim to make software artifact provenance while reducing the operational burden of long-lived key management.<n>There is limited cross-tool longitudinal evidence about which usability problems arise in practice.<n>We conducted the first mining-software-repositories study of five identity-based signing ecosystems.
• Score: 13.315105014043423
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Identity-based software signing tools aim to make software artifact provenance verifiable while reducing the operational burden of long-lived key management. However, there is limited cross-tool longitudinal evidence about which usability problems arise in practice and how those problems evolve as tools mature. This gap matters because unusable signing and verification workflows can lead to incomplete adoption, misconfiguration, or skipped verification, undermining intended integrity guarantees. We conducted the first mining-software-repositories study of five open-source identity-based signing ecosystems: Sigstore, OpenPubKey, HashiCorp Vault, Keyfactor, and Notary v2. We analyzed approximately 3,900 GitHub issues from Nov. 2021 to Nov. 2025. We coded each issue for the reported usability concern and the implicated architectural component, and compared patterns across tools and over time. Across ecosystems, reported concerns concentrate in verification workflows, policy and configuration surfaces, and integration boundaries. Longitudinal Poisson trend analysis shows substantial declines in reported issues for most ecosystems. However, across usability themes, workflow- and documentation-related concerns decline unevenly across tools and concern types, and verification workflows and configuration surfaces remain persistent friction points. These results indicate that identity-based signing reduces some usability burdens while relocating complexity to verification semantics, policy configuration, and deployment integration. Designing future signing ecosystems therefore requires treating verification semantics and release workflows as first-class usability targets rather than peripheral integration concerns.

Related papers

• Automating Static Code Analysis Through CI/CD Pipeline Integration [0.8206562651760948]
  This paper addresses the pervasive challenge of identifying and rectifying security vulnerabilities early in the development process.<n>We propose a novel process for aggregating SAST tool outputs and integrating them into developers' familiar issue-tracking software.<n>We demonstrate the successful implementation of the proposed process with the SonarQube SAST tool in a GitLab-based development environment.
  arXiv  Detail & Related papers  (2026-09-01T03:53:25Z)
• ScrambleToolBench: Agents Search Exhaustively Even When Their Own Map Points to the Next Step [74.83535434786145]
  We introduce ScrambleToolBench, an interactive terminal benchmark designed to isolate behavioral reasoning.<n>The benchmark requires agents to uncover hidden tool behaviors entirely through trial-and-error interaction.<n>Our evaluation of state-of-the-art language models reveals that successful initial discovery does not translate into robust adaptation.
  arXiv  Detail & Related papers  (2026-08-03T15:07:46Z)
• Beyond the YAML File: Understanding Real-World GitHub Actions Workflow Adoption [3.1994648513393873]
  GitHub Actions (GHA) are emerging as a dominant automation platform.<n>We quantitatively analyze 258,300 workflow run records from 952 repositories to understand how maintainers and contributors interact with workflow results.<n>We identify three distinct failure response patterns, observe that higher usage of GHA correlates with lower failure rates, and uncover a configuration-usage gap.
  arXiv  Detail & Related papers  (2026-04-19T23:23:59Z)
• Dynamic analysis enhances issue resolution [53.50448142467294]
  DAIRA (Dynamic Analysis-enhanced Issue Resolution Agent) is an automated repair framework that embeds dynamic analysis into the agent's reasoning cycle.<n> Driven by a Test Tracing-Driven methodology, DAIRA utilizes lightweight monitors to extract critical runtime data.<n>When powered by Gemini 3 Flash Preview, DAIRA establishes a new state-of-the-art (SOTA) performance, achieving a 79.4% resolution rate on the SWE-bench Verified dataset.
  arXiv  Detail & Related papers  (2026-03-23T14:48:54Z)
• EvoClaw: Evaluating AI Agents on Continuous Software Evolution [47.49468375065129]
  We introduce DeepCommit, an agentic pipeline that reconstructs verifiable Milestone DAGs from noisy commit logs.<n>These executable sequences enable EvoClaw, a novel benchmark that requires agents to sustain system integrity and limit error accumulation.
  arXiv  Detail & Related papers  (2026-03-13T03:20:40Z)
• Why Does the LLM Stop Computing: An Empirical Study of User-Reported Failures in Open-Source LLMs [50.075587392477935]
  We conduct the first large-scale empirical study of 705 real-world failures from the open-source DeepSeek, Llama, and Qwen ecosystems.<n>Our analysis reveals a paradigm shift: white-box orchestration relocates the reliability bottleneck from model algorithmic defects to the systemic fragility of the deployment stack.
  arXiv  Detail & Related papers  (2026-01-20T06:42:56Z)
• Overcoming Joint Intractability with Lossless Hierarchical Speculative Decoding [58.92526489742584]
  We propose provably lossless.<n> verification method that significantly boosts the expected number of accepted tokens.<n>We show that HSD yields consistent improvements in acceptance rates across diverse model families and benchmarks.
  arXiv  Detail & Related papers  (2026-01-09T11:10:29Z)
• Process-based Indicators of Vulnerability Re-Introducing Code Changes: An Exploratory Case Study [2.204918347869259]
  This work highlights the critical role of process metrics along with code changes in understanding and mitigating vulnerability reintroduction.<n>Our approach emphasizes that reintroduction is rarely the result of one isolated action, but emerges from cumulative development activities and socio-technical conditions.
  arXiv  Detail & Related papers  (2025-10-30T16:45:36Z)
• Automated Vulnerability Validation and Verification: A Large Language Model Approach [7.482522010482827]
  This paper introduces an end-to-end multi-step pipeline leveraging generative AI, specifically large language models (LLMs)<n>Our approach extracts information from CVE disclosures in the National Vulnerability Database.<n>It augments it with external public knowledge (e.g., threat advisories, code snippets) using Retrieval-Augmented Generation (RAG)<n>The pipeline iteratively refines generated artifacts, validates attack success with test cases, and supports complex multi-container setups.
  arXiv  Detail & Related papers  (2025-09-28T19:16:12Z)
• Predicting Abandonment of Open Source Software Projects with An Integrated Feature Framework [15.50732865972961]
  Open Source Software (OSS) is a cornerstone of contemporary software development, yet the increasing prevalence of OSS project abandonment threatens global supply chains.<n>In this work, we address these challenges by reliably detecting OSS project abandonment through a dual approach: explicit archival status and rigorous semantic analysis of project documentation or description.<n>Building on this foundation, we introduce an integrated, multi-perspective feature framework for abandonment prediction, capturing user-centric, maintainer-centric, and project evolution features.<n>Our work provides reproducible, scalable, and practitioner-oriented support for understanding and managing abandonment risk in large OSS ecosystems.
  arXiv  Detail & Related papers  (2025-07-29T10:45:24Z)
• Why Johnny Signs with Next-Generation Tools: A Usability Case Study of Sigstore [10.88933151812096]
  We conducted a usability study of Sigstore, a pioneering and widely adopted exemplar of next-generation signing.<n>We examined (1) the problems and advantages associated with practitioners' tooling choices, (2) how and why their signing-tool usage has evolved over time, and (3) the contexts that cause usability concerns.<n>Our findings illuminate the usability factors of next-generation signing tools and yield recommendations for toolmakers, adopting organizations, and the research community.
  arXiv  Detail & Related papers  (2025-03-01T00:59:18Z)
• Understanding the Challenges of Deploying Live-Traceability Solutions [45.235173351109374]
  SAFA.ai is a startup focusing on fine-tuning project-specific models that deliver automated traceability in a near real-time environment. This paper describes the challenges that characterize commercializing software traceability and highlights possible future directions.
  arXiv  Detail & Related papers  (2023-06-19T14:34:16Z)
• Analyzing Maintenance Activities of Software Libraries [55.2480439325792]
  Industrial applications heavily integrate open-source software libraries nowadays.<n>I want to introduce an automatic monitoring approach for industrial applications to identify open-source dependencies that show negative signs regarding their current or future maintenance activities.
  arXiv  Detail & Related papers  (2023-06-09T16:51:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.