{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,5]],"date-time":"2026-10-05T20:21:30Z","timestamp":1791231690715,"version":"4.1.0"},"reference-count":34,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,8]]},"DOI":"10.1109\/rew72749.2026.00036","type":"proceedings-article","created":{"date-parts":[[2026,9,16]],"date-time":"2026-09-16T19:14:16Z","timestamp":1789586056000},"page":"185-193","source":"Crossref","is-referenced-by-count":1,"title":["A Stage-Aware Requirements-To-Evidence Framework for Secure CI\/CD Pipelines"],"prefix":"10.1109","author":[{"given":"Sabbir M.","family":"Saleh","sequence":"first","affiliation":[{"name":"Computer Science, University of Western Ontario","place":["London, ON, Canada"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nazim H.","family":"Madhavji","sequence":"additional","affiliation":[{"name":"Computer Science, University of Western Ontario","place":["London, ON, Canada"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"John","family":"Steinbacher","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-218"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2022.106894"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.23055"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3510457.3513044"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2024.112063"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/ISRE.1995.512555"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/s00766-005-0016-3"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2016.08.005"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134015"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2007.70754"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/ICWS.2017.13"},{"key":"ref12","first-page":"1393","article-title":"in-toto: Providing farm-to-table guarantees for bits and bytes","volume-title":"Proc. 28th USENIX Security Symposium","author":"Torres-Arias","year":"2019"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1007\/s00766-004-0194-4"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1142\/S0218194007003240"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2016.12.034"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.5220\/0013018500003825"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ciot63799.2024.10757084"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/658"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338931"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510155"},{"key":"ref21","article-title":"OpenSSF","volume-title":"Supply-chain Levels for Software Artifacts","year":"2026"},{"key":"ref22","article-title":"OWASP","volume-title":"OWASP Top 10 CI\/CD Security Risks","year":"2026"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3689938.3694779"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/snpd-winter67015.2024.00020"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ICRE.1994.292398"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1007\/11576280_3"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-35873-9_18"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-68738-9_13"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME64153.2025.00101"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.5220\/0013298200003928"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CloudCom67567.2025.11331540"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3785520.3785526"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3785520.3785525"},{"key":"ref34","article-title":"Toward stage-aware container security in CI\/CD: A practical review","volume-title":"Proc. Int. Conf. Systems Engineering","author":"Saleh","year":"2025"}],"event":{"name":"2026 IEEE 34th International Requirements Engineering Conference Workshops (REW)","location":"Montreal, QC, Canada","start":{"date-parts":[[2026,8,17]]},"end":{"date-parts":[[2026,8,21]]}},"container-title":["2026 IEEE 34th International Requirements Engineering Conference Workshops (REW)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11677728\/11677769\/11677806.pdf?arnumber=11677806","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,17]],"date-time":"2026-09-17T06:45:17Z","timestamp":1789627517000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11677806\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8]]},"references-count":34,"URL":"https:\/\/doi.org\/10.1109\/rew72749.2026.00036","relation":{},"subject":[],"published":{"date-parts":[[2026,8]]}}}