{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T12:21:54Z","timestamp":1783513314402,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":49,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,4,12]],"date-time":"2026-04-12T00:00:00Z","timestamp":1775952000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CCF-1941816"],"award-info":[{"award-number":["CCF-1941816"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,4,12]]},"DOI":"10.1145\/3786582.3786799","type":"proceedings-article","created":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T11:52:47Z","timestamp":1783511567000},"page":"1-5","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Build Code is Still Code: Finding the Antidote for Pipeline Poisoning"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-0780-743X","authenticated-orcid":false,"given":"Brent","family":"Pappas","sequence":"first","affiliation":[{"name":"University of Central Florida, Orlando, Florida, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1425-8873","authenticated-orcid":false,"given":"Paul","family":"Gazzillo","sequence":"additional","affiliation":[{"name":"University of Central Florida, Orlando, Florida, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,7,8]]},"reference":[{"key":"e_1_3_3_2_2_2","unstructured":"Anonymous. 2024. OpenZFS. https:\/\/openzfs.org\/wiki\/Main_Page."},{"key":"e_1_3_3_2_3_2","unstructured":"Apple Inc.2024. XNU. https:\/\/github.com\/apple-oss-distributions\/xnu."},{"key":"e_1_3_3_2_4_2","doi-asserted-by":"publisher","unstructured":"Thomas Ball Vladimir Levin and Sriram\u00a0K. Rajamani. 2011. A decade of software model checking with SLAM. Commun. ACM 54 7 (July 2011) 68\u201376. 10.1145\/1965724.1965743","DOI":"10.1145\/1965724.1965743"},{"key":"e_1_3_3_2_5_2","doi-asserted-by":"publisher","unstructured":"Michael Buckland and Fredric Gey. 1994. The relationship between Recall and Precision. Journal of the American Society for Information Science 45 1 (1994) 12\u201319. 10.1002\/(SICI)1097-4571(199401)45:1<12::AID-ASI2>3.0.CO;2-L","DOI":"10.1002\/(SICI)1097-4571(199401)45:1<12::AID-ASI2>3.0.CO;2-L"},{"key":"e_1_3_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1145\/502034.502042"},{"key":"e_1_3_3_2_7_2","unstructured":"CMake. 2024. https:\/\/cmake.org."},{"key":"e_1_3_3_2_8_2","unstructured":"Lasse Collin. 2025. xz. https:\/\/github.com\/tukaani-project\/xz\/."},{"key":"e_1_3_3_2_9_2","unstructured":"Felipe Contreras. 2024. xz backdoor and autotools insanity. https:\/\/felipec.wordpress.com\/2024\/04\/04\/xz-backdoor-and-autotools-insanity\/."},{"key":"e_1_3_3_2_10_2","unstructured":"Correct Computation Inc.2021. 3C. https:\/\/github.com\/correctcomputation\/checkedc-clang\/."},{"key":"e_1_3_3_2_11_2","unstructured":"Russ Cox. 2024. The xz attack shell script. https:\/\/research.swtch.com\/xz-script."},{"key":"e_1_3_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1002\/9780470146354.ch2"},{"key":"e_1_3_3_2_13_2","series-title":"(WOOT\u201920)","volume-title":"Proceedings of the 14th USENIX Conference on Offensive Technologies","author":"Fioraldi Andrea","year":"2020","unstructured":"Andrea Fioraldi, Dominik Maier, Heiko Ei\u00dffeldt, and Marc Heuse. 2020. AFL++: combining incremental steps of fuzzing research. In Proceedings of the 14th USENIX Conference on Offensive Technologies(WOOT\u201920). USENIX Association, USA, Article 10, 1\u00a0pages."},{"key":"e_1_3_3_2_14_2","unstructured":"Martin Fowler. 2024. Continuous Integration. https:\/\/martinfowler.com\/articles\/continuousIntegration.html."},{"key":"e_1_3_3_2_15_2","unstructured":"Free Software Foundation Inc.2023. GNU make. https:\/\/www.gnu.org\/software\/make\/manual\/make.html."},{"key":"e_1_3_3_2_16_2","unstructured":"Free Software Foundation Inc.2024. C Preprocessor. https:\/\/gcc.gnu.org\/onlinedocs\/cpp\/."},{"key":"e_1_3_3_2_17_2","unstructured":"Free Software Foundation Inc.2024. GNU autoconf. https:\/\/www.gnu.org\/software\/autoconf\/."},{"key":"e_1_3_3_2_18_2","unstructured":"Free Software Foundation Inc.2024. GNU Coreutils. https:\/\/www.gnu.org\/software\/coreutils\/coreutils.html."},{"key":"e_1_3_3_2_19_2","unstructured":"Free Software Foundation Inc.2024. GNU Make. https:\/\/www.gnu.org\/software\/make\/."},{"key":"e_1_3_3_2_20_2","unstructured":"Free Software Foundation Inc.2024. Standard Targets for Users. https:\/\/www.gnu.org\/software\/make\/manual\/html_node\/Standard-Targets.html."},{"key":"e_1_3_3_2_21_2","unstructured":"Alp Gasimov. 2024. Exclusive: \u2019We will see more attacks\u2019 Ledger CTO warns after NPM breach."},{"key":"e_1_3_3_2_22_2","unstructured":"Omer Gil and AsierRF. 2022. CICD-SEC-4: Poisoned Pipeline Execution (PPE). https:\/\/owasp.org\/www-project-top-10-ci-cd-security-risks\/CICD-SEC-04-Poisoned-Pipeline-Execution."},{"key":"e_1_3_3_2_23_2","first-page":"653","volume-title":"12th USENIX Symposium on Operating Systems Design and Implementation (OSDI 16)","author":"Gu Ronghui","year":"2016","unstructured":"Ronghui Gu, Zhong Shao, Hao Chen, Xiongnan\u00a0(Newman) Wu, Jieung Kim, Vilhelm Sj\u00f6berg, and David Costanzo. 2016. CertiKOS: An Extensible Architecture for Building Certified Concurrent OS Kernels. In 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI 16). USENIX Association, Savannah, GA, 653\u2013669. https:\/\/www.usenix.org\/conference\/osdi16\/technical-sessions\/presentation\/gu"},{"key":"e_1_3_3_2_24_2","unstructured":"Immunant. 2024. C2Rust. https:\/\/github.com\/immunant\/c2rust?tab=readme-ov-file."},{"key":"e_1_3_3_2_25_2","unstructured":"John\u00a0Stawinski IV. 2024. Playing with Fire \u2013 How We Executed a Critical Supply Chain Attack on PyTorch. https:\/\/johnstawinski.com\/2024\/01\/11\/playing-with-fire-how-we-executed-a-critical-supply-chain-attack-on-pytorch\/."},{"key":"e_1_3_3_2_26_2","unstructured":"Sam James. 2024. FAQ on the xz-utils backdoor (CVE-2024-3094). https:\/\/gist.github.com\/thesamesam\/223949d5a074ebc3dce9ee78baad9e27."},{"key":"e_1_3_3_2_27_2","unstructured":"Daniel Krivelevich and Omer Gil. 2024. OWASP Top 10 CI\/CD Security Risks. https:\/\/owasp.org\/www-project-top-10-ci-cd-security-risks\/."},{"key":"e_1_3_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-02658-4_38"},{"key":"e_1_3_3_2_29_2","unstructured":"Michael Larabel. 2024. Timed LLVM Compilation. https:\/\/openbenchmarking.org\/test\/pts\/build-llvm."},{"key":"e_1_3_3_2_30_2","doi-asserted-by":"crossref","unstructured":"Xavier Leroy. 2009. Formal verification of a realistic compiler. Commun. ACM 52 7 (2009) 107\u2013115. http:\/\/xavierleroy.org\/publi\/compcert-CACM.pdf","DOI":"10.1145\/1538788.1538814"},{"key":"e_1_3_3_2_31_2","volume-title":"Software Security: Building Security in","author":"McGraw G.","year":"2006","unstructured":"G. McGraw. 2006. Software Security: Building Security in. Addison-Wesley, Boston, Massachusetts. https:\/\/books.google.com\/books?id=HCQdypbpZXgC"},{"key":"e_1_3_3_2_32_2","unstructured":"Microsoft Research. 2021. 3C. https:\/\/github.com\/Microsoft\/checkedc\/."},{"key":"e_1_3_3_2_33_2","unstructured":"Sarthak Misraa and Antonio Pirozzi. 2024. XZ Utils Backdoor | Threat Actor Planned to Inject Further Vulnerabilities. https:\/\/www.sentinelone.com\/blog\/xz-utils-backdoor-threat-actor-planned-to-inject-further-vulnerabilities\/."},{"key":"e_1_3_3_2_34_2","unstructured":"U.\u00a0S. Government\u00a0Accountability Office. 2021. SolarWinds Cyberattack Demands Significant Federal and Private-Sector Response (infographic). https:\/\/www.gao.gov\/blog\/solarwinds-cyberattack-demands-significant-federal-and-private-sector-response-infographic."},{"key":"e_1_3_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468578"},{"key":"e_1_3_3_2_36_2","unstructured":"OpenSFS and EOFS. 2024. Lustre. https:\/\/www.lustre.org\/."},{"key":"e_1_3_3_2_37_2","unstructured":"OpenSSL. 2024. OpenSSL. https:\/\/www.openssl.org\/."},{"key":"e_1_3_3_2_38_2","unstructured":"Red Hat. 2024. CVE-2024-3094. https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2024-3094."},{"key":"e_1_3_3_2_39_2","doi-asserted-by":"publisher","unstructured":"Thomas Reps. 1998. Program analysis via graph reachability1An abbreviated version of this paper appeared as an invited paper in the Proceedings of the 1997 International Symposium on Logic Programming [84].1. Information and Software Technology 40 11 (1998) 701\u2013726. 10.1016\/S0950-5849(98)00093-7","DOI":"10.1016\/S0950-5849(98)00093-7"},{"key":"e_1_3_3_2_40_2","unstructured":"Rust Team. 2022. rust. https:\/\/github.com\/rust-lang\/rust."},{"key":"e_1_3_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-17465-1_22"},{"key":"e_1_3_3_2_42_2","series-title":"(SEC\u201917)","first-page":"167","volume-title":"Proceedings of the 26th USENIX Conference on Security Symposium","author":"Schumilo Sergej","year":"2017","unstructured":"Sergej Schumilo, Cornelius Aschermann, Robert Gawlik, Sebastian Schinzel, and Thorsten Holz. 2017. kAFL: hardware-assisted feedback fuzzing for OS kernels. In Proceedings of the 26th USENIX Conference on Security Symposium (Vancouver, BC, Canada) (SEC\u201917). USENIX Association, USA, 167\u2013182."},{"key":"e_1_3_3_2_43_2","volume-title":"Software Build Systems: Principles and Experience","author":"Smith Peter","year":"2011","unstructured":"Peter Smith. 2011. Software Build Systems: Principles and Experience. O\u2019Reilly Media, Santa Rosa, California."},{"key":"e_1_3_3_2_44_2","unstructured":"systemd. 2024. systemd. https:\/\/github.com\/systemd\/systemd."},{"key":"e_1_3_3_2_45_2","unstructured":"The Apache Software Foundation. 2024. Apache webserver. https:\/\/httpd.apache.org\/."},{"key":"e_1_3_3_2_46_2","unstructured":"The FreeBSD Project. 2024. FreeBSD. https:\/\/www.freebsd.org\/."},{"key":"e_1_3_3_2_47_2","unstructured":"The Linux Kernel Organization. 2024. The Linux Kernel. https:\/\/www.kernel.org."},{"key":"e_1_3_3_2_48_2","unstructured":"The OpenBSD Foundation. 2024. OpenSSH. https:\/\/www.openssh.com\/."},{"key":"e_1_3_3_2_49_2","unstructured":"Dmitry Vyukov. 2023. syzkaller. https:\/\/github.com\/google\/syzkaller."},{"key":"e_1_3_3_2_50_2","volume-title":"Grokking Continuous Delivery","author":"Wilson Christie","year":"2022","unstructured":"Christie Wilson. 2022. Grokking Continuous Delivery. Manning, Shelter Island, NY 11964."}],"event":{"name":"ICSE-NIER '26: 2026 IEEE\/ACM 48th International Conference on Software Engineering","location":"Rio de Janeiro Brazil","acronym":"ICSE-NIER '26","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the IEEE\/ACM 48th International Conference on Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3786582.3786799","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T11:53:42Z","timestamp":1783511622000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3786582.3786799"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,12]]},"references-count":49,"alternative-id":["10.1145\/3786582.3786799","10.1145\/3786582"],"URL":"https:\/\/doi.org\/10.1145\/3786582.3786799","relation":{},"subject":[],"published":{"date-parts":[[2026,4,12]]},"assertion":[{"value":"2026-07-08","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}