Integrity of portable executables in deployment packages

A computing system for use with a package repository including software packages that include source portable and linkable executable files, the computing system comprising:

• a mapping database;
• one or more hardware processors;
• and
• one or more storage devices having stored computer-executable instructions that are executable by the one or more hardware processors for configuring the computing system to perform the following:
• populating the mapping database by, for each of a plurality of the source portable and linkable executable files having a file format:
• calculating a hash value of a pre-defined subset of sections of the source portable and linkable executable file, the pre-defined subset defined for the file format and including some of and fewer than all of the sections specified by the file format;
• and
• storing, in the mapping database, the calculated hash value in association with (a) an identifier of the source portable and linkable executable file and (b) an identifier of the software package of the source portable and linkable executable file,
• for at least a portion of deployed portable and linkable executable files that are included in a deployment package and have the file format:
• calculating a hash value of the pre-defined subset of the sections of the deployed portable and linkable executable file,
• looking up the calculated hash value of the deployed portable and linkable executable file in the mapping database,
• if the calculated hash value is found in the mapping database, triggering a rule associated with a status of the software package containing the source portable and linkable executable file corresponding, based on the calculated hash value, to the deployed portable and linkable executable file, and
• if the calculated hash value is not found in the mapping database, triggering a not-found rule,
• populate a status indication data structure with respective status indicators for the software packages, each of the status indicators selected from a prespecified list of status indicators, and
• associate respective rules with the status indicators,
• wherein the computer-executable instructions are further executable for configuring the computing system to, for each of the deployed portable and linkable executable files for which the hash value was found in the mapping database, trigger the rule associated with the status indicator of the software package containing the source portable and linkable executable file corresponding, based on the calculated hash value, to the deployed portable and linkable executable file.

A computer-implemented method for use with a package repository including software packages that include source portable and linkable executable files, the method comprising:

• populating a mapping database by, for each of a plurality of the source portable and linkable executable files having a file format:
• calculating a hash value of a pre-defined subset of sections of the source portable and linkable executable file, the pre-defined subset defined for the file format and including some of and fewer than all of the sections specified by the file format;
• and
• storing, in the mapping database, the calculated hash value in association with (a) an identifier of the source portable and linkable executable file and (b) an identifier of the software package of the source portable and linkable executable file:
• generating a software bill of materials (SBOM) for a deployment package that includes deployed portable and linkable executable files, by, for at least a portion of the deployed portable and linkable executable files having the file format:
• calculating a hash value of the pre-defined subset of the sections of the deployed portable and linkable executable file,
• looking up the calculated hash value of the deployed portable and linkable executable file in the mapping database,
• if the calculated hash value is found in the mapping database, creating an entry in the SBOM that includes at least:
• (a) an identifier of the deployed portable and linkable executable file,
• (b) an identifier of the source portable and linkable executable file corresponding, based on the calculated hash value, to the deployed portable and linkable executable file, and
• (c) an identifier of the software package containing the source portable and linkable executable file, and
• if the calculated hash value is not found in the mapping database, creating an entry in the SBOM that includes at least:
• (a) an identifier of the deployed portable and linkable executable file, and
• (b) an indicator that the deployed portable and linkable executable file is not associated with any of the software packages contained in the package repository.

A computing system for use with a package repository including software packages that include source portable and linkable executable files, the computing system comprising:

• a mapping database;
• one or more hardware processors;
• and
• one or more storage devices having stored computer-executable instructions that are executable by the one or more hardware processors for configuring the computing system to perform the following:
• populating the mapping database by, for each of a plurality of the source portable and linkable executable files having a file format:
• calculating a hash value of a pre-defined subset of sections of the source portable and linkable executable file, the pre-defined subset defined for the file format and including some of and fewer than all of the sections specified by the file format;
• and
• storing, in the mapping database, the calculated hash value in association with (a) an identifier of the source portable and linkable executable file and (b) an identifier of the software package of the source portable and linkable executable file;
• and
• generating a software bill of materials (SBOM) for a deployment package that includes deployed portable and linkable executable files, by, for at least a portion of the deployed portable and linkable executable files having the file format:
• calculating a hash value of the pre-defined subset of the sections of the deployed portable and linkable executable file,
• looking up the calculated hash value of the deployed portable and linkable executable file in the mapping database,
• if the calculated hash value is found in the mapping database, creating an entry in the SBOM that includes at least:
• (a) an identifier of the deployed portable and linkable executable file,
• (b) an identifier of the source portable and linkable executable file corresponding, based on the calculated hash value, to the deployed portable and linkable executable file, and
• (c) an identifier of the software package containing the source portable and linkable executable file, and
• if the calculated hash value is not found in the mapping database, creating an entry in the SBOM that includes at least:
• (a) an identifier of the deployed portable and linkable executable file, and
• (b) an indicator that the deployed portable and linkable executable file is not associated with any of the software packages contained in the package repository.

A computing system for use with a package repository including software packages that include source portable and linkable executable files, the computing system comprising:

• a mapping database:
• one or more hardware processors;
• and
• one or more storage devices having stored computer-executable instructions that are executable by the one or more hardware processors for configuring the computing system to perform the following:
• populating the mapping database by, for each of a plurality of the source portable and linkable executable files having a file format:
• calculating a hash value of a pre-defined subset of sections of the source portable and linkable executable file, the pre-defined subset defined for the file format and including some of and fewer than all of the sections specified by the file format;
• and
• storing, in the mapping database, the calculated hash value in association with (a) an identifier of the source portable and linkable executable file and (b) an identifier of the software package of the source portable and linkable executable file,
• wherein the pre-defined subset of the sections includes (a) a code segment and (b) a data segment that includes initialized static variables.

A computer-implemented method for use with a package repository including software packages that include source portable and linkable executable files, the method comprising:

• populating a mapping database by, for each of a plurality of the source portable and linkable executable files having a file format:
• calculating a hash value of a pre-defined subset of sections of the source portable and linkable executable file, the pre-defined subset defined for the file format and including some of and fewer than all of the sections specified by the file format;
• and
• storing, in the mapping database, the calculated hash value in association with (a) an identifier of the source portable and linkable executable file and (b) an identifier of the software package of the source portable and linkable executable file,
• wherein the pre-defined subset of the sections includes (a) a code segment and (b) a data segment that includes initialized static variables.