Computer-based system to validate build integrity of software products

Patent metadata

Field	Value
Publication number	US-12373558-B1
Application number	US-202217650346-A
Country	US
Kind code	B1
Filing date	Feb 8, 2022
Priority date	Feb 9, 2021
Publication date	Jul 29, 2025
Grant date	Jul 29, 2025

Abstract

Techniques are described for validating build integrity of software products, such as applications or containers. More specifically, this disclosure describes a build integrity validation system that analyzes build artifacts resulting from a software build process to create source code assertions, and compares the assertions against the source code from which the build artifacts were produced. The build integrity validation system validates that a particular build artifact is producible by the source code to ensure that no additional code was introduced during the build process. The build integrity validation system may also reverse the analysis to validate that the source code is able to produce the build artifacts to ensure that no code was removed or modified during the build process. The build integrity validation system identifies and reports identified discrepancies between the source code and the build artifacts resulting from the software build process of the source code.

First claim

What is claimed is:

1. A method comprising:
creating, by a computing system, a data file based on information extracted from at least one build artifact resulting from a software build process of source code, wherein the data file includes one or more assertions with respect to one or more definitions of software components expected to be included in the source code in order to produce the at least one build artifact;
comparing, by the computing system, the one or more assertions in the data file and definitions of software components in the actual data of the source code;
identifying, by the computing system and based on the comparison, whether at least one discrepancy occurs between the one or more assertions in the data file and the actual data of the source code, wherein identifying that the at least one discrepancy occurs comprises identifying at least one assertion created from the at least one build artifact that is not included in the actual data of the source code such that the at least one build artifact is not producible by the actual data of the source code; and
in response to identifying the at least one discrepancy, generating, by the computing system, a report indicating the at least one discrepancy between the at least one build artifact and the source code.

2. The method of claim 1 , wherein generating the report comprises generating a notification indicating that additional data was potentially introduced during the software build process of the source code that produced the at least one build artifact.

3. The method of claim 1 , wherein the source code is compiled into the at least one build artifact by a build server, and wherein the build server is independent from the computing system.

4. The method of claim 1 , wherein the source code comprises source code of a software application and the at least one build artifact comprises at least one build artifact of a plurality of build artifacts resulting from the software build process of the source code,
wherein creating the data file comprises:
extracting one or more software components from the at least one build artifact, and
creating one or more source code assertions that the source code is expected to include the one or more definitions of the one or more software components extracted from the at least one build artifact; and

wherein comparing the one or more assertions in the data file and the definitions of the software components in the actual data of the source code comprises comparing each source code assertion of the one or more source code assertions against one or more definitions of the definitions of the software components in the actual data of the source code.

5. The method of claim 4 , wherein identifying that the at least one discrepancy occurs comprises identifying at least one source code assertion created from the at least one build artifact that does not match the one or more definitions of software components in the actual data of the source code such that the at least one build artifact is not producible by the actual data of the source code.

6. The method of claim 4 , wherein identifying whether the at least one discrepancy occurs comprises identifying whether at least one first discrepancy occurs based on a first comparison between the one or more source code assertions and the definitions of the software components in the actual data of the source code, and wherein in response to identifying no first discrepancy between the one or more source code assertions and the definitions of the software components in the actual data of the source code, the method further comprises:
creating one or more build artifact assertions based on the definitions of the software components in the actual data extracted from the source code;
comparing the one or more build artifact assertions and the plurality of build artifacts resulting from the software build process of the source code as a second comparison; and
identifying, based on the second comparison, whether at least one second discrepancy occurs between the one or more build artifact assertions and the plurality of build artifacts, wherein identifying that the at least one second discrepancy occurs comprises identifying at least one build artifact assertion created from the source code that is not included in the plurality of build artifacts resulting from the software build process of the source code such that the actual data of the source code is unable to produce the plurality of build artifacts.

7. The method of claim 6 , wherein creating the one or more build artifact assertions comprises:
extracting one or more definitions of the definitions of the software components from the source code; and
creating the one or more build artifact assertions that the plurality of build artifacts is expected to include one or more software components of the one or more definitions extracted from the source code.

8. The method of claim 6 , wherein generating the report comprises generating a notification indicating that a portion of the actual data of the source code was potentially removed or modified during the software build process of the source code that produced the plurality of build artifacts.

9. The method of claim 1 , wherein the source code comprises a container source file of a software container and the at least one build artifact comprises a container image resulting from the software build process of the container source file,
wherein creating the data file comprises:
extracting a history of one or more commands executed to build the container image during the software build process of the container source file, and
creating a container image history file including one or more source code assertions that the container source file is expected to include the one or more commands extracted from the container image; and

wherein comparing the one or more assertions in the data file and the definitions of the software components in the actual data of the source code comprises comparing each source code assertion of the one or more source code assertions in the container image history file against one or more commands in the actual data of the container source file.

10. The method of claim 9 , wherein identifying that the at least one discrepancy occurs comprises identifying at least one source code assertion in the container image history file created from the container image that does not match the one or more commands in the actual data of the container source file such that the container image is not producible by the actual data of the container source file.

11. The method of claim 9 , wherein comparing each source code assertion in the container image history file against the one or more commands in the actual data of the container source file comprises comparing each source code assertion of the one or more source code assertions read entry-by-entry from top-down in the container image history file against each command of the one or more commands read entry-by-entry from bottom-up in the container source file.

12. The method of claim 11 , further comprising, when a source code assertion of the one or more source code assertions at a given entry in the container image history file does not match a command at a corresponding entry in the actual data of the container source file:
determining that the corresponding step in the actual data of the container source file comprises a reference to a second container image;
accessing the second container image;
creating a second container image history file including one or more commands executed to build the second container image; and
comparing the source code assertion at the given

Assignees

• Wells Fargo Bank Na

Inventors

• Long Jeremy W

Classifications

• G06F2221/033

  Test or assess software · CPC title

• G06F21/563 Primary

  by source code analysis · CPC title