Many critical information technology and cyber-physical systems rely on a supply chain of open-source software projects. OSS project maintainers often integrate contributions from external actors. While maintainers can assess the correctness of a pull request, assessing a pull request's cybersecurity implications is challenging. To help maintainers make this decision, we propose that the open-source ecosystem should incorporate Actor Reputation Metrics (ARMS). This capability would enable OSS maintainers to assess a prospective contributor's cybersecurity reputation. To support the future instantiation of ARMS, we identify seven generic security signals from industry standards; map concrete metrics from prior work and available security tools, describe study designs to refine and assess the utility of ARMS, and finally weigh its pros and cons.

翻译：众多关键信息技术与网络物理系统依赖于开源软件项目构成的供应链。开源项目维护者常需整合外部参与者的贡献。尽管维护者能够评估拉取请求的正确性，但评估其网络安全影响则颇具挑战。为协助维护者进行此类决策，我们提议开源生态系统应引入参与者信誉度量系统。该能力将使开源维护者能够评估潜在贡献者的网络安全信誉。为支持ARMS的未来实现，我们从行业标准中提取了七类通用安全信号；映射了既有研究与现有安全工具中的具体度量指标，描述了用于优化和评估ARMS效用的研究设计方案，并最终权衡了其利弊得失。