System and method for distributed ledger-based software supply chain management

1. A method for distributed ledger-based software supply chain management comprising:

in an information processing apparatus comprising at least one computer processor:

receiving, from a software tool and over a message bus, a metadata artifact comprising at least one of an artifact name, an organization ID, a creation time, an artifact type, an artifact data, an artifact hash, a reference of hash, and a reference ID of the software tool, wherein the metadata artifact contains data for a software development lifecycle event including at least one of creating a requirement or a defect record in a planning system, committing a line

of code in a source code management tool, a software build, completion of a test or scan and a deployment to an end system;

writing the metadata artifact to a metadata store; and

updating a present state database with values for metadata keys referencing the metadata artifact in the metadata store.

2. The method of claim 1 , wherein the metadata artifact refers to the software development lifecycle event.

3. The method of claim 1 , wherein the software tool is part of a software lifecycle.

4. The method of claim 1 , wherein the metadata artifact is encrypted, and the method further comprises decrypting the metadata artifact.

5. The method of claim 1 , wherein the metadata store maintains an immutable record of the metadata artifact.

6. The method of claim 1 , wherein the metadata store comprises a blockchain-based distributed ledger or a hashgraph.

7. The method of claim 1 , wherein the metadata store comprises one of a stream processing service, a noSQL database, and a conventional relational database.

8. The method of claim 1 , wherein the present state database comprises a key/value pair database, wherein each key is a value of stored metadata and references an underlying data source record.

9. A method for distributed ledger-based software supply chain management comprising:

in an information processing apparatus comprising at least one computer processor:

receiving a file of interest;

generating a hash of the file of interest, wherein the hash uniquely identifies the file of interest;

searching a present state database with the hash;

receiving a record from the present state database that matches the hash;

retrieving a block from a metadata store referenced by the record, wherein the metadata store includes a metadata artifact that contains data for a software development lifecycle event including at least one of creating a requirement or a defect record in a planning system, committing a line of code in a source code management tool, a software build, completion of a test or scan and a deployment to an end system; and

retrieving a file archive associated with the record.

10. The method of claim 9 , wherein the metadata store maintains an immutable record of the metadata artifact.

11. The method of claim 9 , wherein the metadata store comprises a blockchain-based distributed ledger or a hashgraph.

12. The method of claim 9 , wherein the present state database comprises a key/value pair database, wherein each key is a value of stored metadata and references an underlying data source record.

13. The method of claim 9 , further comprising:

providing the file archive to a downstream system.

14. The method of claim 9 , wherein the file archive identifies a source of the file of interest.

15. The method of claim 9 , wherein the file archive comprises source code for the file of interest.

16. A system for distributed ledger-based software supply chain management comprising:

a plurality of software development tools, each software development tool executed by a computer processor;

a controller executed by a computer processor;

a metadata store, wherein the metadata store maintains an immutable record of a plurality of metadata artifacts, wherein each metadata artifact comprises at least one of an artifact name, an organization ID, a creation time, an artifact type, an artifact data, an artifact hash, a reference of hash, and a reference ID of the software development tool, wherein the metadata artifact contains data for a software development lifecycle event including at least one of creating a requirement or a defect record in a planning system, committing a line of code in a source code management tool, a software build, completion of a test or scan and a deployment to an end system; and

a present state database comprising a key/value pair database, wherein each key is a value of stored metadata and references an underlying data source record;

wherein:

the controller receives a metadata artifact for a software development lifecycle event from one of the software development tools over a message bus;

the controller writes the metadata artifact to the metadata store; and

the controller updates the present state database with values for metadata keys referencing the metadata artifact in the metadata store.

17. The system of claim 16 , wherein:

the controller receives a file of interest;

the controller generates a hash of the file of interest, wherein the hash uniquely identifies the file of interest;

the controller searches the present state database with the hash;

the controller retrieves a record from the present state database that matches the hash;

the controller retrieves a block from a metadata store referenced by the record; and

the controller retrieves a file archive associated with the record.