Trust validation for software artifacts

1. A computer-implemented method for building trusted executable software using trusted building units, wherein a path between said building units is untrusted, the method comprises:

generating, by each of the trusted building units, an identifier for identifying an output of a respective trusted building unit, wherein the respective trusted building unit also generates a signed confirmative certificate comprising said identifier;

utilizing, by each of said distributed trusted building units, output results of at least one of a predecessor build unit of said trusted building unit as input;

validating that each of said signed confirmative certificates conforms to a predefined set of policy rules; and

upon a failed validating of said signed confirmative certificate of one of said trusted building units, terminating said building of said trusted executable software.

2. The method according to claim 1 , wherein said signed confirmative certificate is based on an Internet security certificate comprising additional validation information.

3. The method according to claim 1 , wherein said validating of said signed confirmative certificate is based on revoking Internet security certificates, and wherein all trusted building units or trusted executing environment units for an execution of said build trusted software are using standard methods for an Internet certificate revocation checking.

4. The method according to claim 1 , wherein said identifier is a hash value of said output of said respective build unit.

5. The method according to claim 1 , wherein said generating said signed confirmative certificate also comprising:

testing said build trusted executable software.

6. The method according to claim 1 , also comprising:

re-validating said build trusted executable software; and

generating a related new signed confirmative certificate.

7. The method according to claim 6 , wherein said re-validating is repeated for a plurality of different security scan types.

8. The method according to claim 1 , wherein said generating said signed confirmative certificate represents that said output of said trusted build unit complies with a predefined set of rules.

9. The method according to claim 8 , wherein said predefined set of rules is stored outside a development framework of which said trusted build units are part of.

10. The method according to claim 1 , also comprising:

upon a failed verification of any of said signed confirmative certificates during an execution phase of said output of said trusted build units, terminating an execution of said trusted executable software.

11. A software build system for building trusted executable software using trusted building units, wherein a path between said building units is untrusted, said system comprising:

a processor and a memory, communicatively coupled to said processor, wherein said memory stores program code portions that, when executed, enable said processor, to:

generate, by each of said trusted building units, an identifier for identifying an output of said respective trusted building unit, wherein said respective trusted building unit also generates a signed confirmative certificate comprising said identifier;

utilize, by each of said distributed trusted building units, output results of at least one of a predecessor build unit of said trusted building unit as input;

validate that each of said signed confirmative certificates conforms to a predefined set of policy rules; and

upon a failed validating of said signed confirmative certificate of one of said trusted building units, terminate said building of said trusted executable software.

12. The system according to claim 11 , wherein said signed confirmative certificate is based on an Internet security certificate comprising additional validation information.

13. The system according to claim 11 , wherein said validating of said signed confirmative certificate is based on revoking Internet security certificates, and wherein all trusted building units or trusted executing environment units for an execution of said build trusted software are using standard methods for an Internet certificate revocation checking.

14. The system according to claim 11 , wherein said identifier is a hash value of said output of said respective build unit.

15. The system according to claim 11 , wherein said generating said signed confirmative certificate also comprising:

testing said build trusted executable software.

16. The system according to claim 11 , wherein said processor is also adapted to: re-validating said build trusted executable software; and generating a related new signed confirmative certificate.

17. The system according to claim 16 , wherein said re-validating is repeated for a plurality of different security scan types.

18. The system according to claim 11 , wherein said generating said signed confirmative certificate represents that said output of said trusted build unit complies with a predefined set of rules.

19. The system according to claim 11 , wherein said processor is also adapted to: upon a failed verification of any of said signed confirmative certificates during an execution phase of said output of said trusted build units, terminating an execution of said trusted executable software.

20. A computer program product for building trusted executable software using trusted building units, wherein a path between said building units is untrusted, said computer program product comprising a computer readable storage medium having program instructions embodied therewith, said program instructions being executable by one or more computing systems or controllers to cause said one or more computing systems to:

generate, by each of said trusted building units, an identifier for identifying an output of said respective trusted building unit, wherein said respective trusted building unit also generates a signed confirmative certificate comprising said identifier;

utilize, by each of said distributed trusted building units, output results of at least one of a predecessor build unit of said trusted building unit as input;

validate that each of said signed confirmative certificates conforms to a predefined set of policy rules; and

upon a failed validating of said signed confirmative certificate of one of said trusted building units, terminate said building of said trusted executable software.