Functional package managers (FPMs) and reproducible builds (R-B) are technologies and methodologies that are conceptually very different from the traditional software deployment model, and that have promising properties for software supply chain security. This thesis aims to evaluate the impact of FMPs and R-B on the security of the software supply chain and propose improvements to the FPM model to further improve trust in the open source supply chain.

Julien Malka is a PhD student in software supply chain security at Télécom Paris, Institut Polytechnique de Paris. His research interests focus on software supply chain security, functional package managers and reproducible builds, but cover more widely cybersecurity and type theory topics. He is also a NixOS developer in his free time.