White paper for Tern ?

[sgirdhar]

Hi,

I have been analysing Tern for a few days now. I am really impressed with the capabilities of this tool.
It is very well documented, but I am a research student and world like to understand some things in more detail. So, I was wondering if there is any white paper that was published related to Tern ?

Thanks in advance :)

[rnjudge]

Hi @Shubham-Girdhar, thanks for your post! We don't have an official white paper for this tool beyond the diagrams/explanations in the repository. Is there specific information you are looking for?

[sgirdhar]

Thanks for your kind reply @rnjudge.

I would like to understand more about how and why tern is using hashing? Is it being used for verification of digital signatures for the packages?
If not, I would also like to know if there is some procedure in place to verify the genuineness of the identified packages.

[rnjudge]

Hi @Shubham-Girdhar. Tern uses hashing in a few different ways:

1. Used as a filesystem identifier. Each image layer with a corresponding tar file gets a filestsystem hash assigned to it. This hash is generated using the calc_fs_hash function walks through the files of the layer and hashes their contents as well as collect some file stats such as file permissions, size and extended attributes. As a result, the hashes change only when the file contents themselves change. This keeps the hashes constant from build to build. The hash value is stored in the fs_hash attribute per image layer and is included in the more verbose reports (like JSON). The layer fs_hash value is also used as a key when Tern caches/looks up the layer metadata in the cache.

2. The SPDX and CycloneDX reports each use some forms of hashing to report on the contents of the container image according to their respective specifications.

Can you elaborate what you mean by the "genuineness" of the identified packages? Are you asking about whether packages are signed and then verified by Tern or something else?

[sgirdhar]

Hi @rnjudge, thanks a lot for the information.

Are you asking about whether packages are signed and then verified by Tern or something else?

Yes, I mean exactly this, if packages are signed and then verified by Tern?