When the code changes (IP Paris)

30 October 2025

Drawing on this global archive of open source software, Stefano Zacchiroli offers tools that can be used to trace the evolution of the code used in most products on the market and detect anomalies between different versions.

Stefano Zacchiroli is a full Professor at the Information Processing and Communication Laboratory (LTCI) at Télécom Paris, and co-founder of the Software Heritage project. His works contribute to the security of the open source software supply chain and to European sovereignty in this area. He spoke at the IP Paris Cybersecurity and Defense Conference on October 21, 2025.

What is the context of your research?

I am the co-founder and scientific director of the Software Heritage project, which is the world’s largest archive of source code and software development history. More than 300 million projects are stored there for the purpose of preserving intangible assets (with the support of UNESCO), but also for scientific purposes, with applications in research and industry. On this last point, the stakes are high because 99% of digital products today reuse open source code. It is therefore useful to be able to trace the history of a piece of code and verify whether the version on which a piece of software is running is consistent with the one archived in Software Heritage. My work also focuses on the security of the software supply chain. In recent years, cyberattackers have been trying to introduce vulnerabilities into the open source components of products on the market. Government policies to secure the open source supply chain are being rolled out in Europe and the United States in response to this phenomenon.