I like their reason for caring about software plagarism

> How difficult is it to get the database of other open source code signatures to compare against?

It is essentially impossible because a lot of builds are not reproducible, even when they are modern dev tooling enables pining any random commit as dependency (so the matrix of version combinations to compare against grows exponentially), and even if one did manage to limit oneself to reproducible builds with a complete database of signatures it is trivially easy to invalidate this database with a few changes (forks) right and left, that do not change the security status but do change the resulting signature.

The idea of using known signatures to detect problems comes from the enterprise space and enterprise devs have learnt a long time ago to run circles around this detection to avoid the inconvenience of getting caught red handed with known security bugs. It sort of worked in the dark ages when licensing restrictions horrible build tooling and lack of network distribution drastically limited the volume of possible (good or bad) artifacts.

Blacklisting rotten artifact versions is a fool’s game. The only thing known to “work” is whitelisting known good versions. That amounts to getting into the distribution game, whether you use some third party distribution, an internal monorepo, an artifact repository or whatever other guises it takes. Of course that restricts dev liberty to the artifacts you managed to check (even imperfectly) and whitelist. Also that sort of forces dynamic linking because vetting an artifact is expensive, so you do not want this vetting and the associated signature to be invalidated on every build by build-specific optimisations.

Because using signatures for blacklisting is a fool’s game and using signatures for whitelisting is hard and restrictive you have the current situation where everything that originates from a trusted distribution can be vetted via signatures and everything else requires manual checking and eventual rebuilding using the original project latest fixes.