  Many software products are composed by the recursive integration of
components from other teams or external parties. Each additional link in a
software product's supply chain increases the risk of the injection of
malicious behavior. To improve supply chain provenance, many cybersecurity
frameworks, standards, and regulations recommend the use of software signing.
However, recent surveys and measurement studies have found that the adoption
rate and quality of software signatures are low. These findings raise questions
about the practical application of software signing, the human factors
influencing its adoption, and the challenges faced during its implementation.
We lack in-depth industry perspectives on the challenges and practices of
software signing.
  To understand software signing in practice, we interviewed 18 high-ranking
industry practitioners across 13 organizations. We provide possible impacts of
experienced software supply chain failures, security standards, and regulations
on software signing adoption. We also study the challenges that affect an
effective software signing implementation. To summarize our findings: (1) We
present a refined model of the software supply chain factory model highlighting
practitioner's signing practices; (2) We highlight the different challenges --
Technical, Organizational, and Human -- that hamper software signing
implementation; (3) We report that expert subjects disagree on the importance
of signing; (4) We describe how failure incidents and industry standards affect
the adoption of software signing and other security techniques. Our findings
contribute to the understanding of software supply chain security by
highlighting the impact of human and organizational factors on Software Supply
Chain risks and providing nuanced insights for effectively implementing
Software Supply Chain security controls -- towards Software signing in
practice.
