Search papers, labs, and topics across Lattice.
This paper introduces AgOSS, a dataset comprising 66 repositories of open-source agricultural software, to evaluate the supply chain security of this domain-specific ecosystem. The analysis reveals that governance metrics do not correlate with dependency risk or vulnerability counts, indicating that the architectural category of the software plays a more significant role in security posture than the agricultural context itself. Additionally, while agricultural projects initially appear to have lower security scores compared to non-agricultural counterparts, this disparity diminishes when controlling for project size and maturity, suggesting that enhancing contributor capacity and dependency management is crucial for improving security.
Governance metrics in agricultural open-source software reveal surprising independence from actual security risks, challenging assumptions about the sector's vulnerability.
Much of agriculture depends on open-source software spanning farm management platforms, cloud services, edge gateways, embedded systems, and field-deployed sensors, forming a domain-specific software supply chain that has drawn little empirical security attention. It is unknown whether this ecosystem's supply chain security posture differs from that of comparable non-agricultural software, and if it does, whether the difference reflects the agricultural domain or the size and maturity of the projects within it. As a step towards securing agricultural open-source software, we present AgOSS, a dataset of 66 repositories across six architectural categories. We assess supply chain security within the dataset via OpenSSF Scorecard, governance metrics, SBOM-based dependency analysis, and KEV matching, and compare against matched non-agricultural controls. We report two findings. First, governance is largely independent of inherited dependency risk. Scorecard tracks community activity, but we detect no association with vulnerability count, density, or known-exploited count, and in regression the exposure signal loads on architectural category rather than domain. Second, agricultural projects score far lower on raw Scorecard, but size and maturity confound the gap: the residual loses significance under matching and regression. Securing this ecosystem means investing in contributor capacity and dependency hygiene, not agriculture-specific controls.
