Proposal: Insecure Quantum Software Supply Chain as a Candidate Risk - #39
Open
leprecha1 wants to merge 1 commit into
Open
Proposal: Insecure Quantum Software Supply Chain as a Candidate Risk#39leprecha1 wants to merge 1 commit into
leprecha1 wants to merge 1 commit into
Conversation
Propose Insecure Quantum Software Supply Chain as a candidate risk, focusing on end-to-end integrity and provenance across dependencies, build systems, CI/CD pipelines, artifacts, repositories, and deployment. The proposal complements QS09 by addressing risks before and around the quantum transformation and execution toolchain.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR proposes Insecure Quantum Software Supply Chain as a candidate risk for consideration in the OWASP Top 10 for Quantum Security Risks.
The proposal addresses integrity and provenance across the broader quantum software development lifecycle, including dependencies, SDKs, build systems, CI/CD pipelines, quantum artifacts, package and artifact repositories, signing, provenance, and deployment.
Relationship to QS09
QS09:2026 - Toolchain and Compiler Compromise focuses on compromise within the quantum transformation and execution stack, including transpilers, compilers, schedulers, and hardware configuration.
This proposal focuses on the broader software supply chain before and around that toolchain.
QS09 asks whether the quantum transformation and execution toolchain can be trusted. This candidate risk asks whether the software and artifacts entering that toolchain can be trusted in the first place.
A trusted quantum compiler cannot compensate for a compromised dependency, build process, CI/CD pipeline, or artifact delivered to it.
The intention is not to duplicate QS09, but to submit end-to-end quantum software supply-chain integrity and provenance for community consideration as a distinct risk area.
Why this matters
Quantum applications increasingly rely on classical software-development infrastructure before workloads reach quantum execution environments. Compromise of dependencies, build pipelines, artifact repositories, or generated circuit artifacts can therefore alter a quantum workload without requiring compromise of the quantum compiler itself.
The proposal is grounded in established software supply-chain practices such as SLSA, in-toto, Sigstore, and NIST SSDF, together with emerging quantum software engineering research.
Feedback, scope adjustments, and suggestions are welcome.