Abstract: Provided is a process that includes: calling an alert program configured to execute on a decentralized computing platform and access records on a blockchain, wherein: the decentralized computing platform is configured to execute multiple instances of the program to produce multiple instances of candidate results, the decentralized computing platform is configured to determine an output of the alert program in response to the call with a first consensus algorithm, the alert program is configured to verify a cryptographic signature of the call and determine whether an alerting entity is authorized to issue the alert, and the alert program is configured to publish the information about the software asset to alert recipients or to the blockchain upon verifying the cryptographic signature and determining that the alerting entity is authorized to issue the alert.

Abstract: Provided is a process that includes: traversing, with one or more processors, a constituency graph of a software asset and accessing corresponding trust records of a plurality of the software assets of the constituency graph visited by traversing the constituency graph, the trust records being published to a tamper-evident, immutable, decentralized data store; and for each respective constituent software asset among the plurality of constituent software assets visited by traversing, assessing, with one or more processors, trustworthiness of the respective software asset based on the corresponding trust record of the respective software asset.

Abstract: Provided is a process that includes: calling a program executed on a decentralized computing platform configured to persist state to a blockchain, the call requesting the program to release the software asset to the production environment, wherein: respective instances of the program are configured to publish release documentation by which provenance of the software asset is verifiable to the blockchain, respective instances of the program are configured to verify a cryptographic signature associated with the software asset, the cryptographic signature establishes that the software asset being released has not been tampered with subsequent to signing, the cryptographic signature establishes that the releasing entity or a proxy of the releasing entity has access to a cryptographic key by which the cryptographic signature was formed, and the decentralized computing platform is configured to reach a consensus verification determination among verification results from the replicated instances of the program.

Abstract: Provided is a process that includes: determining whether to execute a software asset based on trust records documenting provenance of the software asset published to a blockchain, wherein determining whether to trust the software asset comprises: accessing the trust record, verifying the trust record has not been tampered with subsequent to publishing, verify that a hash digest based on the software asset matches a hash digest associated with the trust record and published to the blockchain; verifying that trust assertions of the trust record are cryptographically signed by trusted entities specified by entity criteria, and verifying that the trust assertions satisfy execution criteria.

Abstract: Provided is a process that includes: calling an audit smart contract with a request to indicate whether an audit requirement has been satisfied for a software asset, wherein: the audit smart contract is configured to access a trust record published in a blockchain to determine whether the audit requirement has been satisfied, the trust record is caused to be published to the blockchain by an auditing entity that performed the audit, the trust record contains a cryptographically signed indication of an identity of an auditing entity that performed the audit, a result of the audit that specifies whether the audit was passed by the software asset, and a hash digest of the software asset upon which the audit was performed, wherein the audit smart contract is configured to determine whether the trust record establishes that the audit requirement has been satisfied.

Abstract: Provided is a smart contract that specifies a routine to be executed by a plurality of the computing nodes of a blockchain-based, decentralized computing platform, wherein the promotion smart contract is configured to determine whether a pre-release software asset satisfies software quality criteria required to advance the pre-release software asset to a next stage, and the promotion smart contract is configured to cause an assertion indicating whether software quality criteria are satisfied to be published to a blockchain storing trust records in response to determining whether the software quality criteria are satisfied.