Source-linked AI summary
AgOSS: A Dataset and Multi-Layer Characterization of Open-Source Agricultural Software
Vatsal Dudhaiya, Mikhail Golovenchits, Aryan Banerjee, James C. Davis
TL;DR
Agricultural OSS spans critical software layers, but its supply-chain security and the source of any domain gap remain unclear. The paper constructs AgOSS and evaluates it against matched controls using governance, activity, dependency, and exploitation measures. It finds that governance and dependency risk are largely independent, while the apparent agricultural governance deficit is confounded by project size and maturity.
Problem
Agricultural OSS forms a multi-layer software supply chain with limited empirical security evidence, leaving unclear whether differences from comparable software reflect agriculture or project maturity.
Method
The study constructs AgOSS, a 66-repository dataset across six categories, and analyzes it with Scorecard, GitHub metrics, SBOM/OSV dependency analysis, KEV matching, and matched non-agricultural controls.
Results
Governance is independent of inherited dependency risk, while agricultural projects’ lower raw Scorecard results do not survive matching and size-adjusted regression.
Takeaways & Limitations
Security efforts should target contributor capacity and dependency management rather than agriculture-specific controls.
Takeaways & Limitations
The purposive, GitHub-centered sample of 66 repositories is not a random draw, so p-values describe observed groups rather than all agricultural OSS.
Abstract
from arXiv · showhide
Much of agriculture depends on open-source software spanning farm management platforms, cloud services, edge gateways, embedded systems, and field-deployed sensors, forming a domain-specific software supply chain that has drawn little empirical security attention. It is unknown whether this ecosystem's supply chain security posture differs from that of comparable non-agricultural software, and if it does, whether the difference reflects the agricultural domain or the size and maturity of the projects within it. As a step towards securing agricultural open-source software, we present AgOSS, a dataset of 66 repositories across six architectural categories. We assess supply chain security within the dataset via OpenSSF Scorecard, governance metrics, SBOM-based dependency analysis, and KEV matching, and compare against matched non-agricultural controls. We report two findings. First, governance is largely independent of inherited dependency risk. Scorecard tracks community activity, but we detect no association with vulnerability count, density, or known-exploited count, and in regression the exposure signal loads on architectural category rather than domain. Second, agricultural projects score far lower on raw Scorecard, but size and maturity confound the gap: the residual loses significance under matching and regression. Securing this ecosystem means investing in contributor capacity and dependency hygiene, not agriculture-specific controls.
1 Introduction
Agriculture depends on a broad OSS stack whose supply-chain security has not been systematically characterized. AgOSS addresses this gap by comparing agricultural and non-agricultural repositories while separating domain effects from project maturity.
- Agricultural OSS spans field sensors, embedded infrastructure, cloud platforms, and farm-management software, but has not been studied as a distinct software supply chain.
- Prior work covers mainly farm-management and modelling applications, leaving infrastructure layers and their governance, security practices, and dependency risk poorly understood.
- The study compares agricultural repositories with non-agricultural ones and tests whether observed differences vary across architectural layers or reflect project maturity.
- AgOSS presents a dataset of 66 repositories mapped onto a four-layer agricultural stack.
- Agricultural repositories show lower raw governance results, but the gap does not survive size- and activity-adjusted comparisons.
- Governance and inherited dependency risk move independently, so remediation should emphasize contributor capacity rather than domain-specific governance hardening.
2 Background and Related Work
Smart farming relies on fragmented OSS across applications, infrastructure, and data-processing layers, but prior research provides limited ecosystem-level supply-chain evidence. AgOSS builds on related MSR and supply-chain studies to examine this underexplored setting.
- Agricultural OSS supports interconnected precision-agriculture systems spanning farm platforms, telemetry, embedded systems, edge gateways, cloud dashboards, and processing libraries.
- These projects often depend on fragmented networks of researchers, contributors, and small teams rather than large maintainer communities.
- A prior review cataloged 21 open-source precision-agriculture packages and identified weak repository management alongside small maintainer communities.
- Existing MSR research motivates reproducible pipeline design and systematic analysis of software evolution, dependencies, and ecosystem properties.
- Adjacent studies operationalize supply-chain risk in heterogeneous ecosystems using repository attributes, firmware analysis, SBOMs, and dependency-network models.
- Prior Scorecard studies examined vulnerability associations and practice effects mainly in npm and PyPI, leaving firmware- and RTOS-spanning stacks underexamined.
3 Research Questions
The study asks whether agricultural repositories differ from non-agricultural repositories, how security varies across the agricultural stack, and whether differences reflect domain or maturity.
- RQ1 asks whether ag-specific repositories have weaker security and maintenance characteristics than non-ag-specific repositories.
- RQ2 asks how agricultural OSS security posture is distributed across architectural layers.
- RQ3 asks whether observed differences reflect agriculture itself or project maturity.
- Answering these questions determines whether defensive efforts should target the domain or shared resourcing and maintenance gaps.
4 Methodology
AgOSS uses an exploratory MSR workflow to construct and classify a 66-repository corpus, then compares repositories using multiple security, activity, dependency, and matching procedures.
- Dataset construction: The corpus was built through keyword retrieval, snowball sampling, semantic discovery, screening, and eligibility assessment.The initial search retrieved 1,500 keyword candidates before screening.
- Dataset construction: 66 repositories satisfied the selection criteria after all candidates were evaluated.
- Labeling: Repositories received one stack-category label and one ag-specificity label, with classifications reviewed by a second reviewer.Reviewer agreement was 96.97% (64/66), with discrepancies resolved through discussion.
- Labeling: The six categories are Embedded OS Substrate, Field-Deployed Sensor, Edge and Gateway software, Cloud-hosted backends and dashboards, agricultural platforms, and data-processing libraries/tools.
- Labeling: The stack contains four vertical layers plus a cross-cutting Data Processing Libraries/Tools category that interfaces at multiple points.
- Comparison design: Ag-specific repositories were matched to controls using programming language and six covariates covering size, age, contributors, activity, and repository popularity.The primary estimate paired each repository with k=3 nearest eligible controls by Mahalanobis distance.
- Data pipeline: Four independent collection stages measured Scorecard, GitHub telemetry, SBOM/OSV dependency exposure, and KEV matches before merging results for analysis.
5 Results
Across 66 repositories, agricultural projects show lower raw governance scores, but dependency exposure is not aligned with governance and the apparent domain gap disappears after maturity adjustment. Vulnerability exposure varies more by architectural category, while matching and regression weaken the case for an agriculture-specific deficit.
- Dependency exposure: 2,841 findings across 20,050 packages covered 1,649 unique vulnerability IDs, with 36 of 55 scanned repositories affected.Findings included 167 Critical, 893 High, 818 Medium, 240 Low, and 723 Unknown severities.
- Unadjusted comparison: Ag-specific repositories scored 3.3 median on OpenSSF Scorecard versus 5.2 for non-ag-specific repositories.The corresponding means were 3.4 and 5.4, respectively.
- Unadjusted comparison: Non-agricultural repositories led activity, popularity, and governance metrics, while ag-specific repositories had fewer raw vulnerabilities but no difference in vulnerability density or KEV count.The Scorecard gap was the widest effect (r = −0.873, pFDR < 0.001); fewer raw vulnerabilities matched smaller dependency footprints.
- Metric relationships: Scorecard was not significantly correlated with vulnerability count, density, or KEV count, although dependency-risk metrics correlated with one another.The reported correlations were ρ = 0.23, 0.10, and −0.04 for Scorecard against the three exposure metrics; count correlated with KEV at ρ = 0.45 and density at ρ = 0.66.
- Adjusted comparison: After holding category, popularity, and community size constant, ag_specific was not significant in any model, while category and contributor count remained informative.The ag_specific pFDR range was 0.31–0.43; contributor count positively predicted Scorecard, and selected categories predicted lower Scorecard or vulnerability counts.
- Matched comparison: 47 of 55 ag-specific repositories matched controls, improving balance but leaving residual imbalance in stars and forks.Log stars changed from −1.64 to −0.61 and log forks from −1.39 to −0.50, remaining above the imbalance threshold.
- Matched comparison: The matched Scorecard difference fell to −0.40 with pFDR = 0.170, while vulnerability count, density, and KEV count were near zero.The Scorecard effect declined from r = −0.873 unmatched to r = −0.362 matched; limited power means this does not establish absence.
6 Analysis and Discussion
The unadjusted agricultural security gap is better explained by project maturity and contributor capacity than by domain, while dependency exposure remains structurally separate from governance.
- A Confounded Maturity Gap: The raw Scorecard deficit does not establish an agriculture-specific effect because adjustment strategies undercut the domain-deficit interpretation.The unadjusted comparison showed non-agricultural repositories leading on Scorecard and activity metrics, but the adjusted analyses weakened that reading.
- A Confounded Maturity Gap: Contributor-community size most consistently tracks governance maturity, correlating with Scorecard at ρ=0.69 and predicting it positively in the joint model.It is also the sharpest single separator between agricultural and non-agricultural repositories in the raw comparison.
- Supply-Chain Exposure Beyond Governance: Scorecard governance measures are decoupled from vulnerability count, density, and KEV count because dependency exposure arrives through upstream packages.A disciplined project with a wide transitive dependency graph can inherit substantial exposure, while a loosely governed project with few dependencies may carry little.
- Supply-Chain Exposure Beyond Governance: Regression places outcome differences in architectural category rather than agricultural specificity for both vulnerability count and Scorecard.Several categories differ from the Cloud-hosted Backends reference, while the ag_specific term carries neither signal.
- Repository-Level Context: Five representative repositories were examined to ground the aggregate findings in cases from different parts of the AgOSS dataset.The cases span different architectural positions within the dataset.
7 Threats to Validity
The study’s validity is constrained by purposive, GitHub-centric sampling, residual confounding, incomplete dependency visibility, and several dataset-construction and measurement limitations.
- Dataset Construction: Keyword retrieval, snowball sampling, and single-rater triage may skew coverage toward well-documented or connected repositories.The study did not measure the single rater’s false-negative rate against a second screen.
- Vulnerability-to-Exploit Gap: KEV matching provides a conservative lower bound on exploitability because the catalog contains only a subset of exploitable vulnerabilities.Known vulnerabilities do not necessarily represent immediate threats.
- Internal Validity: Unmeasured funding, institutional backing, governance structure, and deployment context may contribute to remaining group differences after matching and regression.The adjustment strategies did not include these factors.
- External Validity: The purposive sample of 66 repositories may not represent the broader agricultural OSS ecosystem, and p-values should be read descriptively rather than generalized.GitHub-centric discovery may overlook software hosted on GitLab, Bitbucket, or industrial platforms.
- Data and Conclusion Validity: Eleven repositories, or 16.67%, lacked valid SBOMs, with failures concentrated in C/C++ and embedded build systems.GitHub resolves npm and PyPI ecosystems more completely than manifest-poor embedded environments, disproportionately affecting Field-Deployed Sensors.
- Data and Conclusion Validity: Unqueryable package records may mask additional risks: 406 of 20,050 records lacked standard names or version metadata.This limitation affects dependency-risk measurement rather than repository inclusion broadly.
8 Conclusion
AgOSS shows that agricultural repositories’ lower governance scores are confounded by scale, while dependency exposure follows dependency footprint rather than governance practices.
- Conclusion: AgOSS covers 66 repositories across six categories and combines Scorecard, governance and activity metrics, SBOM analysis, and KEV matching.The dataset spans the agricultural software supply chain across architectural layers.
- Conclusion: The agricultural governance gap does not survive matching against comparable repositories or size-adjusted regression, although the sample cannot prove no domain difference.Contributor-community size most consistently tracks governance maturity.
- Conclusion: Dependency exposure moves independently of Scorecard and concentrates in a project’s dependency footprint rather than its practices.Remediation should therefore address contributor sustainability and dependency management.
- Conclusion: The field-deployed layer has the least completely resolved dependencies, so its low observed exposure may reflect under-observation rather than low risk.The conclusion calls for SBOM tooling suited to C and embedded build systems.
Ethics and Privacy Statement
The study reports no human-subject involvement and limits its analysis to aggregate security comparisons and dependency summaries rather than exploitation guidance.
- Ethics and Privacy Statement: The study did not involve human subjects.The analysis used aggregate architectural layers, statistical comparisons, and dependency-count summaries.
- Ethics and Privacy Statement: The analysis provides no actionable exploitation guidance and uses only pre-existing public CISA KEV entries.Accordingly, no vulnerability disclosure was warranted.