Paper
InstallTrust Score: Universal Trust Metrics for Software Installation Security
Quantifying Installation Security Trust Across All Computing Platforms
The last mile of the software supply chain is installation. InstallTrust Score introduces a universal 0–100 metric for installation trust across platforms (app stores, package managers, containers, scripts), decomposes trust into six weighted factors, and benchmarks 100 installation methods across 8 platform categories.
Key insight
Trust varies more by installation method than by platform: the same OS can span an 80+ point “trust gap” depending on how you install.
-
—
Six-factor model (25/25/15/15/10/10): Integrity, Review & CI/CD, Provenance, Least-Privilege, Update Security, Distribution Hygiene.
-
—
Empirical benchmark: 100 installation methods across 8 categories.
-
—
Headline contrast: iOS App Store ~98 vs curl|sh ~15–25 (trust failure by design).
-
—
Example: Nix on Linux (~94) can exceed unverified script installs on macOS (~43).
-
—
Android’s 2026 developer verification moves the baseline upward—and changes what “open” means.