Publications

@inproceedings{kalu2026johnnyadopts,
  author = {Kelechi G. Kalu and Sofia Okorafor and Tanmay Singla and Sophie Chen and Santiago Torres-Arias and James C. Davis},
  title = {Why Johnny Adopts Identity-Based Software Signing: A Usability Case Study of Sigstore},
  booktitle = {35th USENIX Security Symposium (USENIX Security 26)},
  year = {2026},
  publisher = {USENIX Association},
  url = {https://www.usenix.org/conference/usenixsecurity26/presentation/kalu},
  note = {Prepublication}
}

@inproceedings{usenixsecurity25-kalu,
  author = {Kelechi G. Kalu and Tanmay Singla and Chinenye Okafor and Santiago Torres-Arias and James C. Davis},
  title = {An Industry Interview Study of Software Signing for Supply Chain Security},
  booktitle = {34th USENIX Security Symposium (USENIX Security 25)},
  year = {2025},
  isbn = {978-1-939133-52-6},
  address = {Seattle, WA},
  pages = {81--100},
  url = {https://www.usenix.org/conference/usenixsecurity25/presentation/kalu},
  publisher = {USENIX Association},
  month = aug
}

@inproceedings{DBLP:conf/sp/SchorlemmerKCKIBTD24,
  author = {Taylor R. Schorlemmer and Kelechi G. Kalu and Luke Chigges and Kyung Myung Ko and Eman Abu Ishgair and Saurabh Bagchi and Santiago Torres-Arias and James C. Davis},
  title = {Signing in Four Public Software Package Registries: Quantity, Quality, and Influencing Factors},
  booktitle = {IEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024},
  pages = {1160--1178},
  publisher = {IEEE},
  year = {2024},
  url = {https://doi.org/10.1109/SP54263.2024.00215},
  doi = {10.1109/SP54263.2024.00215}
}

@misc{kalu2026armsvisionactorreputation,
  title = {ARMS: A Vision for Actor Reputation Metric Systems in the Open-Source Software Supply Chain},
  author = {Kelechi G. Kalu and Sofia Okorafor and Bet{\"u}l Durak and Kim Laine and Radames C. Moreno and Santiago Torres-Arias and James C. Davis},
  year = {2026},
  eprint = {2505.18760},
  archivePrefix = {arXiv},
  primaryClass = {cs.CR},
  url = {https://arxiv.org/abs/2505.18760}
}

@misc{kalu2026operationalizingresearchsoftwaresupply,
  title = {Operationalizing Research Software for Supply Chain Security},
  author = {Kelechi G. Kalu and Soham Rattan and Taylor R. Schorlemmer and George K. Thiruvathukal and Jeffrey C. Carver and James C. Davis},
  year = {2026},
  eprint = {2601.20980},
  archivePrefix = {arXiv},
  primaryClass = {cs.SE},
  url = {https://arxiv.org/abs/2601.20980}
}

@misc{peng2025agentsperformcodeoptimization,
  title = {How Do Agents Perform Code Optimization? An Empirical Study},
  author = {Huiyun Peng and Antonio Zhong and Ricardo Andr{\'e}s Calvo M{\'e}ndez and Kelechi G. Kalu and James C. Davis},
  year = {2025},
  eprint = {2512.21757},
  archivePrefix = {arXiv},
  primaryClass = {cs.SE},
  url = {https://arxiv.org/abs/2512.21757}
}

@article{Schorlemmer_2025,
  title = {Establishing Provenance Before Coding: Traditional and Next-Generation Software Signing},
  volume = {23},
  issn = {1558-4046},
  url = {http://dx.doi.org/10.1109/MSEC.2025.3537616},
  doi = {10.1109/msec.2025.3537616},
  number = {2},
  journal = {IEEE Security & Privacy},
  publisher = {Institute of Electrical and Electronics Engineers (IEEE)},
  author = {Schorlemmer, Taylor R. and Burmane, Ethan H. and Kalu, Kelechi G. and Torres-Arias, Santiago and Davis, James C.},
  year = {2025},
  month = mar,
  pages = {14--22}
}

@inproceedings{Patil_2025,
  title = {Recommending Pre-Trained Models for IoT Devices},
  url = {http://dx.doi.org/10.1109/SERP4IoT66600.2025.00007},
  doi = {10.1109/serp4iot66600.2025.00007},
  booktitle = {2025 IEEE/ACM 7th International Workshop on Software Engineering Research & Practices for the IoT (SERP4IoT)},
  publisher = {IEEE},
  author = {Patil, Parth V. and Jiang, Wenxin and Peng, Huiyun and Lugo, Daniel and Kalu, Kelechi G. and LeBlanc, Josh and Smith, Lawrence and Heo, Hyeonwoo and Aou, Nathanael and Davis, James C.},
  year = {2025},
  month = apr,
  pages = {17--21}
}

@inproceedings{Singla_2023,
  series = {CCS '23},
  title = {An Empirical Study on Using Large Language Models to Analyze Software Supply Chain Security Failures},
  url = {http://dx.doi.org/10.1145/3605770.3625214},
  doi = {10.1145/3605770.3625214},
  booktitle = {Proceedings of the 2023 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses},
  publisher = {ACM},
  author = {Singla, Tanmay and Anandayuvaraj, Dharun and Kalu, Kelechi G. and Schorlemmer, Taylor R. and Davis, James C.},
  year = {2023},
  month = nov,
  pages = {5--15},
  collection = {CCS '23}
}

@inproceedings{Kalu_2023,
  series = {ESEC/FSE '23},
  title = {Reflecting on the Use of the Policy-Process-Product Theory in Empirical Software Engineering},
  url = {http://dx.doi.org/10.1145/3611643.3613075},
  doi = {10.1145/3611643.3613075},
  booktitle = {Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering},
  publisher = {ACM},
  author = {Kalu, Kelechi G. and Schorlemmer, Taylor R. and Chen, Sophie and Robinson, Kyle A. and Kocinare, Erik and Davis, James C.},
  year = {2023},
  month = nov,
  pages = {2112--2116},
  collection = {ESEC/FSE '23}
}

@misc{kalu2026longitudinalstudyusabilityidentitybased,
  title = {A Longitudinal Study of Usability in Identity-Based Software Signing},
  author = {Kelechi G. Kalu and Hieu Tran and Santiago Torres-Arias and Sooyeon Jeong and James C. Davis},
  year = {2026},
  eprint = {2603.17133},
  archivePrefix = {arXiv},
  primaryClass = {cs.SE},
  url = {https://arxiv.org/abs/2603.17133}
}

@misc{davis2025guidestakeholderanalysiscybersecurity,
  title = {A Guide to Stakeholder Analysis for Cybersecurity Researchers},
  author = {James C Davis and Sophie Chen and Huiyun Peng and Paschal C Amusuo and Kelechi G Kalu},
  year = {2025},
  eprint = {2508.14796},
  archivePrefix = {arXiv},
  primaryClass = {cs.CR},
  url = {https://arxiv.org/abs/2508.14796}
}

@misc{kalu2025softwaresigningstillmatters,
  title = {Why Software Signing (Still) Matters: Trust Boundaries in the Software Supply Chain},
  author = {Kelechi G. Kalu and James C. Davis},
  year = {2025},
  eprint = {2510.04964},
  archivePrefix = {arXiv},
  primaryClass = {cs.SE},
  url = {https://arxiv.org/abs/2510.04964}
}