A systematic literature review on trust in the software ecosystem

Fang Hou*, Slinger Jansen

*Corresponding author for this work

Research output: Contribution to journalArticleAcademicpeer-review


The worldwide software ecosystem is a trust-rich part of the world. Throughout the software life cycle, software engineers, end-users, and other stakeholders collaboratively place their trust in major hubs in the ecosystem, such as package managers, repository services, and software components. However, as our reliance on software grows, this trust is frequently violated by bad actors and crippling vulnerabilities in the software supply chain. This study aims to define software trust in the worldwide SECO, that is, to determine what signifies a trustworthy system, actor, or hub. We conduct a systematic literature review on the concept of trust in the software ecosystem. We acknowledge that trust is something between two actors in the software ecosystem, and we examine what role trust plays in the relationships between end-users and (1) software products, (2) package managers, (3) software producing organizations, and (4) software engineers. Two major findings emerged from the systematic literature review. To begin, we define trust in the software ecosystem by examining the definition and characteristics of trust. Second, we provide a list of trust factors that can be used to assemble an overview of software trust. Trust is critical in the communication between actors in the worldwide software ecosystem, particularly regarding software selection and evaluation. With this comprehensive overview of trust, software engineering researchers have a new foundation to understand and use trust to create a trustworthy software ecosystem.

Original languageEnglish
Article number8
Pages (from-to)1-38
Number of pages38
JournalEmpirical Software Engineering
Issue number1
Publication statusPublished - Jan 2023


  • Literature review
  • Software ecosystem
  • Software package evaluation
  • Software trust


Dive into the research topics of 'A systematic literature review on trust in the software ecosystem'. Together they form a unique fingerprint.

Cite this