Extending #
Cloud Build Systems to Eliminate Transitive #
Trust #
p2p #
nixosCI/CD
> Trusting the output of a build process requires trusting the build
process itself, and the build process of all inputs to that process, and
so on. Cloud build systems, like Nix or Bazel, allow their users to
precisely specify the build steps making up the intended software
supply chain, build the desired outputs as specified, and on this
basis delegate build steps to other builders or fill shared caches with
their outputs. Delegating build steps or consuming artifacts from
shared caches, however, requires trusting the executing builders,
which makes cloud build systems better suited for centrally man-
aged deployments than for use across distributed ecosystems. We
propose two key extensions to make cloud build systems better
suited for use in distributed ecosystems. Our approach attaches
metadata to the existing cryptographically secured data structures
and protocols, which already link build inputs and outputs for the
purpose of caching. Firstly, we include builder provenance data,
recording which builder executed the build, its software stack, and
a remote attestation, making this information verifiable. Secondly,
we include a record of the outcome of how the builder resolved
each dependency. Together, these two measures eliminate transitive
trust in software dependencies, by enabling users to perform verifi-
cation of transitive dependencies independently, and against their
own criteria, at time of use. Finally, we explain how our proposed
extensions could theoretically be implemented in Nix in the future.
dl.acm.org/doi/pdf/10.1145/368…
