))
Binary verification with Trustix starring Adam Höse
アーカイブされたシリーズ ("無効なフィード" status)
When?
This feed was archived on March 27, 2023 17:04 (
Why? 無効なフィード status. サーバーは持続期間に有効なポッドキャストのフィードを取得することができませんでした。
What now? You might be able to find a more up-to-date version using the search function. This series will no longer be checked for updates. If you believe this to be in error, please check if the publisher's feed link below is valid and contact support to request the feed be restored or if you have any other concerns about this.
Manage episode 284022803 series 2809070
コンテンツは Tweag I/O によって提供されます。エピソード、グラフィック、ポッドキャストの説明を含むすべてのポッドキャスト コンテンツは、Tweag I/O またはそのポッドキャスト プラットフォーム パートナーによって直接アップロードされ、提供されます。誰かがあなたの著作権で保護された作品をあなたの許可なく使用していると思われる場合は、ここで概説されているプロセスに従うことができますhttps://ja.player.fm/legal。
We often use pre-built software binaries and trust that they correspond to the program we want. But nothing assures that these binaries were really built from the program's sources and reasonable built instructions. Common, costly supply chain attacks exploit this to distribute malicious software. Trustix, a tool developed by Tweag's Adam Höse, establishes trust in binaries in a different, decentralized manner increasing security and opening up exciting new models for distributed software supply chains and reproducibility checking.
In a nutshell, Trustix verifies the build process that maps build inputs (source code, build instructions, build dependencies) into build outputs (e.g. software binaries) via consensus-based comparison of build logs from several providers. This comparison is only meaningful in ecosystems with a sizeable amount of reproducible packages such as Nix or Guix that recently gain a lot of traction. A byproduct of Trustix is, that reproducibility of software can be tracked on the large scale, across a wide range of hardware and systems.
In this episode, Rok and Adam shine light on the inception, internals and various use cases of Trustix. Check it out and don't forget to look at the support material linked on the Episode's website on compositional.fm.
Special Guest: Adam Höse.
Links:
- NixOps PR — As promised, here is the link to the NixOps PR that was discussed.
- Trustix Introduction — Blog post on Tweag that gives an overview of Trustix.
- The NLNet project page — Trustix is funded by the NLNet foundation via the European Comission's Next Generation Internet program.
- Merkle Tree — As promised, the Wikipedia article about Merkle trees.
- SpectrumOS — Discussions about the particular security model of this operating system initiated the Trustix idea.
16 つのエピソード
シェア
