Description
A reliable supply chain is highly relevant to guarantee the security of software. Possible attacks
aim against the host platform or the build tools to inject malicious code into a build artifact.
Although reproducible builds try to solve this problem, the effort to rebuild the entire software
is often not practical. Other approaches aim to solve this problem by building on hosted cloud
platforms. However, further solutions are needed because trust is required in the host platform
to verify the produced artifact and the build process.
We present a design that provides a secure build environment and verifies the build process
through hardware-based attestation. We use confidential virtual machines to ensure that the
build environment is tamper-proof and to protect it against the host platform. We produce an
attestation report that allows for later verification of the build environment and created artifact
without the need for reproduction.
Our proof of concept shows the feasibility of our design. The build environment is reusable and
can be customized using containers to supply the required build tools. Our approach protects
the build process even if the remote host platform is compromised. It ensures the integrity of
the supply chain through cost-effective verification.
|
Thesis topic in co-operation with the Fraunhofer Institute for Applied and Integrated Security AISEC, Garching