This isn’t just about reproducibility: it touches auditor trust, SBOM
completeness, and the future of supply chain assurance. Worth a skim if you
care about provable software integrity.
Automatic Bill of Materials (2023)
embeds source file hashes into binaries with compressed Bloom filters, making
it easy to check whether known-vulnerable code is present.
Remote Attestation with Constrained Disclosure
(2023) proposes a selective log disclosure mechanism for TPM-based
attestation. It uses non-interactive zero-knowledge (NIZK) proofs over IMA logs
to let systems prove integrity without revealing full software inventories.
The selective disclosure primitives introduced here are interesting beyond
privacy—for example, for fine-grained trust delegation across supply chains.
Here’s a modern classic:
Reflections on Trusting Distributed Trust
(2022) proposes an auditable deployment model using trusted execution
environments and append-only logs to solve distributed trust bootstrapping
without expensive cross-organization coordination.
I found it an approachable, practical read that is relevant to supply chain
integrity and multiparty, privacy-preserving computation.
Worth a read if you touch distributed systems and transparency in your work.
Revocation isn’t just an IoT issue. It connects to many topics, from membership
proofs—à la Automatic Bill of Materials—to transparency log auditing. I liked
that this paper goes all the way down to practical implementation details but
still takes time to introduce basic concepts for the reader.