The paper shows how Thompson-class attacks aren’t restricted to compilers by
tampering with strip in the NixOS bootstrap seed. The malicious strip
repurposes PT_NOTE as PT_LOAD, and the payload propagates into later
generations of strip rebuilt from clean source. All but one binary in
stdenv ends up infected, without breaking the build or functional tests.
I walked away thinking about diverse artifact structure verification:
population-level artifact checks run from independent trust roots, with
independently built parsers and tooling. Could we come up with a stable ELF
morphology of a distribution and use that to detect a coordinated structural
shift across thousands of unrelated binaries?
The core argument is that coding agents have crossed the threshold where mandatory human code review is no longer economically justified. Human review consumes an
estimated 10–15% of developer time, and scaling code generation while keeping humans as the approval gate simply moves the bottleneck downstream.
Readers might find the implication for SCM architecture most interesting. GitHub/GitLab-like platforms may need first-class agent identities, cryptographically attributable
actions, specialized permissions, structured findings and confidence, and machine-readable review artifacts—not agents impersonating humans through comment threads. Agent
review also seems better described as auditable and replayable than deterministic.
This suggests code review may evolve from a human synchronization gate into continuous agentic assurance, with human inspection becoming a risk-based escalation path in
some scenarios.
Kettle turns build provenance from an assertion into hardware-rooted evidence. It runs builds inside a measured confidential VM,
records source, resolved dependencies, toolchain, environment, and output digests as SLSA/in-toto provenance, then commits the provenance hash into the TEE attestation
report. Verification becomes an attestation check plus digest comparisons rather than trusting CI infrastructure or reproducing the build.
The interesting part is the composition: Kettle reproducibly builds its own CVM image, providing a way to derive the expected launch
measurement; uses a Merkle commitment over build inputs; and can optionally attest the CVM before confidentially delivering source. Reproducibility answers whether another
build produces the same bytes; attestation proves that one measured environment actually observed specific inputs and produced specific bytes.
The broader lesson is that attestation can move build infrastructure outside the trust boundary—but verifier policy still determines which measured builders deserve trust.
I maintain Awesome Software Supply Chain Security, a popular and
comprehensive reference of tools, trends, and challenges in the software supply chain security.
I’ve built Linux distributions of various sizes, from a consumer-focused one
that has millions of end users
to custom-built Linux desktop distributions for the enterprise. From there, I transitioned to
researching how distribution package management, release cadence, and
security are relevant to the open source software supply chain problem.
Source review and reproducible builds alone cannot establish that a compiler binary faithfully implements its source. A trusting-trust attack can survive compiler upgrades
without appearing anywhere in the source tree.
Diverse Double-Compiling (DDC) addresses this by rebuilding the compiler source through an independently trusted compiler, then using that result to rebuild the compiler
again and comparing the resulting executable with the compiler under test. Assuming deterministic builds and sufficient toolchain diversity, equality provides evidence
that the executable corresponds to the reviewed source; divergence exposes either build nondeterminism, a defect, or possible subversion.
The thesis demonstrates this concretely with TCC: a compromised compiler reinfects its successor while also modifying cryptocurrency transaction code, and DDC detects the
subversion. More interestingly, attempts to extend the technique to GCC expose the practical problem: real build graphs quickly expand the trusted surface to assemblers,
linkers, loaders, OSes, firmware, and hardware.
ML provenance is not just software provenance with models added. The interesting problem is that datasets, code, configurations, weights, and execution environments are
coupled through transformations, while models can subsequently be fine-tuned or otherwise adapted. Atlas treats lineage as an authenticated chain of transformations rather
than simply an inventory of artifacts.
The individual mechanisms presented in the paper include Intel TDX, remote attestation, cryptographic measurements, C2PA manifests, and Merkle-tree transparency logs. What
I found interesting is their composition. An attestation client monitors PyTorch/Kubeflow execution, measures inputs and outputs, records runtime/configuration metadata,
and signs a transformation attestation containing hashes of precursor attestations. The transparency service makes these records tamper-evident; verification reconstructs
and validates the lineage.
More broadly, Atlas suggests that ML supply-chain integrity may require authenticating the transformation history, not merely signing the resulting model.
This isn’t just about reproducibility: it touches auditor trust, SBOM
completeness, and the future of supply chain assurance. Worth a skim if you
care about provable software integrity.
Automatic Bill of Materials (2023)
embeds source file hashes into binaries with compressed Bloom filters, making
it easy to check whether known-vulnerable code is present.
Here’s a modern classic:
Reflections on Trusting Distributed Trust
(2022) proposes an auditable deployment model using trusted execution
environments and append-only logs to solve distributed trust bootstrapping
without expensive cross-organization coordination.
I found it an approachable, practical read that is relevant to supply chain
integrity and multiparty, privacy-preserving computation.
Worth a read if you touch distributed systems and transparency in your work.