Notes: Kettle: Attested Builds for Verifiable Software Provenance

Kettle turns build provenance from an assertion into hardware-rooted evidence. It runs builds inside a measured confidential VM, records source, resolved dependencies, toolchain, environment, and output digests as SLSA/in-toto provenance, then commits the provenance hash into the TEE attestation report. Verification becomes an attestation check plus digest comparisons rather than trusting CI infrastructure or reproducing the build.

The interesting part is the composition: Kettle reproducibly builds its own CVM image, providing a way to derive the expected launch measurement; uses a Merkle commitment over build inputs; and can optionally attest the CVM before confidentially delivering source. Reproducibility answers whether another build produces the same bytes; attestation proves that one measured environment actually observed specific inputs and produced specific bytes.

The broader lesson is that attestation can move build infrastructure outside the trust boundary—but verifier policy still determines which measured builders deserve trust.