[Notes] Verifiable Provenance of Software Artifacts with Zero-Knowledge Compilation

Paper

The interesting idea here is shifting software provenance from reproducing or trusting a build to cryptographically verifying the computation itself. Reproducible builds effectively say “repeat my computation”; TEE-based systems attest that trusted hardware performed it. COSMICTURTLE instead runs compilation inside the RISC Zero zkVM and produces the binary plus a succinct proof binding the claimed source, compiler, and output.

The prototype runs unmodified ChibiCC and successfully zk-compiles 252 C programs, including OpenSSL and libsodium source files. Adversarial tests reject compiler substitution, source or binary tampering, and replay. This is still far from proving an industrial GCC/LLVM build graph, but it suggests that software provenance can be dealt with as a verifiable-computation problem rather than primarily a reproducibility or hardware-attestation problem.