CHAINIAC: Proactive Software-Update Transparency...
summary
CHAINIAC builds a decentralized update pipeline where independent witness servers collectively verify source-to-binary correspondence and produce a single collective signature so clients accept only widely disclosed releases. It combines verified builds (witnesses reproducibly build and attest binaries) with a tamper-evident collectively signed skipchain that embeds forward/backward links for efficient, offline validation. Prototype evaluation on Debian shows ~5 minutes per package validation and ~20 seconds for an aggregate snapshot, with PyPI tests cutting client bandwidth to about one-fifth.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:19Software Updates
- 2:02Software Release Pipeline
- 2:38Challenges
- 6:07Roadmap to CHAINIAC
- 6:19Decentralized Release-Approval
- 8:17Background
- 8:51Verified Builds
- 11:07Anti-equivocation Measures
- 12:12Evolution of Developer Keys
- 13:02Evolution of Cothority Configuration
- 14:43Skipchains
- 17:52Implementation
- 18:17Evaluation Methodology
- 21:36Conclusion
related talks
19mCollective Authorities: Transparency & Decentralized Trust...
30mHow Secure Is Your Build/Server?
30mBringing Continuous Delivery to Open Source
33mGrowing the Chain: Trusting Build Provenance from Userspace
54mBenchmarking the Security of Your Software Supply Chain- 33mGrowing the Chain: Trusting Build Provenance from Userspace
47mSecure software supply chain on a shoestring budget
23mMastering Secure Software Supply Chains