StageX: Rebuilding Trust Through Multi-Signed, Full-Source Bootstrapped, and Reproducible Builds
summary
StageX rebuilds distribution trust by requiring bit-for-bit reproducible builds that are bootstrapped from 181 bytes of machine code and released only after a quorum of independent, hardware-backed signatures; it uses OCI images for packaging, LLVM for cross-compiling, musl/mimalloc/mold for runtime/linking, and validates builds across multiple machines and countries. Current gaps: Ada and Haskell lack full bootstrappability, Zig pulls a WASM binary, timestamps often break hashes, and automated multi-arch native validation is work in progress.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:01Multi-signed builds rebuild trust
- 2:03Key terms and threat model
- 3:49Trust history and supply chain attacks
- 6:15Full source bootstrapping requirements
- 7:19Risks of single maintainer trust
- 8:43Multi-system and multi-location builds
- 10:30OCI images for container-native distribution
- 11:50StageX technical decisions
- 13:35Building packages with container files
- 13:55Hello World multi-arch examples
- 15:01Current limitations and future goals
- 16:47Mirror and source review challenges
- 18:57Q&A
related talks
30mHow Secure Is Your Build/Server?
18mYou Can Sign It, But Can You Trust It? Securing the Compilation Process
43mBuilding Trust Through Proactive Security - Key Parts of the Trus...
17mVerifiable Build Environments in the Cloud: Powered by Sigstore and Enclaves
49mSecure Boot from A to Z
27mBuilding Trust Through Proactive Security - Key Parts of the Trusted Software Supply Chain
46mVerifiable End To End Secure OCI Native Machines
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...