An Evidence-driven Protocol for Trustworthy CI Pipelines

2026-05-20

AI Summary

This work addresses the vulnerability of enterprise software supply chains to infrastructure-level attacks and the limitations of traditional verification approaches that rely on consumers re-executing builds and tests—a process that incurs significant bottlenecks and erodes trust. To overcome these challenges, the paper proposes an evidence-driven, trustworthy CI pipeline protocol that, for the first time, integrates deterministic builds (based on Nix) with remote attestation from Intel TDX trusted execution environments (TEEs). The authors formally define the evidence lifecycle and introduce lightweight cryptographic signing and policy validation mechanisms. This approach provides strong cryptographic guarantees of integrity, authenticity, and provability for CI artifacts without requiring consumer-side re-execution, substantially improving verification efficiency and system scalability while effectively amortizing the initial overhead introduced by TEEs.

Abstract

Enterprise software supply chains are increasingly vulnerable to infrastructure attacks, resulting in financial and reputational damage. Ensuring the integrity and provenance of software artifacts remains a significant challenge, where re-execution of the build and tests by every consumer to guarantee provenance produces a verification bottleneck and credibility reduction. This paper presents an evidence-driven protocol for trustworthy Continuous Integration (CI) pipelines that combines Deterministic Build Systems (DBS) with Trusted Execution Environments (TEEs). The approach provides cryptographically verifiable guarantees of integrity, authenticity, and attestation for CI artifacts in distributed environments, reducing implicit trust without requiring costly re-execution by consumers. We introduce a protocol that binds deterministic builds with TEE-based attestations, formalizing the evidence life cycle, together with a practical implementation using Nix and Intel TDX. Experimental results show that artifact verification is reduced from redundant computation to lightweight signature and policy checks. These findings demonstrate that evidence-driven CI pipelines establish scalable and verifiable trust in digital infrastructure, effectively amortizing the initial computational overhead introduced by TEEs.

Problem

• software supply chain
• integrity
• provenance
• CI pipelines
• verification bottleneck

Innovation

• Deterministic Build Systems
• Trusted Execution Environments
• Evidence-driven Protocol
• Cryptographic Attestation
• Continuous Integration