An Evidence-driven Protocol for Trustworthy CI Pipelines

• URL: http://arxiv.org/abs/2605.21089v1
• Date: Wed, 20 May 2026 12:22:20 GMT
• Title: An Evidence-driven Protocol for Trustworthy CI Pipelines
• Abstract summary: This paper presents an evidence-driven protocol for trustworthy Continuous Integration pipelines.<n>It combines Deterministic Build Systems (DBS) with Trusted Execution Environments (TEEs)<n>The approach provides cryptographically verifiable guarantees of integrity, authenticity, and attestation for CI artifacts in distributed environments.
• Score: 37.76528129929801
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Enterprise software supply chains are increasingly vulnerable to infrastructure attacks, resulting in financial and reputational damage. Ensuring the integrity and provenance of software artifacts remains a significant challenge, where re-execution of the build and tests by every consumer to guarantee provenance produces a verification bottleneck and credibility reduction. This paper presents an evidence-driven protocol for trustworthy Continuous Integration (CI) pipelines that combines Deterministic Build Systems (DBS) with Trusted Execution Environments (TEEs). The approach provides cryptographically verifiable guarantees of integrity, authenticity, and attestation for CI artifacts in distributed environments, reducing implicit trust without requiring costly re-execution by consumers. We introduce a protocol that binds deterministic builds with TEE-based attestations, formalizing the evidence life cycle, together with a practical implementation using Nix and Intel TDX. Experimental results show that artifact verification is reduced from redundant computation to lightweight signature and policy checks. These findings demonstrate that evidence-driven CI pipelines establish scalable and verifiable trust in digital infrastructure, effectively amortizing the initial computational overhead introduced by TEEs.

Related papers

• AI Slop and Hallucinations in Vulnerability Assessment: A Survey on Reasoning Failures and Trustworthy Mitigation [48.55515767840701]
  "AI slop" is artifacts, hallucinated vulnerabilities, plausible but incorrect patches, and semantically repackaged bug reports.<n>This paper surveys the empirical evidence, identifies a unifying mechanism, and traces a path toward trustworthy triage.
  arXiv  Detail & Related papers  (2026-08-26T11:48:38Z)
• FedEDAuth -- Federated Embedding Distribution Authentication for Counterfeit IC Detection [0.0]
  Federated Embedding Distribution Authentication (FedEDAuth) is a lightweight, embedding level client authentication framework.<n>FedEDAuth consistently identifies all clients in experimental settings under the byzantine data poisoning attack.<n>After filtering, the federated model achieved a high counterfeit IC classification performance of 94.17% accuracy.
  arXiv  Detail & Related papers  (2026-05-15T12:08:01Z)
• A TEE-Based Architecture for Confidential and Dependable Process Attestation in Authorship Verification [0.0]
  We present the first architecture for continuous process attestation evidence collection inside Trusted Execution Environments (TEEs)<n>We provide hardware-backed tamper resistance against trust-inverted adversaries with graduated input assurance from software-channel integrity (Tier 1) through hardware-bound input (Tier 3)<n>We introduce a resilient evidence chain protocol maintaining chain integrity across TEE crashes, network partitions, and enclave migration.
  arXiv  Detail & Related papers  (2026-02-26T20:17:52Z)
• Proving Circuit Functional Equivalence in Zero Knowledge [4.301822791698451]
  We propose ZK- CEC, the first privacy-preserving framework for hardware formal verification.<n>By combining formal verification and zero-knowledge proof (ZKP), ZK- CEC establishes a foundation for formally verifying IP correctness and security.<n>ZK- CEC successfully verifies practical designs, such as the AES S-Box, within practical time limits.
  arXiv  Detail & Related papers  (2026-01-16T10:43:30Z)
• Document Data Matching for Blockchain-Supported Real Estate [2.9873162504735133]
  This work presents a system that integrates optical character recognition (OCR), natural language processing (NLP), and verifiable credentials (VCs) to automate document extraction, verification, and management.<n>The approach standardizes heterogeneous document formats into VCs and applies automated data matching to detect inconsistencies, while the blockchain provides a decentralized trust layer that reinforces transparency and integrity.<n>The proposed framework demonstrates the potential to streamline real estate transactions, strengthen stakeholder trust, and enable scalable, secure digital processes.
  arXiv  Detail & Related papers  (2025-12-30T20:30:48Z)
• Verification of Lightning Network Channel Balances with Trusted Execution Environments (TEE) [0.05330327625867509]
  This paper introduces a methodology for the verification of LN channel balances.<n>The core contribution is a framework that combines Trusted Execution Environments (TEEs) with Zero-Knowledge Transport Layer Security (zkTLS) to provide strong, hardware-backed guarantees.
  arXiv  Detail & Related papers  (2025-12-12T23:55:12Z)
• ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Search [69.60882125603133]
  We present ReliabilityRAG, a framework for adversarial robustness that explicitly leverages reliability information of retrieved documents.<n>Our work is a significant step towards more effective, provably robust defenses against retrieved corpus corruption in RAG.
  arXiv  Detail & Related papers  (2025-09-27T22:36:42Z)
• ZKPROV: A Zero-Knowledge Approach to Dataset Provenance for Large Language Models [46.71493672772134]
  We introduce ZKPROV, a novel cryptographic framework that enables zero-knowledge proofs of LLM provenance.<n>It allows users to verify that a model is trained on a reliable dataset without revealing sensitive information about it or its parameters.<n>Our method cryptographically binds a trained model to its authorized training dataset(s) through zero-knowledge proofs while avoiding proof of every training step.
  arXiv  Detail & Related papers  (2025-06-26T00:49:02Z)
• Are You Getting What You Pay For? Auditing Model Substitution in LLM APIs [71.7892165868749]
  Commercial Large Language Model (LLM) APIs create a fundamental trust problem.<n>Users pay for specific models but have no guarantee that providers deliver them faithfully.<n>We formalize this model substitution problem and evaluate detection methods under realistic adversarial conditions.<n>We propose and evaluate the use of Trusted Execution Environments (TEEs) as one practical and robust solution.
  arXiv  Detail & Related papers  (2025-04-07T03:57:41Z)
• ACRIC: Securing Legacy Communication Networks via Authenticated Cyclic Redundancy Integrity Check [98.34702864029796]
  Recent security incidents in safety-critical industries exposed how the lack of proper message authentication enables attackers to inject malicious commands or alter system behavior.<n>These shortcomings have prompted new regulations that emphasize the pressing need to strengthen cybersecurity.<n>We introduce ACRIC, a message authentication solution to secure legacy industrial communications.
  arXiv  Detail & Related papers  (2024-11-21T18:26:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.