Post #1835411

Reproducible builds are a valuable property for remote attestation workflows but often hard to maintain. We faced a special challenge building reproducible artifacts that contain signatures. Together with @Euler I wrote a blog post about how we used ECDSA public key recovery to generate signatures that match exactly one artifact, can be reproduced by a verifier, and are secure, without anyone ever knowing a private key. https://katexochen.aro.bz/posts/reproducible-secure-signatures/ #ReproducibleBuilds #RemoteAttestation #Cryptography #ConfidentialComputing #Infosec