An Evidence-driven Protocol for Trustworthy CI Pipelines

TL;DR

This paper introduces an evidence-driven protocol for trustworthy CI pipelines that combines deterministic build systems with trusted execution environments to provide cryptographically verifiable guarantees of software artifact integrity and authenticity.

Contribution

It presents a novel protocol that binds deterministic builds with TEE-based attestations, formalizes the evidence lifecycle, and demonstrates practical implementation and efficiency improvements.

Findings

Verification reduces from redundant computation to lightweight checks.

Experimental results show scalable and verifiable trust in CI artifacts.

The approach effectively reduces verification overhead while maintaining security.

Abstract

Enterprise software supply chains are increasingly vulnerable to infrastructure attacks, resulting in financial and reputational damage. Ensuring the integrity and provenance of software artifacts remains a significant challenge, where re-execution of the build and tests by every consumer to guarantee provenance produces a verification bottleneck and credibility reduction. This paper presents an evidence-driven protocol for trustworthy Continuous Integration (CI) pipelines that combines Deterministic Build Systems (DBS) with Trusted Execution Environments (TEEs). The approach provides cryptographically verifiable guarantees of integrity, authenticity, and attestation for CI artifacts in distributed environments, reducing implicit trust without requiring costly re-execution by consumers. We introduce a protocol that binds deterministic builds with TEE-based attestations, formalizing the evidence life cycle, together with a practical implementation using Nix and Intel TDX. Experimental results show that artifact verification is reduced from redundant computation to lightweight signature and policy checks. These findings demonstrate that evidence-driven CI pipelines establish scalable and verifiable trust in digital infrastructure, effectively amortizing the initial computational overhead introduced by TEEs.