3 ms·
No, gigel82 is right. Transparency logging provides discoverability. That does not mean the transparency logged software is auditable in practice. As gigel82 co
by kfreds 2y ago
No, gigel82 is right. Transparency logging provides discoverability. That does not mean the transparency logged software is auditable in practice. As gigel82 correctly points out, the build hash is not sufficient, nor is the source hash sufficient. The remote attestation quote contains measurements of the boot chain, i.e. hashes of compiled artifacts. Those hashes need to be linked to source hashes by reproducible builds.
- davidczech 2y agoThe OS build and cryptex binaries aligning to the hashes found in the transparency log will be made available for download. These are reconcilable with attestations signed by the SEP. The source code provided is for reference to help with disassembly. Edit link: https://security.apple.com/documentation/private-cloud-compute/verifiabletransparency https://security.apple.com/documentation/private-cloud-compu...