diff --git a/linux-distros/img/SolarWinds-logo.png b/linux-distros/img/SolarWinds-logo.png new file mode 100644 index 0000000..b40084a Binary files /dev/null and b/linux-distros/img/SolarWinds-logo.png differ diff --git a/linux-distros/img/airgap-os.png b/linux-distros/img/airgap-os.png new file mode 100644 index 0000000..70c873a Binary files /dev/null and b/linux-distros/img/airgap-os.png differ diff --git a/linux-distros/img/binary-exploit-2.png b/linux-distros/img/binary-exploit-2.png new file mode 100644 index 0000000..56b1a5e Binary files /dev/null and b/linux-distros/img/binary-exploit-2.png differ diff --git a/linux-distros/img/binary-tampering.png b/linux-distros/img/binary-tampering.png new file mode 100644 index 0000000..76ed767 Binary files /dev/null and b/linux-distros/img/binary-tampering.png differ diff --git a/linux-distros/img/demo-auto.gif b/linux-distros/img/demo-auto.gif new file mode 100644 index 0000000..dc58132 Binary files /dev/null and b/linux-distros/img/demo-auto.gif differ diff --git a/linux-distros/img/distrust-logo.png b/linux-distros/img/distrust-logo.png new file mode 100644 index 0000000..059b7d5 Binary files /dev/null and b/linux-distros/img/distrust-logo.png differ diff --git a/linux-distros/img/expanded-3-hashes.png b/linux-distros/img/expanded-3-hashes.png new file mode 100644 index 0000000..f2ad15b Binary files /dev/null and b/linux-distros/img/expanded-3-hashes.png differ diff --git a/linux-distros/img/logo-and-typemark.svg b/linux-distros/img/logo-and-typemark.svg new file mode 100644 index 0000000..00b06e3 --- /dev/null +++ b/linux-distros/img/logo-and-typemark.svg @@ -0,0 +1,149 @@ + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/linux-distros/img/stagex-chart-0.png b/linux-distros/img/stagex-chart-0.png new file mode 100644 index 0000000..f3dfec9 Binary files /dev/null and b/linux-distros/img/stagex-chart-0.png differ diff --git a/linux-distros/img/stagex-chart-1.png b/linux-distros/img/stagex-chart-1.png new file mode 100644 index 0000000..051e3bd Binary files /dev/null and b/linux-distros/img/stagex-chart-1.png differ diff --git a/linux-distros/img/stagex-logo.png b/linux-distros/img/stagex-logo.png new file mode 100644 index 0000000..c172312 Binary files /dev/null and b/linux-distros/img/stagex-logo.png differ diff --git a/linux-distros/img/xcodeghost.jpg b/linux-distros/img/xcodeghost.jpg new file mode 100644 index 0000000..a3082db Binary files /dev/null and b/linux-distros/img/xcodeghost.jpg differ diff --git a/linux-distros/img/xzbackdoor.png b/linux-distros/img/xzbackdoor.png new file mode 100644 index 0000000..4f87f57 Binary files /dev/null and b/linux-distros/img/xzbackdoor.png differ diff --git a/linux-distros/index.html b/linux-distros/index.html new file mode 100644 index 0000000..3f17cfb --- /dev/null +++ b/linux-distros/index.html @@ -0,0 +1,337 @@ +
+

+
+
+

Anton Livaja

+

Co-Founder & Security Engineer at Distrust (https://distrust.co)

+
    +
  • +

    Firm specializing in high assurance security consulting and engineering.

    +
    • +
  • +

    Clients: blockchain labs and companies, fin-tech, hedge funds, exchanges,
    +electrical grid operators, healthcare providers, etc.

    +
    • +
+
+
+

Trends in Supply Chain Security

+

"[Supply chain threats increased by 1300% between 2020 and 2023]"

+
    +
  • 2025 Software Supply Chain Security Report by ReversingLabs.
    • +
+
+
+

Linux Usage Statistics

+
    +
  • +

    70%+ servers run Linux

    +
    • +
  • +

    ~5% desktop / laptop users use Linux

    +
    • +
  • +

    ~12 widely used Linux distributions

    +
    • +
+
+
+

Open Source vs Proprietary

+
    +
  • +

    High risk environments require verifiability

    +
    • +
  • +

    Proprietary software = security through obscurity

    +
    • +
+
+
+

What is a "Linux Distribution"

+
    +
  • +

    Linux kernel

    +
    • +
  • +

    Software "packages"

    +
    • +
  • +

    Package manager

    +
    • +
  • +

    But they are not all equal...

    +
    • +
+
+
+

Linux Distribution Security

+
    +
  • +

    What machine are packages built on?

    +
    • +
  • +

    Who maintains your Linux packages?

    +
    • +
  • +

    How are the packages delivered?

    +
    • +
+
+
+

Anatomy of a Package

+
    +
  • +

    Mainainer creates a "package"

    +
    • +
  • +

    The package is reviewed

    +
    • +
  • +

    A centralized server builds the binary and signs it

    +
    • +
+
+
+

Underutilized Strategies

+
    +
  • +

    Reproducible / deterministic builds

    +
    • +
  • +

    Full source bootstrapping

    +
    • +
  • +

    Cryptographic signing

    +
    • +
+
+
+

Reproducibility / Determinism

+
+
+

+
+
+

no-tamper-evidence

+
+
+

+
+
+

How Deep Do We Have to Go?

+
    +
  • +

    Compiler

    +
    • +
  • +

    Build and Runtime Environment

    +
      +
    • +

      Operating System + Packages

      +
      • +
    • +

      Additional CLI / Tools

      +
      • +
    +
    • +
  • +

    Software Application

    +
      +
    • +

      First Party Code

      +
      • +
    • +

      Third Party Code

      +
      • +
    +
    • +
+
+
+

Full Source Bootstrapping

+
+
+

+
+
+

Who Compiles the Compiler?

+
    +
  • +

    Mostly downloaded as a binary

    +
    • +
  • +

    Even if the compiler is built from source, usually another compiler is used to do so

    +
    • +
  • +

    This means there is no clear providence to how we went from nothing to having a usable compiler

    +
    • +
+
+
+

Bootstrapping Compilers

+
    +
  • +

    Consists of "stages", and hundreds of steps of starting from a human auditable rudimentary compiler and building up all the way up to a modern compiler

    +
    • +
  • +

    Bootstrapping programming languages

    +
    • +
+
+
+

Cryptographic Signing

+
    +
  • +

    Code signing

    +
    • +
  • +

    Artifact signing

    +
    • +
  • +

    Multi-person signing

    +
    • +
+
+
+

+
+
+

[Stageˣ]

+

Open source Linux Distribution

+
    +
  • Minimal, bootstrapped, hermetic, and deterministic
    • +
+
+
+

+
+
+

+
+
+

Full source bootstrapped from Stage 0

+

From a <190 byte compiler written in machine code, StageX bootstraps all the
+compiler tools necessary to build the distribution, 100% deterministically.

+
    +
  • Stage 0: Getting a basic C compiler on x86 from hex0
    • +
  • Stage 1: Building GCC for x86
    • +
  • Stage 2: Upgrading GCC for x86_64
    • +
  • Stage 3: Building up-to-date toolchains
    • +
  • Stage X: Shipping the software you know and love
    • +
+
+
+

A Rust Example

+
FROM stagex/pallet-rust@sha256:b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c AS build
+ADD . /src
+WORKDIR /src
+ARG TARGET x86_64-unknown-linux-musl
+RUN cargo build --release --target ${TARGET}
+
+FROM scratch
+COPY --from=build /app/target/${TARGET}/release/hello /usr/bin/hello
+CMD ["/usr/bin/hello"]
+
+
+
+

All packages in StageX are:

+
    +
  • +

    Built using hash-locked sources

    +
    • +
  • +

    Confirmed reproducible by multiple developers

    +
    • +
  • +

    Signed by multiple release maintainers

    +
    • +
+
+
+

Pallets

+

StageX offers prebuilt containers including all the packages necessary to run some of our most used software, such as:

+
    +
  • rust
    • +
  • go
    • +
  • nodejs
    • +
  • nginx
    • +
  • redis
    • +
  • postgres
    • +
+
+
+

+
+
+

QubesOS

+
+
+

Key Takeaways

+
    +
  • +

    Full-source bootstrap

    +
    • +
  • +

    Use bit for bit determinism

    +
    • +
  • +

    Leverage cryptographic signing

    +
    • +
+
+
+

What's Next?

+
    +
  • +

    Adding SBOM

    +
    • +
  • +

    Packaging more software

    +
    • +
  • +

    Fully automating software updates

    +
    • +
  • +

    Additional container runtimes like Podman and Kaniko

    +
    • +
  • +

    Additional chip architecture support such as ARM and RISC-V

    +
    • +
+
+
+

How You Can Help

+
    +
  • +

    Provide feedback

    +
    • +
  • +

    Support with development efforts

    +
    • +
  • +

    Become a sponsor

    +
    • +
+
+
+

Links

+

Email: anton@distrust.co / sales@distrust.co

+

Matrix Chat: #stagex:matrix.org

+

Docker Hub: https://hub.docker.com/u/stagex

+

Git Repo: https://codeberg.org/stagex/stagex

+

AirgapOS: https://git.distrust.co/public/airgap

+

EnclaveOS: https://git.distrust.co/public/enclaveos

+
+
\ No newline at end of file diff --git a/linux-distros/index.md b/linux-distros/index.md new file mode 100644 index 0000000..f0b1b11 --- /dev/null +++ b/linux-distros/index.md @@ -0,0 +1,301 @@ +--- +_class: lead +paginate: true +backgroundColor: #fff +--- + + + + +![](img/logo-and-typemark.svg) + +--- + +# Anton Livaja + +Co-Founder & Security Engineer at Distrust (https://distrust.co) + +* Firm specializing in high assurance security consulting and engineering. + +* Clients: blockchain labs and companies, fin-tech, hedge funds, exchanges, +electrical grid operators, healthcare providers, etc. + +--- + +# Trends in Supply Chain Security + +"[Supply chain threats increased by 1300% between 2020 and 2023]" + +- 2025 Software Supply Chain Security Report by ReversingLabs. + +--- + +# Linux Usage Statistics + +* 70%+ servers run Linux + +* ~5% desktop / laptop users use Linux + +* ~12 widely used Linux distributions + +--- + +# Open Source vs Proprietary + +* High risk environments require verifiability + +* Proprietary software = security through obscurity + +--- + +# What is a "Linux Distribution" + +* Linux kernel + +* Software "packages" + +* Package manager + +* But they are not all equal... + +--- + +# Linux Distribution Security + +* What machine are packages built on? + +* Who maintains your Linux packages? + +* How are the packages delivered? + +--- + +# Anatomy of a Package + +* Mainainer creates a "package" + +* The package is reviewed + +* A centralized server builds the binary and signs it + +--- + +# Underutilized Strategies + +* Reproducible / deterministic builds + +* Full source bootstrapping + +* Cryptographic signing + +--- + +# Reproducibility / Determinism + +--- + +![](img/SolarWinds-logo.png) + +--- + +![no-tamper-evidence](https://antonlivaja.com/images/binary-exploit-2.png) + +--- + +![height:600px](https://antonlivaja.com/images/expanded-3-hashes.png) + +--- + +# How Deep Do We Have to Go? + +* Compiler + +* Build and Runtime Environment + + * Operating System + Packages + + * Additional CLI / Tools + +* Software Application + + * First Party Code + + * Third Party Code + +--- + +# Full Source Bootstrapping + +--- + +![](img/xcodeghost.jpg) + +--- + +# Who Compiles the Compiler? + +* Mostly downloaded as a binary + +* Even if the compiler is built from source, usually another compiler is used to do so + +* This means there is no clear providence to how we went from nothing to having a usable compiler + +--- + +# Bootstrapping Compilers + +* Consists of "stages", and hundreds of steps of starting from a human auditable rudimentary compiler and building up all the way up to a modern compiler + +* Bootstrapping programming languages + +--- + +# Cryptographic Signing + +* Code signing + +* Artifact signing + +* Multi-person signing + +--- + +![](img/xzbackdoor.png) + + +--- + +# [Stageˣ] + +Open source Linux Distribution + +* Minimal, bootstrapped, hermetic, and deterministic + +--- + +![](img/stagex-chart-0.png) + +--- + +![](img/stagex-chart-1.png) + +--- +# Full source bootstrapped from Stage 0 + +From a <190 byte compiler written in machine code, StageX bootstraps all the +compiler tools necessary to build the distribution, 100% deterministically. + +- Stage 0: Getting a basic C compiler on x86 from hex0 +- Stage 1: Building GCC for x86 +- Stage 2: Upgrading GCC for x86_64 +- Stage 3: Building up-to-date toolchains +- Stage X: Shipping the software you know and love + +--- + +# A Rust Example + +```dockerfile +FROM stagex/pallet-rust@sha256:b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c AS build +ADD . /src +WORKDIR /src +ARG TARGET x86_64-unknown-linux-musl +RUN cargo build --release --target ${TARGET} + +FROM scratch +COPY --from=build /app/target/${TARGET}/release/hello /usr/bin/hello +CMD ["/usr/bin/hello"] +``` + +--- + +# All packages in StageX are: + +* Built using hash-locked sources + +* Confirmed reproducible by multiple developers + +* Signed by multiple release maintainers + +--- + +# Pallets + +StageX offers prebuilt containers including all the packages necessary to run some of our most used software, such as: + +- `rust` +- `go` +- `nodejs` +- `nginx` +- `redis` +- `postgres` + +--- + +![](img/airgap-os.png) + +--- + +# QubesOS + +--- + +# Key Takeaways + +* Full-source bootstrap + +* Use bit for bit determinism + +* Leverage cryptographic signing + +--- + +# What's Next? + +* Adding SBOM + +* Packaging more software + +* Fully automating software updates + +* Additional container runtimes like Podman and Kaniko + +* Additional chip architecture support such as ARM and RISC-V + +--- + +# How You Can Help + +* Provide feedback + +* Support with development efforts + +* Become a sponsor + +--- + +# Links + +**Email**: anton@distrust.co / sales@distrust.co + +**Matrix Chat**: #stagex:matrix.org + +**Docker Hub**: https://hub.docker.com/u/stagex + +**Git Repo**: https://codeberg.org/stagex/stagex + +**AirgapOS**: https://git.distrust.co/public/airgap + +**EnclaveOS**: https://git.distrust.co/public/enclaveos + + + diff --git a/linux-distros/scripts/alpine.sh b/linux-distros/scripts/alpine.sh new file mode 100644 index 0000000..6c25105 --- /dev/null +++ b/linux-distros/scripts/alpine.sh @@ -0,0 +1,4 @@ +#!/bin/sh + +apk add cargo +printf "DEPS (Alpine): %s\n" $(apk list --installed | tail -n +2 | wc -l) diff --git a/linux-distros/scripts/archlinux.sh b/linux-distros/scripts/archlinux.sh new file mode 100644 index 0000000..c086afe --- /dev/null +++ b/linux-distros/scripts/archlinux.sh @@ -0,0 +1,4 @@ +#!/bin/sh + +pacman -Syu --noconfirm rust +printf "DEPS (Arch Linux): %s\n" $(pacman -Q | wc -l) diff --git a/linux-distros/scripts/debian.sh b/linux-distros/scripts/debian.sh new file mode 100644 index 0000000..42b2745 --- /dev/null +++ b/linux-distros/scripts/debian.sh @@ -0,0 +1,5 @@ +#!/bin/sh + +apt-get update +apt-get install -y cargo rustc +printf "DEPS (Debian): %s\n" $(dpkg --get-selections | wc -l) diff --git a/linux-distros/scripts/fedora.sh b/linux-distros/scripts/fedora.sh new file mode 100644 index 0000000..f0a0091 --- /dev/null +++ b/linux-distros/scripts/fedora.sh @@ -0,0 +1,4 @@ +#!/bin/sh + +yum install -y cargo +printf "DEPS (Fedora): %s\n" $(yum list installed | tail -n +2 | wc -l) diff --git a/linux-distros/scripts/rust-deps.sh b/linux-distros/scripts/rust-deps.sh new file mode 100644 index 0000000..1c49db7 --- /dev/null +++ b/linux-distros/scripts/rust-deps.sh @@ -0,0 +1,7 @@ +#!/bin/sh + +SCRIPTDIR="$(cd "$(dirname $0)"; pwd)" + +for distro in debian archlinux fedora alpine; do + docker run --rm -v "$SCRIPTDIR:/scripts:ro" $distro /bin/sh /scripts/$distro.sh | grep --color "^DEPS" +done