4.2 KiB

Raw Blame History

theme	_class	paginate	backgroundColor
gaia	lead	true

Minimalism and security first repository of reproducible and multi-signed OCI images of common open source software toolchains full-source bootstrapped from Stage 0 to the compiler and libraries you'll use.

Minimalism and security first repository

Approach the distribution of a toolchain by ensuring each component uses exactly what it needs to build - no more, no less.

TODO: include image describing traditional package building, by installing every dependency in a single OS, with a comparison of stagex only having mini Containerfiles with just what each project needs.

Rust "hello world"

FROM scratch AS build
COPY --from=stagex/busybox . /
COPY --from=stagex/rust . /
COPY --from=stagex/gcc . /
COPY --from=stagex/binutils . /
COPY --from=stagex/libunwind . /
ADD <<EOF hello.rs
fn main() {
    println!("Hello, world!");
}
EOF
RUN rustc hello.rs
FROM scratch
COPY --from=build ./hello .
CMD ["./hello"]

Reproducible and multi-signed

All packages provided by StageX are built deterministically

All packages are reproduced by multiple developers to ensure their integrity

All packages are signed by well-known PGP keys after being successfully reproduced

OCI images

StageX uses an open standard for images in order to allow the use of different container runtimes

OCI images makes StageX portable and easy to reproduce on all AMD based systems

The only available target at the moment is AMD.

Common open source software

StageX supports 100+ packages, with a focus on supporting software commonly used by developers

Some of the currently available packages include: curl, rust, git, go, bash, tofu...

If you are interested in additionally software being added feel free to open a PR or let us know what you would like to see added.

Full source bootstrapped from Stage 0

The StageX compiler and all libraries necessary to build software are themselves fully bootstrapped and deterministic

Bootstrapped - built up from "nothing" in order to allow verification of how the compiler is built - ensuring there is no malicious code added to it at any point.

Ken Thompson describes the risk of using a compiler which can't be verified to be trustworthy in his seminal paper "Reflections on Trusting Trust"

OK, So What?

There is an entire family of supply chain vulnerabilities which can be eliminated by using StageX

By reducing the number of dependencies needed to run and build software, we remove unnecessary software which can act as an entry point for malicious software such as malware

For example, if using Debian as a base for rust, one ends up using 232 dependencies, where as StageX only requires 4 dependencies

Additionally, there has not been a simple way to verify that a compiler is trusted.

This is because compilers are used to build other compilers, and for a long time, we lost the ability to build up a compiler toolchain from "nothing"

StageX allows us to bootstrap the compiler toolchain, making it easy to verify that no malicious code was introduced at any point, by reviewing the code, and it also does so in a deterministic manner, which makes it simple to further verify the integrity of the binary

What's Next?

Packaging more software

Adding additional container runtimes like Podman and Kaniko

Adding additional chip architecture support such as ARM and RISC-V

Links

Presenter: <your_name>

Matrix Chat: #stagex:matrix.org

Git Repo: https://codeberg.org/stagex/stagex

Big thank you to sponsors who have supported the development of this project:

Turnkey, Distrust, Mysten Labs

4.2 KiB Raw Blame History