CCSI Officer course · Module 08 of 10
Supply chain, reproducible builds and measurements
Attestation proves which bytes are running. This module makes sure those bytes are the ones you reviewed: reproducible builds, image signing, provenance, and managing reference values across releases.
Learning objectives
- Explain why attestation is only as good as the link between source code and measurement
- Describe what makes a build reproducible and how to check it
- Choose between pinning exact measurements and trusting a signing key
- Run a reference-value approval process
Lessons
Lesson 8.1 · 12 min
From source code to measurement
The chain of custody from a reviewed commit to the hash in an attestation report.
Lesson 8.2 · 13 min
Reproducible builds and independent verification
Making builds deterministic so that a third party can rebuild and get the same measurement.
Lesson 8.3 · 12 min
Pinning versus signing, and reference-value governance
Trade-offs between approving exact hashes and trusting a signer, and the approval record an officer keeps.
Check your understanding
Module 8 quiz
6 questions · pass mark 80%
1.What does an attestation report by itself NOT prove?
2.What is a reproducible build?
3.Which is a common cause of non-reproducible images?
4.A KMS policy conditions on PCR8 instead of PCR0. What does that change?
5.Where does the expected value for a Confidential Space workload come from?
6.What should a reference-value approval record contain?
Glossary
- Reproducible build
- A build that yields identical output from the same source and declared toolchain.
- Provenance
- Verifiable metadata describing how, where and from what an artifact was built.
- Digest pinning
- Referencing images or dependencies by content hash rather than mutable tag.
- Signing identity
- A key or certificate whose signature marks an artifact as approved.