Provable Hermetic Builds: Cryptographic Proof That Your Software Was Built in Isolation

How do you prove a build actually ran in an isolated environment with no network access? Not trust — prove. With cryptographic evidence that can be verified after the fact. In this session, Adolfo García Veytia (Puerco), founder of Carabiner Systems, and Marina Moore, Head of Research at Edera, demonstrate a system that combines Edera's per-workload microVM isolation with SPIFFE/SPIRE identity, in-toto attestations, and a policy engine called Ample to produce builds that are provably hermetic. The session includes a live demo running inside an Edera zone with network disabled, generating signed attestations that cryptographically bind build artifacts to the isolated environment that produced them. Topics covered: -What hermetic builds actually require and why existing CI environments can't guarantee them -How Edera zones provide hardware-enforced isolation for build workloads, with each build running in its own kernel -SPIFFE/SPIRE node attestation through the Edera hypervisor — verifying the build environment from hardware up, not just from the OS -Cocoon: a builder that packages source code, dependencies, and policy into a single container that refuses to run unless its environment passes attestation -The Ample policy engine: defining tenets in CEL (Common Expression Language) that inspect zone state, verify hermeticity, and gate builds -Live demo: running a Go build inside an Edera zone with no network interfaces, generating SLSA Build Provenance and SBOMs signed with the zone's SPIFFE SVID -Short-term vs. long-term verification: SPIRE-based verification for immediate use, SigStore bundles for verification years later -How this maps to the SLSA Build Environment Track for supply chain security compliance https://github.com/carabiner-labs/ede... This session is part of Edera's Sandbox Summer Webinar Series. Originally presented at Open Source Summit in abbreviated form — this is the full-length version with complete demo. 0:00 Introduction and Background 1:16 Meet the Speakers: Puerco and Marina Moore 3:24 Edera Architecture for Secure Builds 5:33 SPIFFE/SPIRE and Hypervisor-Level Attestation 8:22 How the Build Pipeline Works: Cocoon, Ample, and Attestations 13:32 Live Demo: Configuring Policies and Building in an Edera Zone 17:48 Running the Hermetic Build Inside a Zone 25:22 Inspecting Attestations and Policy Results 32:00 Running With Hermeticity Enforced 40:34 Verifying SLSA Build Provenance and SBOMs 44:40 Short-Term vs. Long-Term Verification: SPIRE and SigStore 46:30 Wrap-Up and Q&A