Paul Meyer

The Nix sandbox aims to provide a pure environment by isolating the build environment from the rest of the system. However, some impurities can still affect builds inside the sandbox and lead to reproducibility issues. One of them is the filesystem.

A common example is builds that implicitly depend on inode numbering or directory entry ordering. In some cases, you might even run into a filesystem bug: a build succeeds on one machine, but fails on another with a different filesystem.

To debug these issues, you can now use nix-buildon. It lets you swap out the filesystem underneath the Nix sandbox. By running the sandbox on disorderfs, you can get a deterministic, sorted, or reverse-sorted view of directory entries. This makes it easy to check whether a build depends on filesystem behavior that should not matter in the first place.

https://github.com/katexochen/nix-buildon

I created this at #OceanSprint. 🌊

#Nix #NixOS #ReproducibleBuilds

Dependabot can now update Nix flake inputs: https://github.blog/changelog/2026-04-07-dependabot-version-updates-now-support-the-nix-ecosystem/

The nix flake support in Renovate was broken for some time and only worked for nixpkgs (not sure if that's still the case), so this is an interesting development.

#Nix #NixOS

Fabricked, a new attack on AMD SEV-SNP presented: software-based attack that manipulates memory routing of inter-component communication within the SoC to trick the secure processor into improperly initializing the RPM table. The root cause is a missing check in the secure processor firmware to enforce the Data Fabric is locked down.

https://fabricked-attack.github.io/

#ConfidentialComputing #CloudSecurity #AMD

RE: @trailofbits@infosec.exchange

Trail of Bits published a really interesting audit report on Meta's confidential computing protection for WhatsApp's AI support. One of the findings is an AML injection attack, which I wrote about in a blog post a few weeks ago: https://katexochen.aro.bz/posts/badaml/

There are many other interesting findings, and a lot to learn from them. I really appreciate that they are sharing the full report.

#ConfidentialComputing #CloudSecurity

BadAML exploits host-supplied ACPI tables to get arbitrary code execution inside confidential VMs. We reproduced the attack end-to-end against our stack and built an AML sandbox to stop it. I did a writeup on the original paper that published the attack, our reproducer, and our journey to fix it.

https://katexochen.aro.bz/posts/badaml/

#ConfidentialComputing #Security #Linux

Reproducible builds are a valuable property for remote attestation workflows but often hard to maintain. We faced a special challenge building reproducible artifacts that contain signatures.

Together with @Euler@infosec.exchange I wrote a blog post about how we used ECDSA public key recovery to generate signatures that match exactly one artifact, can be reproduced by a verifier, and are secure, without anyone ever knowing a private key.

https://katexochen.aro.bz/posts/reproducible-secure-signatures/

#ReproducibleBuilds #RemoteAttestation #Cryptography #ConfidentialComputing #Infosec

RE: @filippo@abyssdomain.expert

Trusted Execution Environments (TEEs) like Intel SGX and AMD SEV-SNP and in general hardware attestation are just f***d. All their keys and roots are not PQ and I heard of no progress in rolling out PQ ones, which at hardware speeds means we are forced to accept they might not make it

#ConfidentialComputing #pqc

#Nix

Recordings of OC3 2026 (Open Confidential Computing Conference) are now available:
https://www.youtube.com/playlist?list=PLEhAl3D5WVvSqGrHPmtH9aHly3n2bwkYk

#ConfidentialComputing #Cloud #CloudSecurity #AI

Physical security has become an important aspect of protecting confidential computing workloads. Physical access is typically excluded from hardware vendors' CVM attack models, leaving physical and relay attacks largely unaddressed.
Flashbots and Intel have each been working independently on solutions to help bridge this physical-access gap: https://writings.flashbots.net/mind-the-gap-tee-poc

#ConfidentialComputing #CloudSecurity #TPM

Cool, KVM-based AMD SEV-SNP support was recently added to Cloud Hypervisor! Including support for Google's oak stage0 firmware and IGVM image format.
https://github.com/cloud-hypervisor/cloud-hypervisor/pull/7942

#ConfidentialComputing #virtualization #KVM #CloudHypervisor