Verifiability¶

Learn how Caution lets you verify that the code running in confidential compute matches the exact source you intended to deploy, from your application down to the kernel.

What verifiability means¶

Today, most confidential compute solutions do not fully utilize the underlying technology because they do not leverage reproducibility.

By ensuring that the entire software stack, including the compiler and kernel, is reproducible and full-source bootstrapped, we can prove exactly what source code was used to deploy a workload into confidential compute using hardware-backed methods.

Limits of the status quo¶

Most confidential compute solutions today provide what we call "last-mile" reproducibility, or no reproducibility at all. They can show that deployed software has not changed, but they cannot tie it back to the exact source code used to produce it. With last-mile reproducibility, they may verify the integrity of application code, but not dependencies or the kernel, leaving most of the stack impossible to verify.

Caution's approach¶

Caution leverages full-source bootstrapping and reproducibility all the way down to the kernel through StageX and EnclaveOS. This approach makes the entire software stack verifiable.

See also¶