We often use pre-built software binaries and trust that they correspond to the program we want. But nothing assures that these binaries were really built from the program's sources and reasonable built instructions. Common, costly supply chain attacks exploit this to distribute malicious software. Trustix, a tool developed by Tweag's Adam Höse, establishes trust in binaries in a different, decentralized manner increasing security and opening up exciting new models for distributed software supply chains and reproducibility checking.In a nutshell, Trustix verifies the build process that maps build inputs (source code, build instructions, build dependencies) into build outputs (e.g. software binaries) via consensus-based comparison of build logs from several providers. This comparison is only meaningful in ecosystems with a sizeable amount of reproducible packages such as Nix or Guix that recently gain a lot of traction. A byproduct of Trustix is, that reproducibility of software can be tracked on the large scale, across a wide range of hardware and systems.In this episode, Rok and Adam shine light on the inception, internals and various use cases of Trustix. Check it out and don't forget to look at the support material linked on the Episode's website on compositional.fm. Special Guest: Adam Höse.