Is this binary actually built from that public source code?

In this lightning talk, I'd like to share ideas and results from my recent exploration in the opaque binary verification.

Talk TLDR

1. Problem: in ecosystems like apple, devs sign compiled binaries with their certificate/pvt key. in some ecosystems like npm, crates, and more user trust that the platform and dev both are legit.

2. How hackers are exploiting the gap.

3. Approaches to binary verification:

- self build (no trust assumptions, CPU intensive, hardly anyone does),

- delegated build (google's oss rebuild tool)

- zk proof of compilation (5000x overhead from feb 2026 study)

- builds in TEE

- social layer attestations.

4. How social layer attestation can be leveraged today in ethereum consensus/execution client binaries, various design vectors, positives and negatives of this approach.

5. PoC screenshots/GIF verifying an update to ethereum client in a fairly decentralised way.

Speakers: Soham Zemse

Track: Open & Verifiable Stack