GuixChain: Enforcing Reproducible Builds and Provenance Integrity for Secure Automotive OTA Pipelines

Ensuring the integrity of automotive software, from source code to deployed binaries, has become critical as vehicles increasingly rely on over-the-air (OTA) updates and complex supply chains. The Uptane framework secures OTA update delivery for automotive systems but does not enforce integrity within the upstream software supply chain, leaving the gap between source commits and deployed artifacts unverified. We present GuixChain, a blockchain-backed reproducible build layer that enforces multi-party consensus before artifacts enter OTA pipelines. GuixChain combines deterministic GNU Guix builds, cryptographic SBOM binding, and Hyperledger Fabric smart contracts. Together, these components ensure that only independently verified, bit-identical binaries are deployed.

Evaluation across a consortium representing OEMs, suppliers, and auditors demonstrated reliable reproducibility over 30 build cycles. Fault injection experiments covering four threat categories were fully detected with low latency (1.8–2.4 seconds). The system maintained modest overheads (15–19% CPU, 1.4–3.5.GB memory, 41–60MB disk), with blockchain consensus adding only 2–3 seconds to build verification. Multi-node consensus yielding total build-to-verification time of 30–38 seconds per validator.

By enforcing consensus-based reproducibility upstream of Uptane, GuixChain provides a scalable and verifiable supply chain integrity layer, bridging the gap between source-level trust and safe deployment, while remaining compatible with existing automotive OTA infrastructure.