  Trusted computing defines how to securely measure, store, and verify the
integrity of software controlling a computer. One of the major challenges that
make them hard to be applied in practice is the issue with software updates.
Specifically, an operating system update causes the integrity violation because
it changes the well-known initial state trusted by remote verifiers, such as
integrity monitoring systems. Consequently, the integrity monitoring of remote
computers becomes unreliable due to the high amount of false positives. We
address this problem by adding an extra level of indirection between the
operating system and software repositories. We propose a trusted software
repository (TSR), a secure proxy that overcomes the shortcomings of previous
approaches by sanitizing software packages. Sanitization consists of modifying
unsafe installation scripts and adding digital signatures in a way software
packages can be installed in the operating system without violating its
integrity. TSR leverages shielded execution, i.e., Intel SGX, to achieve
confidentiality and integrity guarantees of the sanitization process. TSR is
transparent to package managers, and requires no changes in the software
packages building and distributing processes. Our evaluation shows that running
TSR inside SGX is practical; since it induces only ~1.18X performance overhead
during package sanitization compared to the native execution without SGX. TSR
supports 99.76% of packages available in the main and community repositories of
Alpine Linux while increasing the total repository size by 3.6%.
