3 ms·
> what guarantee do we have that the source code matches the deployed code? What is the answer to this question in general? Genuinely asking, I never considere
by corycal 5y ago
> what guarantee do we have that the source code matches the deployed code?
What is the answer to this question in general? Genuinely asking, I never considered this but it seems like a real concern for any OSS.
- macintux 5y agoI don't know that there is an answer, but I'd think the FAQ should at least mention the concern.
- gigamick 5y agoFair - I will add this.
- endisneigh 5y agoFor an app that exists solely on the client it’s easy to provide a md5 hash that can be verified. This was and still is a popular solution if you torrent to make sure you’re getting what the original seeder intended. The same philosophy applies here. For back end apps it’s inherently not possible.
- charcircuit 5y agoPlease do not use md5 in 2021. At least use something like sha256.
- endisneigh 5y agoAgreed, it was broken a while ago.
- gigamick 5y agoYeah I wondered this myself and my colleagues at the day job and myself were kinda stumped. How does any OSS prove that the repo linked is what is actually deployed?
- fsflover 5y agohttps://reproducible-builds.org/ https://reproducible-builds.org/