4 ms·

An organisation that is prepared to write "sabotage" software would have no problem deploying software that is different to the software they submit.

• bmacho 3y ago
  Compile the code yourself?
  • mordae 3y ago
    Right. Mandate that the software is delivered with CI pipeline running in the client's environment with 100% reproducible builds and verify checksums.
• Ygg2 3y ago
  Implying that's an impossible obstacle. Reproducibility is a thing. Make it so code needs to be reproducibly buildable. Only reproducibly buildable artifacts can be deployed on hardware. Document the whole process.
• redman25 3y ago
  Doesn't mean it's not a step in the right direction. Any transparency is better than zero.