0

Part of our project includes an open source GO server that we have open sourced for transparency. How can we prove that we havent made any alterations to the code before we deployed it?

closed as too broad by gnat, candied_orange, Basile Starynkevitch, BobDalgleish, Robert Harvey Jun 1 at 0:33

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Who is asking for the proof? – BobDalgleish May 30 at 21:17
  • 1
    Include a digital signature with your code and your binary, using some public utility like PGP. Whoever wants to can verify the digital signature against their own binary. – Robert Harvey May 30 at 21:17
  • 1
    Running code and deploying code are different things. Please make clear which you really mean. – candied_orange May 30 at 22:41
  • 1
    Its not the binary we are concerned with, but actually being able to prove that what we have running is exactly what the code is providing. We have considered an outside auditor, but i was hoping for a technical mechanism. – r2DoesInc May 30 at 22:54
  • 1
    The only way that I know of to do what you're describing is to let users of your open source project compile from source and deploy the executable themselves. – Robert Harvey May 31 at 0:17
1

No that is impossible. Even if you included a service method that has some challenge/response mechanism, the service provider could run a proxy and pass on the request. And any mechanism could be reproduced easily because it is all open.

Even knowing they are running the same sever would not guarantee it would behave as expected. Results could be input dependent and the input could be local/configurable, impossible for you to verify.

I understand, transparency is all the rage now and you basically want to proof you are not Facebook, right? I would dedicate a page on my website to this and provide the warm feeling from there. You will need a good text writer though.

1

The only way I know you could solve is by find a trusted third party, hand your code over to them and let them compile and run it (maybe on a neutral cloud platform). If you want to provide / host the server on your own, you will probably have to let the trusted third party audit your internal processes.

  • That was my thought for having an outside auditor come and validate our statements. – r2DoesInc May 31 at 16:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.