Title: Wasn&#x27;t really sure how to make the title descriptive enough without putting the full question there.<p>Anyway, I have been toying with the idea of creating an open-source web application. Open-source in the way that I would host the product on my own servers but the full source code, except, of course, authentication info, tokens and things which shouldn&#x27;t be under source control anyway, would be available on Github. Anyone would also be able to set up a self-hosted version of the product, and if anyone wanted to contribute, I would accept pull requests, etc.<p>The idea behind that was that, since it would be targeted mostly at a tech-savy crowd and deals with personal information, I would like to introduce some level of trust that I&#x27;m not doing anything sneaky or unexpected behind the scenes (like storing information I shouldn&#x27;t be).<p>So basically I started wondering if it is possible to implement a way people could verify that the same code they see on the Github repo is the code that&#x27;s also running on the live hosted site? I will be working with node.js, but I don&#x27;t think the tech stack is too relevant here.<p>The client-side part, as I imagined it, would be relatively trivial to verify - run the build part locally, compare fingerprint of the live code and the local version.<p>But my idea got stuck on the server side. Since there, even if I would make a server side endpoint that returns the fingerprint of the live code, there is no way for someone to check what is actually going on, I could just as well return a static file with a hardcoded fingerprint.<p>I&#x27;m sure someone has dealt with or thought about similar problems before, and I would be happy to hear some insights. Feels like this might be a pipe dream, but at least some level of verification would be nice to achieve.
Upvote: