On 4/27/23 09:16, James Bottomley wrote: > Public but not open source is still a problem. The federal government > has walked into several cloud accounts demanding a source code security > review, which means the code was made public to them but not generally. Apparently we have different definitions of "public". I don't call that public. > Without all customers or some third party being able to build the code > and verify it (or ideally supply it ... think something like Red Hat > built the OVMF code this cloud is using and you can prove it using > their build signatures) how do you know the source you're given > corresponds to the binary the signature verifies. -- ~Randy
