Re: [PATCH] docs: security: Confidential computing intro and threat model

[Randy Dunlap]

On 4/27/23 09:16, James Bottomley wrote:
> Public but not open source is still a problem.  The federal government
> has walked into several cloud accounts demanding a source code security
> review, which means the code was made public to them but not generally.

Apparently we have different definitions of "public".
I don't call that public.

> Without all customers or some third party being able to build the code
> and verify it (or ideally supply it ... think something like Red Hat
> built the OVMF code this cloud is using and you can prove it using
> their build signatures) how do you know the source you're given
> corresponds to the binary the signature verifies.


-- 
~Randy