[uecker]

I assume it is meant to not only have hashes of the final output, but also securely record all steps done by the right people and the right inputs during building of the software. But this solves the wrong^1 problems while still leaving the door open for malware. Reproducible builds are the right step forward if you actually care about security of free software ecosystem.

1. I guess this depend on your position. In the context of remote attestation, I think this is also even dangerous / evil.

[Chris2048]

> In the context of remote attestation, I think this is also even dangerous / evil.

It's cool until it becomes enforced and we no longer hold the keys to our own hardware; bwim the ability to determine which key signers are to be trusted. But I don't think standing in the way of attestation tech is a fruitful tactic - much better to fight for hardware/key control.

[uecker]

The website / service you want to use will not accept your key, but only the key from the organization that makes sure that your software does not make it possible to skip the ads. So I think the only chance to avoid this is to reject such concepts completely from the beginning.

[Chris2048]

You can always build/compile your own software, having the local 'key' is the ability to do so. I'm not sure what else is implied - how will an external service / website enforce this?

[uecker]

Via remote attestation.