Today we often use binaries that someone claims were built from particular source code, but we usually have no way to check that the source and binaries we've been actually given correspond to one another. We rely on someone's say-so, and they might be wrong! Software developers and the infrastructure used to create and distribute software are significant targets of attack. We need ways to give everybody meaningful assurances about the provenance and integrity of the software they use.
Speakers: Seth Schoen