Is there a way to (say, cryptographically) prove, that a specific software code is used in a web service?

Question

Assume I have an open-source github repo, and I offer paid services, using a solution in that repo.

Is there a way I can prove, that the online service really uses the code/release from that repo, without modifications/additions, etc?

Ideally, I am lookin for some form of cryptographic proof, not a "third-party review" or "bounty program". This is valuable, in case the nature of those services is secure, and each user would want to be able to review the code and ensure, that the specific, unchanged version of the code is powering the services. We can assume running a docker image inside AWS ECS or similar service, so that we avoid all platform-dependent differnces.

Answer 1

It depends on what you mean by "prove". The Notary v2 project aims to extend the OCI specification to include cryptographic signatures of container images. This will allow the user of a container image to independently verify that a specific image was published by the holder of the private key (similar to how TLS certificates work with https). However, it seems like you are asking for the ability for end users of your service to also verify the software that you are running. You could share the signatures of the images, but unless you give your users access to the actual container orchestration system you are using there would be no way for them to know that you are running the images you claim to be running.