title: Verify remote open source software
body: <p>Trying to wrap my head around how this could be accomplished, not even sure it's really possible. In simple terms, if I write a piece of open source software that is going to interact with other instances of itself running elsewhere, is there a way to validate that the remote software hasn't been tampered with? When my trusted local software instance X reaches out to unverified instance Y, what can I do that prevents someone from simply tearing out actual validation code and just "returning true" in their version?</p>
  
  <p>No matter how I come at this, it seems that a central source of trust is always required (like in certificate chains) and direct peer trust is not possible. Even with a remote source of trust I'm not sure how I could verify/validate that the peer behaves appropriately rather than just claiming it is.</p>
  
  <p>This is just an academic or design question that I'm trying to resolve, I don't have a specific use case or implementation in place to provide examples with.</p>