So, generally speaking the question is: how can i develop open source software and let the end user to verify if the code behind that software is the same published?
From my very basic knowledge of programming and cryptography, i would try to solve this situation adding to the published code the fingerprint of, let's say, each source file. That fingerprint should also be signed by the developer. At this point when the user download the code while accessing to the web service, he can calculate the fingerprint and compare it against the public one. Does it is viable approach? Am i missing something?
Thanks in advance!
P.S. I have already read some other questions like this one and i think they still not fully answer to this question.