We are seeking a design that works across every VCS, mirror, or vendored copy of code by generating a universally stable SWHID across all distribution methods of a given version of software source code. The goal being you can just request software by the swhid or version and a copy on the internet will be discovered and a normalized folder of extracted code that matches the SWHID will appear, regardless of git, cvs, svn, tar, tar.gz, and even from slightly different mirrors as long as it is a superset of expected files, etc. All resolve to a single SWHID.

e.g for curl it would look something like this: (wip) https://codeberg.org/stagex/sources/src/branch/main/curl.jso...

Once we have finished compiling that database of swhids for at least the sources live-bootstrap and stagex rely on, we then are all set for anyone to publish a signed review in basically any format they want bound to that swhid.

We will likely have our own PGP signed review tools that are a superset of the review fields of crev and validate web of trust etc, however nothing at all would stop people from publishing crev reviews signed with software exposed ssh keys or w/e as well which are still of much more value than nothing.

Anyone would be free to host their own signature servers as well with signed reproducible build proofs or code reviews.

Naturally spam will be a thing in a distributed system, so we would likely choose to only mirror and make discoverable signatures from an extended web of trust of linux distro maintainers, security researchers, etc, but anyone could publish subsets of signatures on their own servers under their own criteria. E.g every distro could host their own but if the stagex team has not reviewed a source yet but Debian has on their mirrors we will still assign limited trust to it.

Anyway that is the 50 floor elevator pitch. Absolutely looking to collaborate with anyone interested.