Is it possible to have
distributed CI in the following sense:
- The “CI” is a program that checks if the code is okay (like runs a test
suite)
- Anyone can run it and get the result
- A central server/node can receive the output and SHA1 (that the code was
run on) and quickly check if the CI passed
- It takes some effort to cheat the procedure—it doesn't have to be bullet
proof (it's meant to be used “among friends”)
- No proof-of-work or something else that burns up electricity for
questionable gain
It seems that a simple plaintext script CI is not sufficient since
whatever node has run the script can just change the script: `return
true`. But if you can either encrypt the program or obfuscate it enough
(for a decompiler) then you might be able to implement something like
this:
<do tests>
if they pass: calculate the output of the CI based on the stable
success-output of the tests + a secret + the SHA1
That means that the CI program that is distributed to the nodes needs to
literally be an undecipharable blob program that in principle can do
anything to the node computer—another reason why this can only work “among
friends”.
You either trust the client to do the requested work, or you don't. If you can't trust the client to use the appropriate CI script version, then you can't trust anything the client responds with.
An example of this is how hacked DVD/BluRay drives work, where they fib to the driver about what byte is in which memory address.
You can issue the work to multiple clients, and treat it like a node failure. If you have a quorum of executions then you can trust that result. However, that's similar to the disallowed proof-of-work requirement.
No matter what, the client has to trust that the server isn't out to get them.