I'm building an open source application that will have a corresponding but optional web service, where users will be able to share certain statistics publicly if they wish. I want people to feel free to modify and improve the client, submitting changes back upstream, but I'd also like the web service to be able to detect whether data is being submitted by an official release or a modified client.
Sending a computed checksum was the only idea that came to mind, but the user could modify the code to send the expected checksum and my web service wouldn't know the difference. I've looked around and found suggestions which would apply to game clients, regarding sending a recording of game actions to verify high scores; but my app isn't a game and I can't think of a meaningful stream of actions that would be appropriate. Basically the client will perform time tracking for a specific domain of work.
Any ideas?