Where can I read more about this environment? I'm very interested in having the same thing for my own app.
It's Gitian. See https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-building.md for some info about Bitcoin's use of it.
Topic: Can I verify that the official binary was compiled from the open source code? (Read 923 times)
April 20, 2014, 12:31:33 PM
It's Gitian. See https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-building.md for some info about Bitcoin's use of it.
April 20, 2014, 09:19:28 AM
Yes. The official binary is compiled in a special environment that can be exactly replicated so that the binary can be verified. It's a bit difficult to set up, though.
Where can I read more about this environment? I'm very interested in having the same thing for my own app.
I'm very sure it's http://gitian.org/
April 20, 2014, 09:10:45 AM
Yes. The official binary is compiled in a special environment that can be exactly replicated so that the binary can be verified. It's a bit difficult to set up, though.
Where can I read more about this environment? I'm very interested in having the same thing for my own app.
April 20, 2014, 08:52:15 AM
First compare the code you have downloaded with the original.
Then compile it.
Then compile it.
April 19, 2014, 11:11:44 PM
Yes. The official binary is compiled in a special environment that can be exactly replicated so that the binary can be verified. It's a bit difficult to set up, though.
Is this is preferred process?
http://gitian.org/
April 19, 2014, 08:02:52 PM
Yes. The official binary is compiled in a special environment that can be exactly replicated so that the binary can be verified. It's a bit difficult to set up, though.
April 19, 2014, 02:55:37 PM
On the download page on bitcoin.org you can click the link "Verify signature releases" which will download the signatures and then you can use the signatures to verify it is the correct release.
E.g something like
gpg --verify ...
E.g something like
gpg --verify ...
April 19, 2014, 11:12:26 AM
Is there any way to verify that the binaries were actually produced from the advertised source code?
Compile the source using gitian and check that the generated binaries are identical to the published ones.
April 19, 2014, 11:06:05 AM
You could always compile it yourself.
Most people have trouble with the dependencies, and admittedly in the past this included me, so we just accept the binaries and move on.
Do you believe there is a fake going around? Would be interesting.
Most people have trouble with the dependencies, and admittedly in the past this included me, so we just accept the binaries and move on.
Do you believe there is a fake going around? Would be interesting.
April 19, 2014, 10:36:10 AM
The Bitcoin website, https://bitcoin.org, provides links to both binaries and source code of Bitcoin Core (Bitcoin-Qt).
I would say that 99% of people just download the binaries and trust them.
Is there any way to verify that the binaries were actually produced from the advertised source code?
I would say that 99% of people just download the binaries and trust them.
Is there any way to verify that the binaries were actually produced from the advertised source code?
Jump to: