|
Title: Can I verify that the official binary was compiled from the open source code? Post by: pf on April 19, 2014, 03:36:10 PM The Bitcoin website, https://bitcoin.org, provides links to both binaries and source code of Bitcoin Core (Bitcoin-Qt).
I would say that 99% of people just download the binaries and trust them. Is there any way to verify that the binaries were actually produced from the advertised source code? Title: Re: Can I verify that the official binary was compiled from the open source code? Post by: ncsupanda on April 19, 2014, 04:06:05 PM You could always compile it yourself.
Most people have trouble with the dependencies, and admittedly in the past this included me, so we just accept the binaries and move on. Do you believe there is a fake going around? Would be interesting. Title: Re: Can I verify that the official binary was compiled from the open source code? Post by: dserrano5 on April 19, 2014, 04:12:26 PM Is there any way to verify that the binaries were actually produced from the advertised source code? Compile the source using gitian and check that the generated binaries are identical to the published ones. Title: Re: Can I verify that the official binary was compiled from the open source code? Post by: cr1776 on April 19, 2014, 07:55:37 PM On the download page on bitcoin.org you can click the link "Verify signature releases" which will download the signatures and then you can use the signatures to verify it is the correct release.
E.g something like gpg --verify ... Title: Re: Can I verify that the official binary was compiled from the open source code? Post by: theymos on April 20, 2014, 01:02:52 AM Yes. The official binary is compiled in a special environment that can be exactly replicated so that the binary can be verified. It's a bit difficult to set up, though.
Title: Re: Can I verify that the official binary was compiled from the open source code? Post by: drawingthesun on April 20, 2014, 04:11:44 AM Yes. The official binary is compiled in a special environment that can be exactly replicated so that the binary can be verified. It's a bit difficult to set up, though. Is this is preferred process? http://gitian.org/ Title: Re: Can I verify that the official binary was compiled from the open source code? Post by: bitsmichel on April 20, 2014, 01:52:15 PM First compare the code you have downloaded with the original.
Then compile it. Title: Re: Can I verify that the official binary was compiled from the open source code? Post by: oleganza on April 20, 2014, 02:10:45 PM Yes. The official binary is compiled in a special environment that can be exactly replicated so that the binary can be verified. It's a bit difficult to set up, though. Where can I read more about this environment? I'm very interested in having the same thing for my own app. Title: Re: Can I verify that the official binary was compiled from the open source code? Post by: drawingthesun on April 20, 2014, 02:19:28 PM Yes. The official binary is compiled in a special environment that can be exactly replicated so that the binary can be verified. It's a bit difficult to set up, though. Where can I read more about this environment? I'm very interested in having the same thing for my own app. I'm very sure it's http://gitian.org/ Title: Re: Can I verify that the official binary was compiled from the open source code? Post by: theymos on April 20, 2014, 05:31:33 PM Where can I read more about this environment? I'm very interested in having the same thing for my own app. It's Gitian. See https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-building.md for some info about Bitcoin's use of it. |