Can I verify that the official binary was compiled from the open source code?

[pf]

The Bitcoin website, https://bitcoin.org, provides links to both binaries and source code of Bitcoin Core (Bitcoin-Qt).

I would say that 99% of people just download the binaries and trust them.

Is there any way to verify that the binaries were actually produced from the advertised source code?

[1538088105]

1538088105

[1538088105]

1538088105

[ncsupanda]

You could always compile it yourself.

Most people have trouble with the dependencies, and admittedly in the past this included me, so we just accept the binaries and move on.

Do you believe there is a fake going around? Would be interesting.

[dserrano5]

Is there any way to verify that the binaries were actually produced from the advertised source code?

Compile the source using gitian and check that the generated binaries are identical to the published ones.

[cr1776]

On the download page on bitcoin.org you can click the link "Verify signature releases" which will download the signatures and then you can use the signatures to verify it is the correct release.

E.g something like

gpg --verify ...

[theymos]

Yes. The official binary is compiled in a special environment that can be exactly replicated so that the binary can be verified. It's a bit difficult to set up, though.

[drawingthesun]

Yes. The official binary is compiled in a special environment that can be exactly replicated so that the binary can be verified. It's a bit difficult to set up, though.

Is this is preferred process?

http://gitian.org/

[bitsmichel]

First compare the code you have downloaded with the original.
Then compile it.

[oleganza]

Yes. The official binary is compiled in a special environment that can be exactly replicated so that the binary can be verified. It's a bit difficult to set up, though.

Where can I read more about this environment? I'm very interested in having the same thing for my own app.

[drawingthesun]

Yes. The official binary is compiled in a special environment that can be exactly replicated so that the binary can be verified. It's a bit difficult to set up, though.

Where can I read more about this environment? I'm very interested in having the same thing for my own app.

I'm very sure it's http://gitian.org/

[theymos]

Where can I read more about this environment? I'm very interested in having the same thing for my own app.

It's Gitian. See https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-building.md for some info about Bitcoin's use of it.