pull down to refresh

151 sats \ 4 replies \ @AaronDewes OP 31 Aug \ parent \ on: The end of open source in Bitcoin security bitcoin devs lightning

I think that's answered in the blog post:

  1. To allow people who need the source code to build and run this (people running on other operating systems than the officially supported ones, people who don't want to trust maintainers, etc.). Some people need the source code to be protected, so it helps more people get a secure node running.
  2. To prove that it's pointless to have this embargo.
write
compose
26 sats \ 3 replies \ @optimism 31 Aug

Since this doesn't give me a reproducible build (I repro-built the 24.04 binary as a test), I can't trust that what you're claiming is identical to their source code, is in fact that. Yes, I know you made a note about this, and I also know they made a note about it:

Reproducing the binaries. Full build instructions will accompany the source release. This release was not built with the default optimisation settings, so a standard build will not reproduce these checksums; the exact parameters will be published alongside the source.

This is therefore also a problem on their end, not just yours, but they went full trustmebro and eroded a lot of trust that way so no one is counting on them. The "help people" argument for publishing it just doesn't fly because of this though. I'm not going to trust you, and I'm definitely not going to trust Claude.

It's fine if you just wanted to be right. Sometimes we have to be wrong on one thing to be right on the other. Just remember that the roles can be reversed too. Hopefully, that never happens to you.

reply
130 sats \ 2 replies \ @AaronDewes OP 31 Aug

I managed to reproduce the Fedora build, but haven't reproduced the others yet (and didn't provide the correct build flags).

I forgot to mention that in the post. I will try to reproduce the other builds and share reproduction instructions.

It's obviously not identical to theirs, but the compiled version is.

I have them noted down and will publish full reproduction instructions today.

reply
15 sats \ 1 reply \ @optimism 31 Aug

It's on your commit message so it's visible:

This was mostly done by Claude Opus 5. The resulting binaries match the published release exactly, at least for the Fedora builds. Other builds will be verified later.
reply
130 sats \ 0 replies \ @AaronDewes OP 31 Aug

I've added a reproduce script for the Fedora build now. It gives me a tar.gz that matches upstream exactly.

There is also a script for Ubuntu, but it's currently untested.

Will update the blog post later.

reply