Published on: 2015-09-24T09:18:16+00:00
The core developers of Bitcoin are responsible for manually uploading Gitian builds to bitcoin.org. Users who choose to run a pre-compiled version of Bitcoin Core are advised to verify the binary against the available Gitian signatures. The signatures can be found in the signature repository at https://github.com/bitcoin/gitian.sigs. PGP Pubkeys for verification can be found at https://github.com/bitcoin/bitcoin/tree/master/contrib/gitian-downloader, and instructions for verifying Bitcoin Core can be found at https://www.reddit.com/r/Bitcoin/wiki/verifying_bitcoin_core.A discussion between Mark Friedenbach and Roy Osherove in September 2015 revealed that there is no build server where Gitian builds are automatically done and made available on bitcoin.org. This manual process ensures the integrity of the builds. Quorum signatures for the Gitian builds can be found on the GitHub page for gitian.sigs. Roy Osherove inquired about the availability of a public server to view the Gitian builds and quorum verifications. However, Mark Friedenbach explained that the binaries on bitcoin.org are built using the Gitian process and signed by a quorum of developers, and Travis-CI is not considered a trusted platform. Therefore, there is no public server for viewing the Gitian builds or quorum verifications.A discussion on the bitcoin-dev mailing list also touched upon the topic of reproducible builds using TeamCity. Roy Osherove sought clarification on whether all platforms need to be supported and if Gitian is necessary. Mark Friedenbach responded by emphasizing that the binaries on bitcoin.org are built using Gitian and signed by a quorum of developers. Meanwhile, Travis-CI is used to ensure successful compilation and testing on all supported platforms, but the produced binaries are not trusted. Consequently, there is no public server available for viewing Gitian builds or quorum verifications.In his quest to create a reproducible build of Bitcoin and Bitcoin-XT using TeamCity, Roy Osherove requested feedback and suggestions. He questioned the necessity of all flavors of builds and the requirement for Gitian. Osherove's own build can be accessed at http://btcdev.osherove.com:8111/. He welcomed input on whether all platforms need to be supported and if Gitian is truly necessary. Osherove expressed openness to ideas for additional features that people would like to see in the build.
Updated on: 2023-08-01T16:15:02.529131+00:00