Verify the actions · Software supply chain
How to Check That Software Came from the Published Code
Anyone can read Bitcoin Core’s source, but most people install a finished program. Was that file really built from the code on display?
Where the trust gap appears
A compiler turns source into a binary. Tools, libraries, timestamps, and environment settings can affect the result, so ordinary builds may not match byte for byte.
A download signature confirms who signed a file. By itself, it does not prove which source produced it.
What reproducibility changes
A project fixes tools and environment so independent builders can obtain the same output from the same source. Bitcoin Core uses Guix.
Matching independent results cannot prove there is no bug, but they make a silent substitution by one distributor harder.
Trust is divided, not abolished
Compilers, hardware, and human review remain. Reproducibility does not make software error-free.
Its strength is repeatability: “trust us” becomes a procedure other people can perform.
Open source reveals the code. Reproducibility connects it to the finished file.
Sources and verification
A technical overview, not a guarantee for any particular file. Follow the project’s current verification instructions.
← Back to the rubric