[Bug 1020292] Review Request: bitcoin - Peer-to-peer digital
currency
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1020292
--- Comment #55 from Simone Caronni <negativo17(a)gmail.com> ---
(In reply to Suvayu from comment #54)
> Unless Fedora can
> guarantee that the distributed binary will be identical to the upstream
> binary
This can never happen. Libraries, compilers, etc. will be different. Based on
the same logic there should be one and only Linux distribution that everybody
uses.
> or at least Fedora infrastructure will provide sufficient
> information to the user such that they can verify the Fedora packaged
> binaries aren't compromised, Fedora should not be including this in the
> repo. Events since 2017 have shown this is an important concern.
This can be guaranteed by the various chain of trust (builders, package
signatures, etc.) and is easily verifiable. Putting this under doubt means
saying the distribution can not be trusted at all and any binary/pacakge in it
can be compromised easily.
--
You are receiving this mail because:
You are on the CC list for the bug.
You are always notified about changes to this product and component
3 years, 11 months
[Bug 1020292] Review Request: bitcoin - Peer-to-peer digital
currency
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1020292
--- Comment #54 from Suvayu <fatkasuvayu(a)gmail.com> ---
If I may chime in, not an expert on Bitcoin, but I do follow some of the
technical discussion in the community.
As I understand it, security of the distributed binary is of utmost importance.
I believe to that effect, upstream now builds its releases in reproducible
builds (some info might be here:
https://bitcoinops.org/en/topics/reproducible-builds/). Unless Fedora can
guarantee that the distributed binary will be identical to the upstream binary,
or at least Fedora infrastructure will provide sufficient information to the
user such that they can verify the Fedora packaged binaries aren't compromised,
Fedora should not be including this in the repo. Events since 2017 have shown
this is an important concern.
--
You are receiving this mail because:
You are on the CC list for the bug.
You are always notified about changes to this product and component
3 years, 11 months
[Bug 1020292] Review Request: bitcoin - Peer-to-peer digital
currency
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1020292
Simone Caronni <negativo17(a)gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |DUPLICATE
Last Closed|2013-10-22 09:35:04 |2020-05-12 10:10:22
--- Comment #52 from Simone Caronni <negativo17(a)gmail.com> ---
Thanks!
*** This bug has been marked as a duplicate of bug 1834731 ***
--
You are receiving this mail because:
You are on the CC list for the bug.
You are always notified about changes to this product and component
3 years, 11 months