Description
This chapter discusses open source software in the context of why it matters that Bitcoin software is open source. But it also delves into the reason why even open source software doesn’t necessarily solve all software-specific trust is- sues.
In theory, the fact that most Bitcoin nodes, wallets, and applications are open source should ensure that developers can’t include malicious code in the programs, because anyone can in- spect the source code for malware. In practice, however, the number of people with enough ex- pertise to do this is limited, while the reliance by software in general on external code libraries, or dependencies, makes it even harder.
Furthermore, even if the open source code is sound, this doesn’t guarantee that the bina- ries (computer code) really correspond with the open source code. The first attempt at mitigat- ing this risk in Bitcoin involved a process called Gitian building. This is where several Bitcoin Core developers sign the binaries if, and only if, they all produce the exact same binaries from the same source code. This requires special com- piler software.
More recently, Guix, a project that goes above and beyond the Gitian process, came along. It helped minimize the level of trust required to turn source code into binaries — including trust in the compiler itself.
