What does bitcoin.org mean when they say about Coldcard Wallet "the final software was not built deterministically like Bitcoin Core"?

Question

I am looking at hardware wallets to store my Bitcoins, and Coldcard Wallet Mk3 seems like a great option. However, at looking at info about it at bitcoin.org, it says that the software is not built deterministically like the consensus Bitcoin Core protocol.

I just want to know if this is true, or the info is outdated. Because in the Coldcards page, I have not found such thing.

Coldcard even claims extreme compatibility with clients such as Bitcoin Core, Electrum of Wasabi Wallet. And it seems to be easy to use it only trough ones personal Full Node.

The other option as a Hardware Wallet I am looking for, is BitBox02.

Thank you in advance,

Ander

Answer 1

Some security sensitive pieces of software like Tor, Debian and Bitcoin use deterministic builds to increase the safety of binaries for end users. Typically a piece of software will be built from source code by a maintainer, signed by them, and then uploaded to a repository. Small differences in the setup of the machine compiling the software, timestamps, and random values in the output mean that every time it is compiled the output is likely to be unique.

Deterministic builds replace this with a system called Gitian that produces identical binary output no matter who produces the binaries or when, allowing many people to independently compile the software and come to the same end result.

Deteminstic builds protect against:

• Malicious software on the maintainers machine changing the behavior of the software, injecting a backdoor or other code
• A single maintainer acting maliciously and altering the software
• An innocent maintainer being accused of having made modifications they did not

The ColdCard product not being built deterministically means that even though the project is open source, you have no way of verifying that the binaries provided by the company completely match the source code.