3

Is there any information about how Bitcoin Core has applied secure development or application security in the past and currently? For example, the inclusion of third-party dependencies must be checked and tracked so that a dependency doesn't contain a vulnerability or an exploit, and the same reasoning about the build system.

Is there any policy and mechanism in practice for secure development and/or testing and verification of the security, including the dependencies and the build system?

I read somewhere that early development of Bitcoin Core was done in a "jail" but I couldn't find any other source than the mentioning of it in that specific article:

To address uncontrolled build inputs, it is tempting to “jail” builds into sanitized environments that always present a canonical interface to the underlying build system. Indeed, this was the approach taken by early projects such as Bitcoin and Tor (rbm.torproject.org). However, jails result in slower build times and impose technical and social restrictions on developers who may be accustomed to choosing their tooling. Most jails cannot address non-determinism issues either

Is there any more information about it? Was it a real BSD jail or just an isolated environment to make sure that only the allowed dependencies were included?

1 Answer 1

0

The authors of the article most likely referred to a system named Gitian that's been used to check the integrity of Bitcoin builds https://bitcoinmagazine.com/technical/what-is-gitian-building-how-bitcoin-s-security-processes-became-a-model-for-the-open-source-community-1461862937

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.