<p>The authors of the article most likely referred to a system named Gitian that's been used to check the integrity of Bitcoin builds <a href="https://bitcoinmagazine.com/technical/what-is-gitian-building-how-bitcoin-s-security-processes-became-a-model-for-the-open-source-community-1461862937" rel="nofollow noreferrer">https://bitcoinmagazine.com/technical/what-is-gitian-building-how-bitcoin-s-security-processes-became-a-model-for-the-open-source-community-1461862937</a></p>

CC BY-SA 4.0
2024-08-29T20:31:09.897Z
Note that this system has meanwhile been replaced by Guix builds.
Murch
CC BY-SA 4.0
2022-08-10T12:02:47.557Z
2022-08-10T12:02:47.557Z
Niklas Rosencrantz
<p>Is there any information about how Bitcoin Core has applied <a href="https://en.wikipedia.org/wiki/Software_development_security" rel="nofollow noreferrer">secure development</a> or <a href="https://en.wikipedia.org/wiki/Application_security" rel="nofollow noreferrer">application security</a> in the past and currently? For example, the inclusion of third-party dependencies must be checked and tracked so that a dependency doesn't contain a vulnerability or an exploit, and the same reasoning about the build system.</p>
<p>Is there any policy and mechanism in practice for secure development and/or testing and verification of the security, including the dependencies and the build system?</p>
<p>I read <a href="https://arxiv.org/pdf/2104.06020.pdf" rel="nofollow noreferrer">somewhere</a> that early development of Bitcoin Core was done in a &quot;jail&quot; but I couldn't find any other source than the mentioning of it in that specific article:</p>
<blockquote>
<p>To address uncontrolled build inputs, it is tempting to “jail” builds
into sanitized environments that always present a canonical
interface to the underlying build system. Indeed, this was the
approach taken by early projects such as Bitcoin and Tor
(rbm.torproject.org). However, jails result in slower build times and
impose technical and social restrictions on developers who may be
accustomed to choosing their tooling. Most jails cannot address
non-determinism issues either</p>
</blockquote>
<p>Is there any more information about it? Was it a real BSD jail or just an isolated environment to make sure that only the allowed dependencies were included?</p>

<security><bitcoin-core-development><gitian>
Application security of Bitcoin Core
Niklas Rosencrantz
# Application security of Bitcoin Core

(Asked by: username_0 on 2022-08-08)

Is there any information about how Bitcoin Core has applied [secure development](https://en.wikipedia.org/wiki/Software_development_security) or [application security](https://en.wikipedia.org/wiki/Application_security) in the past and currently? For example, the inclusion of third-party dependencies must be checked and tracked so that a dependency doesn't contain a vulnerability or an exploit, and the same reasoning about the build system.

Is there any policy and mechanism in practice for secure development and/or testing and verification of the security, including the dependencies and the build system?

I read [somewhere](https://arxiv.org/pdf/2104.06020.pdf) that early development of Bitcoin Core was done in a "jail" but I couldn't find any other source than the mentioning of it in that specific article:

> To address uncontrolled build inputs, it is tempting to “jail” builds
> into sanitized environments that always present a canonical
> interface to the underlying build system. Indeed, this was the
> approach taken by early projects such as Bitcoin and Tor
> (rbm.torproject.org). However, jails result in slower build times and
> impose technical and social restrictions on developers who may be
> accustomed to choosing their tooling. Most jails cannot address
> non-determinism issues either

Is there any more information about it? Was it a real BSD jail or just an isolated environment to make sure that only the allowed dependencies were included?

**Tags:** security, bitcoin-core-development, gitian


---

## 1 answers

### Answer by username_0 on 2022-08-10. Score: 1

The authors of the article most likely referred to a system named Gitian that's been used to check the integrity of Bitcoin builds <https://bitcoinmagazine.com/technical/what-is-gitian-building-how-bitcoin-s-security-processes-became-a-model-for-the-open-source-community-1461862937>

> **Comments:**
> **username_1**: Note that this system has meanwhile been replaced by Guix builds.  

---

