a production build drops all variable names, not easy to diff

Thanks for the clarification. How easy is it to decompile? What is to just simply stop anyone from decompiling and comparing with latest release?

satonymous

From what I understand: they will be offering closed source binaries reproduced and signed by multiple developers for anyone that wants to upgrade immediately and resume running their node. For people that don’t want to upgrade to a closed source binary, they recommend to restart with 

. The source code will be published two weeks later and allow anyone to verify that the released binary was reproducibly built from the later published source code.

The source code is being held back to make it harder for attackers to discover the vulnerability while people upgrade. This sort of situation is complicated and difficult, but their solution doesn’t require you to run closed source binaries if you don’t want to.

bitcoin

lightning

Take your CLN node offline.

anon

From what I understand: they will be offering closed source binaries reproduced and signed by multiple developers for anyone that wants to upgrade immediately and resume running their node. For people that don’t want to upgrade to a closed source binary, they recommend to restart with `--offline`. The source code will be published two weeks later and allow anyone to verify that the released binary was reproducibly built from the later published source code.
The source code is being held back to make it harder for attackers to discover the vulnerability while people upgrade. This sort of situation is complicated and difficult, but their solution doesn’t require you to run closed source binaries if you don’t want to.