We've reverse engineered this release (LLM-assisted) to confirm it is free of backdoors.
Source code that can reproduce the Fedora binaries (others will be tested later) byte-for-byte is published at github.com/nirvati/lightn….
Details on verification will be published tomorrow.
Core Lightning 26.06.7 is out and recommended for every node runner.
It fixes vulnerabilities reported over the past three weeks, during a sharp rise in AI-generated reports across open source Bitcoin. Details stay under embargo for two weeks, then all published.
We are currently reverse engineering the patched binaries and expect to be able to publish a fully reproducible version of the source code within the next 12h (LLM-assisted).
We plan to publish a blog post about security and FOSS code embargoes tomorrow.
Core Lightning 26.06.7 is out and recommended for every node runner.
It fixes vulnerabilities reported over the past three weeks, during a sharp rise in AI-generated reports across open source Bitcoin. Details stay under embargo for two weeks, then all published.
100% byte-identical is sadly not possible, because the binaries include hashes of certain source files that contain comments with contents we can not determine.
However, the latest code we published is (when compiled) identical to the upstream release apart from 2 classes,
We've updated this reimplementation to match 2.4.3-rc6.
As a next step, there will be small optimizations so we can build a 100% identical binary to make it easier to verify the binary provided upstream has no backdoors.
We've updated this reimplementation to match 2.4.3-rc6.
As a next step, there will be small optimizations so we can build a 100% identical binary to make it easier to verify the binary provided upstream has no backdoors.
We're continuing to publish reimplementations based on the reverse engineering of the newly closed source @BtcpayServer builds.
2.4.3-rc5 is now available: github.com/nirvati/btcpay…
These builds try to reimplement all security fixes.
Full source: github.com/nirvati/btcpay…
