Docs › Security

Reproducible builds

Biscuit releases are built with Guix, like Bitcoin Core, Monero and Feather. Build the same version from its source and you get the same files, byte for byte. Anyone can check that a release really comes from its published source code, and nothing was added along the way.

Rebuilding a release

The source archive of each release is on the download page, and the build instructions in RELEASE.md in it. You need a Linux computer with Guix. The build takes a while the first time: Guix builds every tool from source.

Then compare the checksums of your files with the signed list, hashes-<version>-plain.txt.

Two exceptions

Two parts work differently, and we’d rather you hear it from us:

The atomic swap helper (biscuit-swapd, written in Rust) isn’t built by Guix. We build it separately, and the Guix build won’t continue unless its SHA-256 matches the one recorded in the source code. Its source is in the archive, so you can rebuild it too.
macOS. Macs with Apple Silicon don’t run unsigned apps, so after the Guix build we sign Biscuit with an ad-hoc signature (no Apple account, no name in it) and zip it again. The Mac zip you download is therefore not byte for byte what Guix produced. The Windows and Linux files are.