1
0
Files
electrum/contrib/deterministic-build
SomberNight 40842fad39 requirements: bump electrum-ecc and electrum-aionostr
note: these sdists are now reproducibly built.
Ideally the person updating the pinned hash should be different from the one who uploaded the dep to PyPI and reproduce and verify the hash. This prevents hiding a backdoor in just the sdist uploaded to PyPI.

but people can try to reproduce the PyPI sdists at any time and ring alarm bells if they can't
2025-02-04 17:00:21 +00:00
..
2024-05-29 14:56:04 +00:00

Notes

The frozen dependency lists in this folder are generated files.

  • Starting from contrib/requirements/requirements*.txt,
  • we use the contrib/freeze_packages.sh script,
  • to generate contrib/deterministic-build/requirements*.txt.

The source files list direct dependencies with loose version requirements, while the output files list all transitive dependencies with exact version+hash pins.

The build scripts only use these hash pinned requirement files.