[GH-ISSUE #1027] (Question) Why the 3rd-party binaries for Linux? #338

New issue

Closed

opened 2026-10-13 20:19:17 +00:00 by bsakaguchi · 4 comments

bsakaguchi commented

2026-10-13 20:19:17 +00:00

Owner

Originally created by @zimbabwe303 on GitHub (Aug 29, 2024).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1027

Hello! I can build amnezia-client alright on my Debian system, but what makes me somewhat uncomfortable is that I have to trust the 3rd-party binaries included with the source code. I don't see anything special there which is not included in the official Debian repositories, only libssh, openssl and openvpn, all of which are regularly updated by the Debian team to the latest versions. As far as I know the same applies to Ubuntu. Then why the binaries? Are they patched? Then where are the sources of the patches? How can I avoid using anything besides the source code to build amnezia-client?

Originally created by @zimbabwe303 on GitHub (Aug 29, 2024). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1027 Hello! I can build amnezia-client alright on my Debian system, but what makes me somewhat uncomfortable is that I have to trust the 3rd-party binaries included with the source code. I don't see anything special there which is not included in the official Debian repositories, only libssh, openssl and openvpn, all of which are regularly updated by the Debian team to the latest versions. As far as I know the same applies to Ubuntu. Then why the binaries? Are they patched? Then where are the sources of the patches? How can I avoid using anything besides the source code to build amnezia-client?

bsakaguchi closed this issue

2026-10-13 20:19:18 +00:00

bsakaguchi commented

2026-10-13 20:19:19 +00:00

Author

Owner

@tannisroot commented on GitHub (Aug 31, 2024):

You can alternatively use amneziawg, their fork of wireguard

@tannisroot commented on GitHub (Aug 31, 2024): You can alternatively use amneziawg, their fork of wireguard

bsakaguchi commented

2026-10-13 20:19:20 +00:00

Author

Owner

@SergeiMinaev commented on GitHub (Sep 2, 2024):

I tried to run precompiled linux client, but the binary asked for the root password (again) without providing any info about what would happen if I continued. And now I've learned about precompiled libssl, libcrypto etc even in "open sourced" version. That's shady.

@SergeiMinaev commented on GitHub (Sep 2, 2024): I tried to run precompiled linux client, but the binary asked for the root password (again) without providing any info about what would happen if I continued. And now I've learned about precompiled libssl, libcrypto etc even in "open sourced" version. That's shady.

bsakaguchi commented

2026-10-13 20:19:20 +00:00

Author

Owner

@pokamest commented on GitHub (Sep 2, 2024):

You can find build pipelines here - https://github.com/amnezia-vpn/3rd-build-ga/tree/master/.github/workflows
All binaries equipped with sha256 hash, you can compare hashes on GitHub actions and from bundled binaries.
Anyway, the project was audited by 7ASecurity.

I don't see anything special there which is not included in the official Debian repositories, only libssh, openssl and openvpn, all of which are regularly updated by the Debian team to the latest versions. As far as I know the same applies to Ubuntu. Then why the binaries?

Feel free to develop solution (Ubuntu, Debian and CentOS support required), test it on most popular distros, and make pull request ))

@pokamest commented on GitHub (Sep 2, 2024): You can find build pipelines here - https://github.com/amnezia-vpn/3rd-build-ga/tree/master/.github/workflows All binaries equipped with sha256 hash, you can compare hashes on GitHub actions and from bundled binaries. Anyway, the project was audited by 7ASecurity. > I don't see anything special there which is not included in the official Debian repositories, only libssh, openssl and openvpn, all of which are regularly updated by the Debian team to the latest versions. As far as I know the same applies to Ubuntu. Then why the binaries? Feel free to develop solution (Ubuntu, Debian and CentOS support required), test it on most popular distros, and make pull request ))

bsakaguchi commented

2026-10-13 20:19:20 +00:00

Author

Owner

@zimbabwe303 commented on GitHub (Sep 6, 2024):

Yeah... When binaries are distributed alongside an open-source project there could be two diametrically opposite reasons for doing so:

Benevolent: providing the verified versions which have undergone security audit
Malevolent: providing the patched versions with backdoors included

The sha256 hashes are a good reason to think the first was the reason but still why no explanation was given anywhere in the docs or in README.md? One more thing: GitHub workflows is far from the best way to make reproducible builds to check against the hashes, it's convenient for developers but not for the users. How about a script instead?

@zimbabwe303 commented on GitHub (Sep 6, 2024): Yeah... When binaries are distributed alongside an open-source project there could be two diametrically opposite reasons for doing so: 1. Benevolent: providing the verified versions which have undergone security audit 2. Malevolent: providing the patched versions with backdoors included The sha256 hashes are a good reason to think the first was the reason but still why no explanation was given anywhere in the docs or in README.md? One more thing: GitHub workflows is far from the best way to make reproducible builds to check against the hashes, it's convenient for developers but not for the users. How about a script instead?

bsakaguchi referenced this issue

2026-10-13 20:47:48 +00:00

[PR #338] [MERGED] build_windows.bat fix #1759