jatchili / minimalist-ripple-client

minimalist ripple client
https://jatchili.github.io/minimalist-ripple-client/
GNU General Public License v2.0
143 stars 54 forks source link

Vendored ripple-lib dependency != official ripple labs library #9

Closed movitto closed 6 years ago

movitto commented 6 years ago

Good day, in your README you state

"That ripple-lib is trustworthy (Compare the code included here with that published by Ripple Labs; you should find that they're identical)"

Yet when I run the following I get different results:

$ wget https://raw.githubusercontent.com/jatchili/minimalist-ripple-client/master/ripple-0.12.5-rc2-min.js ... 2017-12-09 12:34:01 (1.94 MB/s) - ‘ripple-0.12.5-rc2-min.js’ saved [360538/360538]

[mmorsi@localhost Downloads]$ wget https://raw.githubusercontent.com/ripple/bower-ripple/v0.12.5-rc2/ripple-min.js ... 2017-12-09 12:34:17 (1.92 MB/s) - ‘ripple-min.js’ saved [360540/360540]

[mmorsi@localhost Downloads]$ diff ripple-0.12.5-rc2-min.js ripple-min.js 9,10c9,10 < }:ti,Nu=cn.... (too much output to paste)


The result is the same if I run the diff against any of the following:

Note I am not rebuilding the packages, I am simply downloading them and running diff (running md5sum yields the same result, different hashes, and if you notice the download file sizes are different).


So long story short, something is different between your vendored ripple lib and the official one. What it is I cannot say without inspecting the mimized js closer or decompiling it.

movitto commented 6 years ago

OK. At closer inspection by unminifying it via http://unminify.com/ I verified the sources are indeeded the same. The differences probably came up during the build process by the project maintainers. Closing this as not an issue (sorry if I caused any alarm!)