Let's discuss reproducible builds and code verification once again

[timo]

@patnorris

Hi everyone, I’m having a few related questions that we’re currently thinking about; what’s the recommended best practice for verifying a canister’s wasm programmatically? Is it calling the canister_status endpoint of the IC management canister and checking the module hash (as described here: Canister settings | Internet Computer)?

canister_status is only available to controllers of the canister. I believe you want to programmatically get the module hash of any third-party canister. The options are:

1. With dfx: dfx canister --ic info <canister id>

2. From your own code running outside the IC: You have to read from the state tree which is a bit inconvenient. See this forum thread where I asked the same question: How does dfx call canister_info and canister_status?
   @Severin gave some links to code examples there (Rust and js). You can also see how the frontend on https://history.ic0.info does it here: useReadState function

3. From canister code: As @Severin mentioned above, call the management canister function canister_info. But it only works from canister code, not from outside the IC.