bundled binaries: rational, security concerns and observation (.deb)
Some observation based on the .deb package provided by https://github.com/retoaccess1/haveno-reto/releases/latest/download/haveno-linux-deb.zip (@retoaccess1 which is the 4th result when searching for _"haveno deb"_)

- [ ] The .deb is bundling/downloading binaries: `tor`, `monero-wallet-rpc`, `monerod` instead of relying on well-proven ones. What's the point of checking a MD5 if it rolls its own unproven trust-system instead of relying of user/distribution/proven supply chains. These binary have/should have their own .deb from verified build.
- [ ] `~/.local/share/Haveno-reto/monerod` indicates having been build from commit 10a1b767b which is suspicious given no such commit exist in the official monero Git repository. (If a malware infected a developer machine, that would be a nice spot to hide)
- [ ] These bundled binaries weight much more than usual (monerod 25MB, monero-wallet-rpc 30MB) instead of ~16 MB for a normal build. Even Tor 0.4.8.13 weight 3.4MB meanwhile Debian's binary is 2.7M.

If this deb is not "official" or even a malware, then it's still a concern for /haveno-dex/ since it'd call for actions regarding official builds (and a more secure binary retrieval/reliance mechanisms)

See also: https://github.com/haveno-dex/haveno/issues/1577
