search

LedgerHQ / ledger-wallet-ripple

MIT License
65 stars 23 forks source link

Provide checksum for all binaries #29

Closed dstnbrkr closed 6 years ago

dstnbrkr commented 6 years ago

There are download links on this page without checksums. Without a checksum, users cannot verify that the binary they receive is intact / not compromised. Checksums were also requested in #9 and would have increased confidence that the virus scanner had a false positive.

amougel commented 6 years ago

All linux download have a signature and OSX/Win downloads are signed with our certificate. We'll add info/checksums on our webpage soon. Thanks for the feedback

stevesbrain commented 6 years ago

@amougel I noticed these aren't GPG signatures. What type of signature are they? Some form of OpenSSL signature?

amougel commented 6 years ago

Yes, openssl signatures.

stevesbrain commented 6 years ago

No worries; is the hash algorithm specified anywhere?

amougel commented 6 years ago

Forgot to mention :/ , we signed the sha256 of the file help

stevesbrain commented 6 years ago

Ah, that's why I could never get it to verify :P Could be worth mentioning that in release announcements? :)