search

vertcoin-project / vertcoin-core

A digital currency with mining decentralisation and ASIC resistance as a key focus
https://vertcoin.org
MIT License
350 stars 134 forks source link

codesigning: windows script #182

Closed vertiond closed 2 years ago

vertiond commented 2 years ago

This script expects the windows codesigning certificate to be in ~/codesigning/vertcoin-project.p12 and VERTCOIN_PROJECT_KEY_PASSWORD to be stored as an environment variable.

Only those that have been given the code signing certificate will be able to use this. The next major release will allow anyone to build and verify the codesigned output by using a detached-sig created by the codesigner.

$ HOSTS="x86_64-w64-mingw32" ./contrib/guix/guix-build.sh`
$ ./contrib/guix/sign.sh`
$ find output/ -type f -print0 | sort -z | xargs -r0 sha256sum
cb83752602582012248ba775ac49375d1b3d04e5bd3290116cba8566682d1be1  output/signed/vertcoin-f8fff8d0498f-win64-setup.exe
aeb9fbda49b4ae7790f3b89cc8f714280b72123dcf9d2bffc6cd247274ded6c3  output/signed/vertcoin-f8fff8d0498f-win64.zip
4f639e795ae387e7cdd7298992dfd4edd524f9909d48c096e57478aead2599c7  output/src/vertcoin-f8fff8d0498f.tar.gz
083e657125f5515ce181ce5ebc2cbd38e93a6d518ae67bdc3c362015e020d92f  output/vertcoin-f8fff8d0498f-win64-debug.zip
d1b5d4ae0be997baffcf30c269452e70267e29d020b73ee1d2c4346ea029829b  output/vertcoin-f8fff8d0498f-win64-setup-unsigned.exe
256361cc1e5c5ca5733580114261b7b6936ae0073fd8475fc8f2fa6f7afa115e  output/vertcoin-f8fff8d0498f-win64.zip
ee7ecc449ecfd1e2b070fce097a05225b8f5dc57c92084514a1e67f0ea9926e0  output/vertcoin-f8fff8d0498f-win-unsigned.tar.gz
KforG commented 2 years ago 
kg@KG:~/vertcoin-core$ find output/ -type f -print0 | sort -z | xargs -r0 sha256sum
4352594192d9dd8ee0a6fdf2b3bb322daf18cdfd5db214675b88650f2fbc8668  output/signed/vertcoin-f8fff8d0498f-win64-setup.exe
640facf5dd67aa6d2eb35fd8dd28d2878f1ce13af9faf2927764fa8dc10cc2c4  output/signed/vertcoin-f8fff8d0498f-win64.zip
4f639e795ae387e7cdd7298992dfd4edd524f9909d48c096e57478aead2599c7  output/src/vertcoin-f8fff8d0498f.tar.gz
083e657125f5515ce181ce5ebc2cbd38e93a6d518ae67bdc3c362015e020d92f  output/vertcoin-f8fff8d0498f-win64-debug.zip
d1b5d4ae0be997baffcf30c269452e70267e29d020b73ee1d2c4346ea029829b  output/vertcoin-f8fff8d0498f-win64-setup-unsigned.exe
256361cc1e5c5ca5733580114261b7b6936ae0073fd8475fc8f2fa6f7afa115e  output/vertcoin-f8fff8d0498f-win64.zip
ee7ecc449ecfd1e2b070fce097a05225b8f5dc57c92084514a1e67f0ea9926e0  output/vertcoin-f8fff8d0498f-win-unsigned.tar.gz
vertiond commented 2 years ago

Codesigned binaries won't be deterministic until 0.19.