Checksum signature? about daedalus

[domenkozar]

Hey everyone. Just a heads up from development team - we'll prioritize this and we hear your feedback.

[jonathancross]

@toldenburger @kiancheong @ress23 - Please provide the SHA-256 fingerprints of the files you download from: https://daedaluswallet.io/#download

[nikolaglumac]

Daedalus software downloads are signed with IOHK’s organizational PGP key. To support verification, a checksum is published for each installer with instructions for verifying their signatures and checksums on the Daedalus download web page. This enables users to verify the integrity of a download so they can be sure that they are using the true version of our software. Step-by-step instructions for checksum and signature verification are available on the download page.

More info can be found on the Support portal: https://iohk.zendesk.com/hc/en-us/articles/360011330194-Installer-integrity-verification

[jonathancross]

FYI: The fingerprint of the release signing key is:
D325 87D4 090F E461 CAEE 0FF4 966E 5CB9 CBFA A9BA
(you can also find it at the bottom of the release notes from v0.11.0)

It is not (yet?) part of the OpenPGP strong set.

[ress23]

Relevant: BTCGPU/BTCGPU#231

[jonathancross]

Hi @ress23 please provide info on the binaries you yourself downloaded.
At least we can try to make sure we have the same versions until someone like @domenkozar begins signing binaries.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

These are the binaries I downloaded from https://daedaluswallet.io/#download

fd644fe565e92adc13bc004bf18d4ec9591d79aa7f69fa63ee008def47fa1770  Daedalus-installer-1.0.3619.pkg
192ba5a9b8ca2a301bb3106cfe2b6c52e86ac81c12cf506c3f43add8da54d63b  daedalus-win64-1.0.3769.0-installer.exe

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEMsk361Pa9SImG35c2FeN+Op8zxsFAlqZZ4wACgkQ2FeN+Op8
zxuZPAf/SNEKLI3aV95Rj5Rrak3BaqrdBbfA22B/TgEtMHYGUE/9lp1q+0ULmjK4
+F+kvoWYVQtQBtSGF0Rkirlb6BGRFF8uT8/eYh9G9462ogNgBOHovsNNFzbWHevF
mY9VxQBxEIx/YJEdnlpO+SyY2aPPrnbGyEG2UxAnK6qQor8mnf2YiLD0wCIltBgi
LFArWSd9NryjqkQF+LrALlKbh50SbrT76O5swy5vrpUaAQFo0v1ZwgBV6H4yMbUL
lsMPaJfOFcoRhZPkX/kcc+p63BDNCsu7XGakNYjRZd+Vs3yAwHS6shrPbIw8S4gG
kIGKuRIHDpk4IkBkP/hWaEiFTTOj5A==
=JReA
-----END PGP SIGNATURE-----

You will find my pgp key (0xC0C076132FFA7695), on my website, and keyservers.

[jonathancross]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

SHA-256 hash of Daedalus-installer-1.1.0.408.pkg:
e504c78431c019b639a7a45b66cd6d754e8faa9b8231ea85154a535b98f111ac
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEMsk361Pa9SImG35c2FeN+Op8zxsFAlq3uKkACgkQ2FeN+Op8
zxupwAf8CfIQyfxl/eyc3TUUo8HxG7bnVhuaPgjgaMEE4yT0NG69TgJw3R1kLDmp
ZgAZxyfU5IqraIAC55hUKiMaTxlqazVCdhdrFkPw8GUuqa9ZUC/wFTm34LTGD2s2
1myip9qdfxc1ZEwZr5m+JTJRt8M+xN4dg01NH3oSy0/M5erznnhsEO9PimxZ7wly
cSZcdOkGwqtR30RNuT90YPQP0Tx1xbeH9ZMG8i/FkLbR5um1PVrfN/T4SjjJ5DE9
OhvvMyWmN+PAQMS4HEg7ALihzMoLrsIrj/biA3Vf0J6AEXDYQ/Jtz9dzp76KqJde
pU19P9cQUJrWpARYEV0snDp4SDglkQ==
=TZ5A
-----END PGP SIGNATURE-----