Namehold beta

Check your download

A wallet holds your money, so check the file before you open it. The macOS and Windows builds are not code-signed, so your system can't tell you who made them. These three checks can.

Get the file, SHA256SUMS and SHA256SUMS.sig, and put them in one folder.

1. Is this the file the release lists?

This catches a damaged or swapped download. It takes a few seconds and needs nothing to install.

shasum -a 256 -c SHA256SUMS --ignore-missing

You should see Namehold_<version>_universal.dmg: OK. On Linux without shasum, use sha256sum -c SHA256SUMS --ignore-missing.

$h = (Get-FileHash .\Namehold_<version>_universal.dmg -Algorithm SHA256).Hash.ToLower()
Select-String -Path SHA256SUMS -SimpleMatch "$h  Namehold_<version>_universal.dmg"

You should see one line naming the file. No line means the file doesn't match.

2. Is the list signed by Namehold's key?

This shows that the list itself came from the release, signed with the key that signs updates. You need minisign; on macOS, brew install minisign.

curl -s https://raw.githubusercontent.com/DimazzzZ/namehold-wallet/main/src-tauri/tauri.conf.json \
  | jq -r .plugins.updater.pubkey | base64 -d > namehold.pub
base64 -d < SHA256SUMS.sig > SHA256SUMS.minisig
minisign -V -m SHA256SUMS -x SHA256SUMS.minisig -p namehold.pub
$conf = (Invoke-WebRequest https://raw.githubusercontent.com/DimazzzZ/namehold-wallet/main/src-tauri/tauri.conf.json -UseBasicParsing).Content | ConvertFrom-Json
[IO.File]::WriteAllBytes("$PWD\namehold.pub", [Convert]::FromBase64String($conf.plugins.updater.pubkey))
[IO.File]::WriteAllBytes("$PWD\SHA256SUMS.minisig", [Convert]::FromBase64String((Get-Content SHA256SUMS.sig -Raw)))
minisign -V -m SHA256SUMS -x SHA256SUMS.minisig -p namehold.pub

minisign should report that the signature is verified. The public key is read from this project's source, and its ID is 33AE02F8757D1609.

3. Was it built by this repository?

This ties the file to the release workflow on GitHub. You need the GitHub CLI, signed in to any account.

gh attestation verify Namehold_<version>_universal.dmg --repo DimazzzZ/namehold-wallet

The command should finish without an error. A changed file is refused.

What this does and doesn't tell you