1

I studied the monero-gui code and in the file monero-gui/src/qt/updater.cpp I found two addresses to verify binaries:

The first file (hashes.txt) is in text format and it is clear to me that hashes and a digital signature are written there.

The second file (hashes.txt.sig) is in binary format. I have a question: what is this file and what utilities is it generated by?

2

what is this file...

hashes.txt.sig is a detached signature (from one of the projects maintainers) for the contents of hashes.txt.

and what utilities is it generated by?

GPG. E.g. gpg -b hashes.txt.

2
  • However, further these two files are checked so that they are signed by different persons. throw std::runtime_error("both signatures were generated by the same person"); How exactly does the process of signing a distribution package work? Jul 24 '21 at 10:14
  • See this QA.
    – jtgrassie
    Jul 24 '21 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.