I studied the monero-gui code and in the file monero-gui/src/qt/updater.cpp I found two addresses to verify binaries:

The first file (hashes.txt) is in text format and it is clear to me that hashes and a digital signature are written there.

The second file (hashes.txt.sig) is in binary format. I have a question: what is this file and what utilities is it generated by?

1 Answer 1


what is this file...

hashes.txt.sig is a detached signature (from one of the projects maintainers) for the contents of hashes.txt.

and what utilities is it generated by?

GPG. E.g. gpg -b hashes.txt.

  • However, further these two files are checked so that they are signed by different persons. throw std::runtime_error("both signatures were generated by the same person"); How exactly does the process of signing a distribution package work? Commented Jul 24, 2021 at 10:14
  • See this QA.
    – jtgrassie
    Commented Jul 24, 2021 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.