What's inside the file hashes.txt.sig?

Question

I studied the monero-gui code and in the file monero-gui/src/qt/updater.cpp I found two addresses to verify binaries:

The first file (hashes.txt) is in text format and it is clear to me that hashes and a digital signature are written there.

The second file (hashes.txt.sig) is in binary format. I have a question: what is this file and what utilities is it generated by?

jtgrassie · Accepted Answer · 2021-07-22 16:33:27Z

2

what is this file...

hashes.txt.sig is a detached signature (from one of the projects maintainers) for the contents of hashes.txt.

and what utilities is it generated by?

GPG. E.g. gpg -b hashes.txt.

answered Jul 22, 2021 at 16:27

jtgrassie

19.4k4 gold badges15 silver badges52 bronze badges

However, further these two files are checked so that they are signed by different persons. throw std::runtime_error("both signatures were generated by the same person"); How exactly does the process of signing a distribution package work?
– Ivan Ivanov
Commented Jul 24, 2021 at 10:14
See this QA.
– jtgrassie
Commented Jul 24, 2021 at 16:04

Add a comment |

1 Answer 1