MORANANETWORKExplorerPool
Wallet
Users

Verify Your Download

Every Morana release comes with a checksum file, SHA256SUMS, and its signature, SHA256SUMS.minisig, made with minisign. A checksum is a file’s fingerprint: change one byte and it no longer matches. Checking takes a couple of minutes and helps detect a file swapped on a mirror or during transfer.

What to download

Along with the program file, get these from the same release on the download page:

  • SHA256SUMS — the SHA-256 sums of every file in the release;
  • SHA256SUMS.minisig — the signature over that list.

Release file names follow this pattern: <program>-v<version>-<platform>+<12 hex characters>.<extension> — for example, an AppImage for Linux or an APK for Android.

Step 1. Check the signature

To verify the signature, use Morana’s minisign public key:

untrusted comment: minisign public key: 27F09ADE3B5199D8
RWTYmVE73prwJ9zIJ6nHo/0G304N5+pU3Z6VENmQ+Gp7S14il3tcB76V

This key is used for the closed testnet. Before the open testnet, the project will replace it and publish the new key on this page.

A checksum lets you check whether a file has changed. The signature confirms that the checksum list was signed with the key corresponding to the public key above.

minisign -Vm SHA256SUMS -x SHA256SUMS.minisig -P RWTYmVE73prwJ9zIJ6nHo/0G304N5+pU3Z6VENmQ+Gp7S14il3tcB76V

You should see Signature and comment signature verified. If you do not, do not run the file.

Step 2. Check the file

sha256sum --ignore-missing -c SHA256SUMS

Your file should be followed by OK.

Android

SHA-256 fingerprint of the wallet APK signing certificate

41d38cbee87c9003636b4c41dd68a175012f41a0dd70781ddb5b0b768fd8d32e

On a computer, run apksigner verify --print-certs wallet.apk, replacing wallet.apk with the downloaded file’s name. The certificate SHA-256 digest value must match the published fingerprint.

The wallet APK is signed with a testnet key. The mainnet wallet will use a different key, so you will need to uninstall the test version before installing it. Before uninstalling, make sure you have saved your 24-word recovery phrase.

Building from source

The source code will be published when the open testnet launches. Every release is tagged morana/v<version> on the commit its files were built from. If you build it yourself, take the source at exactly that tag.