decred-binaries

Decred Binary Releases

This repository contains release notes and binaries released for Decred.

Available Releases

This repository contains releases for the following software:

• dcrd/dcrwallet
• Paymetheus
• gominer
• decrediton

Release notes

Notes for the current and previous releases can be found in the Release Notes document.

Verifying Binaries

Each release contains a manifest file with sha256 hashes for the binaries in that release. To verify these, you will need:

• SHA256 - Once you download your file(s), you need to check their SHA256 hashes, so you may need to download a tool to do this, depending on your OS.
• GnuPG or PGP - This is required to import public keys and verify signatures. Examples below use GnuPG.

The steps to verify the binaries are as follows:

1. Download the file manifest, the signature for the file manifest, and the zip/tarball for your OS from here.

2. Obtain the SHA256 value for the zip/tarball for your OS and check that it matches the value in the file manifest, e.g. for 64-bit Linux

   $ sha256sum linux-amd64-20160127-02.tar.gz
     8ffaa268a329890ebf0f96b3cd1bc9f69359e431edbb95d89cec5a605108574b linux-amd64-20160127-02.tar.gz
   

3. Import the Decred Release Signing Key in GnuPG.

   $ gpg --keyserver pgp.mit.edu --recv-keys 0x518A031D
      gpg: requesting key 518A031D from hkp server pgp.mit.edu
      gpg: /home/user/.gnupg/trustdb.gpg: trustdb created
      gpg: key 7608AF04: public key "Decred Release <release@decred.org>" imported
      gpg: Total number processed: 1
      gpg: imported: 1 (RSA: 1)
   

4. Verify the signature for the file manifest is valid and created by the Decred Release Signing Key.

   $ gpg --verify manifest-20160127-02.txt.asc
     gpg: assuming signed data in `manifest-20160127-02.txt'
     gpg: Signature made Wed 27 Jan 2016 08:56:59 PM UTC using RSA key ID 518A031D
     gpg: Good signature from "Decred Release <release@decred.org>"
     gpg: WARNING: This key is not certified with a trusted signature!
     gpg: There is no indication that the signature belongs to the owner.
         Primary key fingerprint: FD13 B683 5E24 8FAF 4BD1 838D 6DF6 34AA 7608 AF04
          Subkey fingerprint: F516 ADB7 A069 852C 7C28 A02D 6D89 7EDF 518A 031D
   

The zip or tarball with binaries for your platform is now verified and you can be confident they were generated by the Decred team.

Source code

This repo only contains build archives, build scripts, and similar content. For the source code, please see the individual repositories at: https://github.com/decred/

Building Binaries

To build the binaries, use the provided Docker image. First, ensure it is built on your system:

docker build -t decred/decred-binaries .

With this image, you can build the production binaries by specifying the required tag. This will automatically fetch the specified tag from Github, build it inside the docker container, and place those packages in a directory of your choosing. Replace the TAG environment variable with the required tag, and specify the local folder you wish those packages to be placed in. The below example builds version 1.2.0, and places it into ./build on your local machine:

docker run --rm -ti -e TAG="v1.2.0" -e PROD=1 -v $(pwd)/build:/build \
    decred/decred-binaries

If you have local folders cloned that you want to build, instead of fetching, then mount those as well. E.g.:

docker run --rm -ti -e TAG="v1.2.0" -e PROD=1 -v $GOPATH/src:/go/src \
    -v $(pwd)/build:/build decred/decred-binaries

Leave TAG unset if you wish to build the version you have already cloned without verifying it matches the specified tag.

Environment Variables

• TAG: Specify the git tag to have it fetch these packages automatically. Leave unset to use latest commit (if repo's do not exist locally) or local version (if already cloned)
• PROD: Set to 1 if you want to create a production build