Skip to content

v0.3.2

Latest
Latest

Choose a tag to compare

View all tags
@rcarback rcarback released this 30 Oct 23:15
· 2 commits to main since this release
v0.3.2
a6c104c

Note: Every download is signed. The macOS builds carry an Apple Developer
ID signature and Apple notarization, so they install with no Gatekeeper
warning and no Terminal command. The Windows builds carry an Authenticode
signature issued to HADAMARD GATE INCORPORATED. Each release also publishes
SHA256SUMS and an OpenPGP signature over that file. See
Verify Your Download.

Quick Install

macOS / Linux:

curl -fsSL https://gitlab.com/quip.network/quip-node-manager/-/raw/v0.3.2/scripts/install.sh | sh

Windows (PowerShell):

irm https://gitlab.com/quip.network/quip-node-manager/-/raw/v0.3.2/scripts/install.ps1 | iex

Manual Install

macOS

Download the .dmg, open it, and drag the app to /Applications.

Linux

The recommended format is AppImage (works on any distro):

chmod +x quip-node-manager-linux-x86_64.AppImage
./quip-node-manager-linux-x86_64.AppImage

A .deb package is also available for Debian/Ubuntu:

sudo dpkg -i quip-node-manager-linux-x86_64.deb

A signed .rpm package is available for Fedora, RHEL and openSUSE:

sudo rpm --import https://gitlab.com/quip.network/quip-node-manager/-/raw/v0.3.2/.gitlab/release-signing-key.asc
sudo rpm -i quip-node-manager-linux-x86_64.rpm

Windows

Download the .exe and run it. Windows names HADAMARD GATE INCORPORATED as the
publisher. SmartScreen may still warn until the certificate builds reputation
across enough downloads. Click More info, then Run anyway.

Verify Your Download

scripts/install.sh checks the checksum on every run, and checks the signature
as well when gpg is installed. scripts/install.ps1 checks the checksum and
the Authenticode signature on every run, and the OpenPGP signature as well
when gpg is installed. To check a download by hand instead, expand the
section below.

Manual verification steps

Checksums, every platform

Download SHA256SUMS and SHA256SUMS.asc from this release, then import the
release key and check both the signature and the checksum:

curl -fsSLO https://gitlab.com/quip.network/quip-node-manager/-/raw/v0.3.2/.gitlab/release-signing-key.asc
gpg --import release-signing-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS

On macOS, use shasum -a 256 --check --ignore-missing SHA256SUMS for the last
step.

gpg --verify must report a good signature from this key:

Item Value
Key Quip Node Manager Release Signing <rick@postquant.xyz>
Fingerprint A63860E21E7070C2C26FDA5DC85BEAB01AD9FEE3
Type RSA 4096, expires 2029-09-16

GnuPG reports the key as untrusted until you sign it yourself. That warning is
expected. Compare the fingerprint in the output against the value above.

macOS

xcrun stapler validate quip-node-manager-macos-universal.dmg
spctl --assess --type open --context context:primary-signature -v quip-node-manager-macos-universal.dmg

stapler must report The validate action worked. spctl must report
accepted and source=Notarized Developer ID.

Windows

Get-AuthenticodeSignature .\quip-node-manager-windows-x86_64.exe | Format-List

Status must read Valid, and SignerCertificate.Subject must name
HADAMARD GATE INCORPORATED.

Linux RPM

sudo rpm --import release-signing-key.asc
rpm --checksig quip-node-manager-linux-x86_64.rpm

The output must read digests signatures OK. An unsigned package reports
digests OK and still exits 0, so read the words, not the exit status.

The .deb and the AppImage carry no embedded signature. Check those two
against SHA256SUMS as shown above.

v0.3.2-rc2

The macOS release build puts its keychain on the search list

codesign finds a signing identity only in keychains on the user's keychain
search list. Its --keychain option cannot add a keychain that is off that
list. The release build kept its keychain off the list, so v0.3.2-rc1 failed
with no identity found on a runner whose own keychains hold no identity.

  • scripts/macos-keychain-search-list.sh saves the search list and puts the
    build keychain first while Tauri signs.
  • The step after the build writes the saved list back. after_script does
    the same when the build fails or someone cancels the job.
  • The build no longer adds Apple's intermediate certificates to the runner's
    login keychain. The copies in the build keychain count while that keychain
    sits on the search list.
Assets 2
Loading