Faraday 0.1.2

Faraday 0.1.2, a pre-release: no one outside the project has reviewed its code, its cryptography or its builds, and no second builder has reproduced them. Use at your own risk.

Faraday Starter

• Faraday-Starter-0.1.2-Windows.exe: Faraday Starter for Windows (x86-64). It is not code-signed: Windows shows "Windows protected your PC" the first time; check it against SHA256SUMS, then More info, Run anyway.
• Faraday-Starter-0.1.2-Linux.tar.gz: Faraday Starter for Linux (x86-64), one file inside, Faraday-Starter-0.1.2-Linux. Ubuntu 20.04 and later, Debian 11 and later, Fedora 32 and later, Arch.

Faraday Starter makes a Faraday stick or a Raspberry Pi card and checks what it wrote, then shows how to start this computer from the stick, step by step for its maker, and how to set it back. On Windows it keeps the BitLocker recovery key before any firmware change. It also moves files to and from the device by QR code and opens Faraday Desktop for trying Faraday. It carries this release's images; no download happens later.

Other downloads

• faraday-stick-0.1.2-x86_64-uefi.img.xz: the USB stick image for a PC (UEFI, x86-64)
• faraday-pi-0.1.2-pi3-waveshare-28dpi.img.xz: the microSD card image for a Raspberry Pi 3 with a 2.8-inch Waveshare panel
• faraday-desktop-0.1.2-linux-x86_64: Faraday Desktop for Linux, for trying Faraday; on mainnet it takes public demo seeds only
• SHA256SUMS, SHA256SUMS.asc: the files' SHA-256 sums and the commit they were built from, with a detached signature. Each .img.xz is listed with the .img inside it, and the .tar.gz with the file inside it.
• v0.1.2.tag, v0.1.2.tag.asc: the release tag's text and its signature

Raspberry Pi Imager and balenaEtcher take an .img.xz as it is; other tools need it decompressed (xz -d on Linux, 7-Zip on Windows).

New since 0.1.1

• Faraday Starter, for Linux and Windows
• Images are published as .xz, and the files are named faraday-stick-…, faraday-pi-… and faraday-desktop-…
• Faraday Desktop's mainnet is a demo with public seeds only; a test network takes any seed
• Device checks: a new keyboard gets a code before it can type, and wireless receivers, capture devices and screens that can record are warned about
• Scan a key; Can spend; the Spend tab asks what you have; GPG signs several files at once
• In a vault: every way to add an item, Replace or Keep both
• A webcam on the stick, and frames paced by the screen
• Secret nonces, FROST shares and silent payment keys are multiplied in constant time; Secure Boot signing is blinded
• Pictures read for QR codes and FAT reads are bounded in size
• SECURITY.md, and audits from experts and AIs: https://faradayoffline.app/audits/

Verify

The release key was made in Faraday and its secret part has never left a Faraday vault. Its fingerprint:

D1AF A712 ABEF 9010 9A1B  587F F153 6BE0 7E23 4CFD

gpg --import release-key.asc
gpg --fingerprint F1536BE07E234CFD
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS
git tag -v v0.1.2

On Windows, Gpg4win's gpg takes the first three commands, and PowerShell prints a file's sum to compare with its line in SHA256SUMS:

Get-FileHash -Algorithm SHA256 .\Faraday-Starter-0.1.2-Windows.exe

release-key.asc is in the repository at faraday/release-key.asc.

Faraday 0.1.1

Faraday 0.1.1, a pre-release: no one outside the project has reviewed its code, its cryptography or its builds, and no second builder has reproduced them. Use at your own risk.

Files

• faraday-0.1.1-x86_64-uefi.img: the USB stick image for a PC (UEFI, x86-64)
• faraday-0.1.1-pi3-waveshare-28dpi.img: the microSD card image for a Raspberry Pi 3 with a 2.8-inch Waveshare panel
• faraday-0.1.1-linux-x86_64: the desktop app for Linux (online use, for trying Faraday; not for real funds)
• SHA256SUMS, SHA256SUMS.asc: the files' SHA-256 sums and the commit they were built from, with a detached signature
• v0.1.1.tag, v0.1.1.tag.asc: the release tag's text and its signature

New since 0.1.0

• TOTP codes for the entries in open vaults, from Tools and from a vault's Entries
• The time set by hand and a time zone, in Settings → Time; every time shown is local
• Deleting files from a stick with zeros written over them first, the free space, or the whole partition
• The release key is now F1536BE07E234CFD

Verify

The release key was made in Faraday and its secret part has never left a Faraday vault. Its fingerprint:

D1AF A712 ABEF 9010 9A1B  587F F153 6BE0 7E23 4CFD

gpg --import release-key.asc
gpg --fingerprint F1536BE07E234CFD
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS
git tag -v v0.1.1

release-key.asc is in the repository at faraday/release-key.asc.