Release Verification

Release Verification

Release verification covers checksums, tests, fuzzing, package determinism, and signing.

Checksums

Download SHA256SUMS from the release and verify local files:

sha256sum -c SHA256SUMS

Test Before Release

Run:

make clean
make test
make analyze

Fuzzing

Build the fuzz harness:

make fuzz-harness

Run the production fuzz target for one hour:

make fuzz-cli FUZZ_TIME=3600

A passing release fuzz run exits normally with no crash artifact and no AddressSanitizer or UndefinedBehaviorSanitizer finding.

Latest local documented result for 0.1.0:

• Date: 2026-08-01
• Compiler: Debian clang 19.1.7
• Sanitizers: libFuzzer, AddressSanitizer, UndefinedBehaviorSanitizer
• Runtime: 3,601 seconds
• Executed units: 582,830,506
• Crash artifacts: none
• ASan/UBSan findings: none

Reproducible Package Check

When reprotest is unavailable, perform two clean binary package builds and compare hashes:

make clean
dpkg-buildpackage -us -uc -b
mkdir -p tmp/repro-build-1
cp ../wirecat_*.deb tmp/repro-build-1/
cp ../wirecat-dbgsym_*.deb tmp/repro-build-1/

make clean
dpkg-buildpackage -us -uc -b
mkdir -p tmp/repro-build-2
cp ../wirecat_*.deb tmp/repro-build-2/
cp ../wirecat-dbgsym_*.deb tmp/repro-build-2/

sha256sum tmp/repro-build-1/*.deb tmp/repro-build-2/*.deb

Matching package names must produce identical hashes.

Latest local documented result for 0.1.0:

5520630e72c02cc2a936179181430334f1abbd186d91a0d9425937901e2d1333  wirecat_0.1.0-1_amd64.deb
543b1cab6276db909b501b1adb72a66ce3583cf6fcb71af9e09ea6ff245e1bf4  wirecat-dbgsym_0.1.0-1_amd64.deb

Both hashes matched across clean rebuilds.

Signing

Release signing must use Chokri Hammedi's private GPG key. Do not generate or store release keys in the repository.

Recommended signing sequence:

dpkg-buildpackage -S -sa
debsign ../wirecat_*.changes
git tag -s v0.1.0 -m "wirecat 0.1.0"

Verify signatures:

debsign --verify ../wirecat_*.changes
git tag -v v0.1.0