Shrike 2.5.5-blake2b.14 - superseded by blake2b.16

Superseded by blake2b.16. Later releases add: a release cannot ship an incomplete manifest; report the protection a transaction actually has.

Shrike signing with the unified opt-in signature hash as Bitcoin Knots v29.4.1.knots20260508rc4 defines it, on upstream Sparrow 2.5.5.

Everything in 2.5.5-blake2b.13, plus the macOS fix below. If you are on macOS, take this one.

macOS: the app would not open

Double clicking Shrike reported that it "may be damaged or incomplete", and it launched only by running the binary inside the bundle directly. Reported by a user, and confirmed by reading the plist out of the published dmg.

The bundle named upstream's executable:

CFBundleExecutable  = Sparrow          Finder runs this
Contents/MacOS/     contains: Shrike   what actually ships

Finder looked for a file that is not there and called the app damaged. jpackage copies this plist verbatim from the resource directory, so it overrode the application name the build otherwise sets.

Two more things in the same file were upstream's:

• CFBundleIconFile named Sparrow.icns while the bundle ships Shrike.icns, so the icon was wrong too.
• CFBundleIdentifier and the bitcoin:, auth47: and lightning: handlers all claimed com.sparrowwallet.sparrow. Two bundles claiming one identifier leaves macOS to choose between this and an installed Sparrow. The identifier is now io.privkey.shrike.

This was not caused by having Sparrow installed, and it happened on a Mac without it. If you edited your own Info.plist as a workaround, this build needs no edit.

Confirmed in the artifact rather than the source tree: the published dmg now reads CFBundleExecutable Shrike against a bundle shipping MacOS/Shrike.

Verified

368 wallet and 611 drongo unit tests, nine end to end suites, each behaviour checked by reverting the code that implements it and confirming the covering test fails.

Reproducible: this commit built locally with Eclipse Temurin 25.0.2 produces an application tree whose 171 paths, every file and symlink, hash identically to the tree CI published in shrike-2.5.5-x86_64.tar.gz. Only the Linux x86_64 build was reproduced; the archive contents are compared rather than the installers.

Upgrading

.7 through .11 all declared Debian version 2.5.5-1, so apt compared them as equal. From .12 the revision carries the release number. Coming from .11 or earlier this still needs dpkg:

sudo dpkg -i shrike_2.5.5-14_amd64.deb
/opt/shrike/bin/Shrike --version     # expect Shrike 2.5.5-blake2b.14

Wallets and configuration in ~/.shrike are untouched.

Downloads

Platform	File
Windows	Shrike-2.5.5.msi, or .zip for a portable copy
macOS	Shrike-2.5.5-arm64-unsigned.dmg, or -x86_64-unsigned.dmg for Intel
Linux x86_64	shrike_2.5.5-14_amd64.deb, or -x86_64.tar.gz
Linux aarch64	shrike_2.5.5-14_arm64.deb, or -aarch64.tar.gz
Headless	the shrikeserver-* files

Verify before running:

gpg --import privkeyio-signing-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS

Signed by Kyle Santiago kyle@privkey.io, key A47D99B6DB0D715D40C59A2023AE8A8EA7E24E38.

The macOS builds are not code signed or notarized, so macOS still reports the app as from an unidentified developer on first launch. That is the signing warning, not the damaged-bundle failure fixed above:

xattr -dr com.apple.quarantine /Applications/Shrike.app

Verify SHA256SUMS first, because clearing quarantine removes the check that would otherwise stop a tampered download. The Windows installer is not Authenticode signed either.

No warranty

This is unofficial, unaudited software provided as is, with no warranty and no liability, under the same Apache 2.0 license it inherits. It is not a Sparrow release and is neither affiliated with nor supported by the Sparrow project. Using it is entirely at your own risk, and you alone bear any loss of funds.