Skip to content

Shrike 2.5.5-blake2b.19 - superseded by blake2b.20

Choose a tag to compare

View all tags
@kwsantiago kwsantiago released this 04 Sep 18:19
· 28 commits to master since this release
v2.5.5-blake2b.19
800dccf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Superseded by blake2b.20. Nothing here is unsafe: .20 is this release with the interface in the fork's own colors, the application icons corrected, and the opt-in decision taken from the verified chain rather than the tip a server announces. The files below stay in place for anyone already on it, and the Trezor firmware requirement is the same for both.

Everything in 2.5.5-blake2b.18, plus upstream's latest fixes and sharper artwork. Nothing this fork does changes, and a Trezor still needs firmware unified-sighash.2 to opt in.

Built on upstream Sparrow's 2.5.5 development line, which this release is level with. Upstream's newest release is 2.5.4; 2.5.5 is not released yet.

From upstream

  • The signature hash selection reverts when the SIGHASH_NONE warning is dismissed rather than answered no.
  • A Trezor Safe 7 session recovers when the device retransmits a message that went unacknowledged.
  • An announced chain tip below the last pinned header is refused.
  • A block height taken from the server reads as unverified until it is proven.
  • An amount or fee that parses as zero when only part of it validates is corrected.
  • Silent payment scan addresses are compared when deciding whether wallet addresses changed.

Sharper artwork

The application icons were an SVG wrapping a bitmap, so the wallet resampled a fixed-size image and they rendered soft, worst on HiDPI screens. They are vector now, and render at whatever resolution the display asks for.

Verification

Twenty end to end checks against a Bitcoin Knots v29.4.1.knots20260508 regtest node, every transaction judged by the node, on a private loopback so nothing else on the machine can answer as the device. All twenty pass. Unit suites: drongo 615, Sparrow 396, lark 22, no failures.

No warranty

This is unofficial, unaudited software provided as is, with no warranty and no liability, under the same Apache 2.0 license it inherits. It is not a Sparrow release and is neither affiliated with nor supported by the Sparrow project, nor by Trezor, KeepKey or OneKey. Using it is entirely at your own risk, and you alone bear any loss of funds.

Verifying this release

If you already have Shrike installed, this is the easy way. Download three files into the same folder: SHA256SUMS, SHA256SUMS.asc, and the install file for your platform. Then drag any one of them onto Shrike, or open Tools > Verify Download. It checks the signature and the hash and tells you whether the file is ready to install.

Otherwise, with gpg. Download those three files plus privkeyio-signing-key.asc into the same folder, then:

gpg --import privkeyio-signing-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS

The second command must report:

gpg: Good signature from "Kyle Santiago <kyle@privkey.io>"
gpg:                using RSA key A47D99B6DB0D715D40C59A2023AE8A8EA7E24E38

It will also print WARNING: This key is not certified with a trusted signature. That is expected and does not mean the check failed: it says only that you have not marked the key as trusted on your own keyring. What matters is Good signature and that the key matches the fingerprint above.

The third command prints OK for the file you downloaded. Anything else, or a missing Good signature, means do not install it.

The macOS builds are not notarized and the Windows installer is not Authenticode signed, so both will warn on first run. Reproducible builds: see reproducible.md.

Assets 17
Loading