How to verify wallet is not tampered with?

I can’t find a sha256 for a NIC/NIS wallet download nor can I find a release in github nor any tags for NanoWallet.

Also, how can I see my wallets adress in NanoWallet? It only seems to appear in the ‘to’ line of transactions.

https://www.nem.io/install.html

there’s a signature link for ncc/nis and a link to the sourcecode for nano (which you can then easily build yourself from source).

Not sure if it the address is shown anywhere else.

There doesnt seem to be a release or tag in github for nanowallet. How do I interpret the signature link for ncc/nis? It has a transaction id and block number.

I see the transaction in the block explorer with message 4e5459031168167aacc0a4e7c7ebd5ae4162e8a841ba4e64a5bba197f5147ef6119d5e76 but it isn’t the same as the sha256sum for the nis-ncc-0.6.87.tgz

Seems important to let users know how to verify the software.

Hello.

in this file:
http://bob.nem.ninja/nis-ncc-0.6.87.tgz.sig

there is:
txId: f5ae6efac6b3f2dc109aa0a9e8fd4925a2308291b0e9a7976358c3913dc9e9c5
block: 1072404

find block or transaction like this with transaction id from above:
http://explorer.ournem.com/#/s_tx?hash=f5ae6efac6b3f2dc109aa0a9e8fd4925a2308291b0e9a7976358c3913dc9e9c5

now you have the message in this block:
HEX: 4e5459031168167aacc0a4e7c7ebd5ae4162e8a841ba4e64a5bba197f5147ef6119d5e76

make sha265sum of your the file you have downloaded “nis-ncc-0.6.87.tgz”

you should have received this value from sha256sum:
1168167aacc0a4e7c7ebd5ae4162e8a841ba4e64a5bba197f5147ef6119d5e76

compare to hex message above by removing the 4 bytes from beginning from the message like this
4e5459031168167aacc0a4e7c7ebd5ae4162e8a841ba4e64a5bba197f5147ef6119d5e76

the rest should match to the hash you have

value from hash :
        1168167aacc0a4e7c7ebd5ae4162e8a841ba4e64a5bba197f5147ef6119d5e76

value from the message in block
4e5459031168167aacc0a4e7c7ebd5ae4162e8a841ba4e64a5bba197f5147ef6119d5e76

what freigeist said :slight_smile:

I’m not sure I understand what you mean with tag or release ?
There’s an instruction to build it from source.

freigeist, thank you for that explanation. I have verified the download. It would be great to have those instructions on the nem download page. Boost confidence and security for users.

patmast3r, I’m referring to the github repo for NanoWallet. I don’t see any releases nor git tags. I just see commits. I’m concerned about potentially a lack of QA (quality assurance) on the software and asking users to use the latest code with minimal test coverage.

The nano wallet download nem.io is always the stable release. QM has said he will have future releases tagged on GitHub.