History

Johann Bauer 95bbd9593b Add script to check and sign executables		2018-06-29 08:57:24 +02:00
..
build-electrum-git.sh	win builds: call 'git describe' before we add unstaged files to the repo	2018-06-28 19:55:26 +02:00
build-secp256k1.sh	wine build: towards deterministic libsecp - strip debug symbols	2018-06-28 22:05:13 +02:00
build.sh	build and include libsecp256k1 in windows binaries	2018-05-25 16:04:29 +02:00
deterministic.spec	fix revealer for linux distributables; and small clean-up	2018-06-10 22:12:23 +02:00
electrum.nsi	Fix typos	2018-04-15 20:34:40 +02:00
prepare-wine.sh	build and include libsecp256k1 in windows binaries	2018-05-25 16:04:29 +02:00
README.md	Add script to check and sign executables	2018-06-29 08:57:24 +02:00
sign.sh	Add script to check and sign executables	2018-06-29 08:57:24 +02:00

README.md

Windows Binary Builds

These scripts can be used for cross-compilation of Windows Electrum executables from Linux/Wine. Produced binaries are deterministic, so you should be able to generate binaries that match the official releases.

Usage:

Install the following dependencies:

dirmngr
gpg
7Zip
Wine (>= v2)
(and, for building libsecp256k1)
- mingw-w64
- autotools-dev
- autoconf
- libtool

For example:

$ sudo apt-get install wine-development dirmngr gnupg2 p7zip-full
$ sudo apt-get install mingw-w64 autotools-dev autoconf libtool

The binaries are also built by Travis CI, so if you are having problems, that script might help.

Make sure /opt is writable by the current user.
Run build.sh.
The generated binaries are in ./dist.

Code Signing

Electrum Windows builds are signed with a Microsoft Authenticode™ code signing certificate in addition to the GPG-based signatures.

The advantage of using Authenticode is that Electrum users won't receive a Windows SmartScreen warning when starting it.

The release signing procedure involves a signer (the holder of the certificate/key) and one or multiple trusted verifiers:

Signer	Verifier
Build .exe files using `build.sh`
	Build .exe files using `build.sh`
	Sign .exe files using `gpg -b`
	Send signatures to signer
Place signatures as `$filename.$builder.asc` in `./dist`
Run `./sign.sh`

sign.sh will check if the signatures match the signer's files. This ensures that the signer's build environment is not compromised and that the binaries can be reproduced by anyone.