The following are steps taken to verify the checksum of the Rotki installer on macOS:
- Downloaded the file (i.e. rotki-darwin-v1.6.2.dmg.sha512) that contains the published SHA512 hash of binaries that we'll use as checksum to verify the integrity of the binary
- View the checksum in the file with
cat rotki-darwin-v1.6.2.dmg.sha512
- Example output was:
f1be8965f206fb0ae5f745575c0e4da12a302e237188bb5cd41d73a19705965fc409da72508253f8908626ccbfb43990bf0e801f3cfa0ff9e29000c7d177a074 rotki-darwin-v1.6.2.dmg
- Download the .dmg binary file from the Github releases page https://github.com/rotki/rotki/releases/tag/v1.6.2
- Verify that the computered checksum output of the downloaded .dmg file matches the checksum in the .dmg.sha512 file
shasum -a 512 rotki-darwin-v1.6.2.dmg
- Note that there may be an additional file called latest-mac.yml, which is automatically generated by electron builder and is for the auto-updater feature that we is not yet supported. It's contents were the following:
version: 1.6.2
files:
- url: rotki-darwin-v1.6.2.zip
sha512: vyxWdS3quE4RYocAUZrpjUtJ7vCixYZgvShP5Sps7dNOw0fnC1cwQP2VLQg7ELW3MMXacah5d+MYauozMAEIzg==
size: 103125622
blockMapSize: 107783
- url: rotki-darwin-v1.6.2.dmg
sha512: 8b6JZfIG+wrl90VXXA5NoSowLiNxiLtc1B1zoZcFll/ECdpyUIJT+JCGJsy/tDmQvw6AHzz6D/nikADH0XegdA==
size: 105587918
path: rotki-darwin-v1.6.2.zip
sha512: vyxWdS3quE4RYocAUZrpjUtJ7vCixYZgvShP5Sps7dNOw0fnC1cwQP2VLQg7ELW3MMXacah5d+MYauozMAEIzg==
releaseDate: '2020-08-11T20:38:24.058Z'
- Note that the
sha512
value for the file rotki-darwin-v1.6.2.dmg that's shown in that file as (i.e.8b6JZfIG+wrl90VXXA5NoSowLiNxiLtc1B1zoZcFll/ECdpyUIJT+JCGJsy/tDmQvw6AHzz6D/nikADH0XegdA==
) doesn't match the checksum value that's included in the file rotki-darwin-v1.6.2.dmg.sha512. This is because it uses a different encoding of base64. So if you use a base64 to hex converter and pass thissha512
value as an argument, it will convert it to the equivalent hex value, which should match the computed checksum and the checksum found in rotki-darwin-v1.6.2.dmg.sha512. Run the following JavaScript code (after replacing thebase64Value
with thesha512
value. An easy way to run it is in your web browser's console.
function base64toHEX(base64) {
var raw = atob(base64);
var HEX = '';
for ( i = 0; i < raw.length; i++ ) {
var _hex = raw.charCodeAt(i).toString(16)
HEX += (_hex.length==2?_hex:'0'+_hex);
}
return HEX.toUpperCase();
}
const base64Value = "8b6JZfIG+wrl90VXXA5NoSowLiNxiLtc1B1zoZcFll/ECdpyUIJT+JCGJsy/tDmQvw6AHzz6D/nikADH0XegdA==";
console.log(base64toHEX(base64Value));