Checksums

Every figure for the release files, the signature, the law’s digests and the registry contract can be recomputed yourself.

Release files

Version 0.1.5 has six release files, with their checksums in the release list SHA256SUMS.txt:

On each system, compute one file and compare it with the table:

macOS

shasum -a 256 ZIKARON-0.1.5-macos-arm64.dmg

Linux

sha256sum zikaron-desk_0.1.5_amd64.deb

Windows

Get-FileHash ZIKARON-0.1.5-windows-x86_64.zip -Algorithm SHA256

PowerShell prints the value in capitals; compare it without regard to case.

On macOS and Linux you can also put the release list and the downloaded files in one folder and check them all at once:

macOS

shasum -a 256 -c --ignore-missing SHA256SUMS.txt

Linux

sha256sum -c --ignore-missing SHA256SUMS.txt

The third-party licences of the three platforms, THIRD-PARTY-LICENSES-macos.txt, THIRD-PARTY-LICENSES-linux.txt and THIRD-PARTY-LICENSES-windows.txt, are published separately, byte for byte the same as the copy in each package, and stay outside the release list. The drop zone on the download page does the same check: it computes the SHA-256 in the browser and compares it with the list.

Signature

On macOS the app and the dmg are signed with Kaptonia’s self-signed certificate; the pkg is checked by its SHA-256. Once installed, look at the app’s signature: Authority in the output should be Kaptonia, and Identifier should be com.kaptonia.zikaron.app:

Then look at the signing requirement; the string after certificate leaf is the certificate’s SHA-1:

To compute the certificate’s SHA-256, extract the certificate first:

The dmg’s own signature can be checked the same way: codesign -dvv ZIKARON-0.1.5-macos-arm64.dmg.

The Windows zip and the Linux deb and AppImage are unsigned; check them by their SHA-256. On first start Windows says “Windows protected your PC”; click “More info”, then “Run anyway”. On Windows 11 with Smart App Control on, unsigned programs are blocked outright, so turn it off first.

Zikaron record

The code of each release is one commit. At release, the project records that commit and each release file’s fingerprint in its Zikaron ledger and anchors them on Ethereum mainnet: written once and final, with a block time; the “Zikaron record” column of the download table links to that transaction. Before 0.1.5 was published, these fingerprints were recorded as ten records and anchored in the two transactions below, the deb package’s in the second:

The ten records in the ledger (entry number, record name and content fingerprint):

A file’s content fingerprint is the SHA-256 of its bytes; the two Windows programs each get a record of their own, to check one by one after unpacking the zip. The repository’s fingerprint is the SHA-256 of the current commit object; in a clone of the repository, run:

What is anchored on chain is the entry IDs of these ten entries (the SHA-256 of each entry’s bytes), and the entries record the fingerprints above. Each entry’s ID:

The law’s digests

Both laws are frozen, and their digests are written in the law texts. Unpack the source and compute them yourself; the results should match the table:

Each script reads a few Python source files and computes one digest; change any byte of them and the digest changes. See The law and the conformance suite.

The registry contract

The registry contract does one thing: it receives a fingerprint and emits an event. The app comes with four deployments, of which Ethereum mainnet, Arbitrum One and OP Mainnet are the same build at the same address. Read the code on chain and compute its keccak256, and the result should equal the code hash below:

How to recompute the hash from source is under The registry contract and anchoring.