Trust it
Verification
Five checks you can run yourself, with or without this project’s tools, and how to build a device a stranger can check.
This document is for someone who does not trust this project and should not have to. It shows how to check, yourself, that a nullroute device runs the code it claims to, and that the code does what its specifications say. No step needs a nullroute tool: each has an equivalent using coreutils and a Bitcoin Core node.
In this chapter
- 01The five things you can checkThe last is the most important, and the one people skip.
- 021. The manifest and the root hashMANIFEST.lock lists the SHA-256 of every file git tracks in the manifest roots (package.json, package-lock.json, packages/, spec/, provisioning/), one per line, sorted by path....
- 032. Reproducing the buildIdentical inputs must produce a byte-identical dist/, or the manifest root hash means nothing: you could not have checked it.
- 043. The verification reportmake verify performs five checks and writes verification-report.json. The daemon refuses to start if that report is missing, stale, or failing (INV-BUILD-1), so a spec that stops...
- 054. Reproducing a signatureA device that makes randomised signatures can leak your private key through valid transactions alone: grind the nonce until chosen bits of the signature encode part of the key,...
- 065. Recovering without nullrouteThis is the most important check in this document. If it fails, your funds depend on this project continuing to exist.
- 07What verification does not give youThe argument here, trusting arithmetic instead of people, has limits.
- 08Building a deviceEverything above checks a device you were handed or built. This part builds one whose image a stranger can check.
- 09Reporting a verification failureIf any check in this document fails, treat it as a security issue and report it privately. See SECURITY.md.
Rendered from docs/VERIFICATION.md, the same bytes that ship with the code. SHA-256 15ae2ba12417b4691f63d9a4777eba2c328ff694961efea68f5e7dec4ae2e0bd