Git Product home page Git Product logo

Comments (3)

acashmoney avatar acashmoney commented on September 15, 2024

UPDATE

Please see below for the correct files to compare according to the instructions and same Verification Failure.

Downloaded files

ledger-live-desktop-2.42.0-mac.dmg
ledger-live-desktop-2.42.0.sha512sum
ledger-live-desktop-2.42.0.sha512sum.sig
ledgerlive.cer

Screenshot

Screen Shot 2022-06-03 at 10 35 57 AM

vs. Ledger Live instructions

$ openssl dgst -sha256 -verify ledgerlive.pem -signature ledger-live-desktop-2.42.0.sha512sum.sig ledger-live-desktop-2.42.0.sha512sum

Verified OK

Differences

  • sha512 instead of sha256
  • .cer instead of .pem certificate

from ledger-live.

gre avatar gre commented on September 15, 2024

Hi @acashmoney,
I just went through the instructions of https://www.ledger.com/ledger-live/lld-signatures

and to me it works correctly:

Screenshot 2022-06-06 at 15 53 32

  • The installer binaries are all hashed using SHA512 into a checksum files:
$ cat ledger-live-desktop-2.42.0.sha512sum
51d61df7e9c0c716eaa57700dc871e745d2206727c3400b06ef6c30a0e535679ee99bb2f04dbafdbcdcc5e28dc24f97e6fb5c811360a5df83ace517651c192dc ledger-live-desktop-2.42.0-linux-x86_64.AppImage
dfea05c59003b60a55a50998285c4f57b261b09fd211cc0e624cbfa82690be069abcebb0e07e12a61634deb28035a5bf49557a2afdb12fc5306e2743b915cbb8 ledger-live-desktop-2.42.0-mac.dmg
ef20a9edb9f5419db1379e756f170faed0a7dd6893aa961df47d76970b09f6fc0448b89e7f934127f265f5ae4da72d3852b3815005dc00883d82f8c69f42ad49 ledger-live-desktop-2.42.0-mac.zip
0fb189e8e6f3f6d15a298040ccc896d43f09766b25f7fba67d549fe09ec14269d41bead677186ed2acfa2ce458a78c37481307c3fe7599d80688a10f320ff563 ledger-live-desktop-2.42.0-win-x64.exe
  • a SHA256 hash of this file is then produced. in this case, c0bf4150fa081dba51b42997df59c913f1440f7bc9086fefff303abc55d4c3c3
  • a signature of this hash is done by ledger. it's the .sig file.

that's why you give -sha256 to openssl as it need to hash with SHA256 the ledger-live-desktop-2.42.0.sha512sum checksum file.

Indeed we use a combination of SHA 512 and SHA 256 and this probably creates this confusion. I hope this explanation makes sense.

from ledger-live.

acashmoney avatar acashmoney commented on September 15, 2024

Thanks for clearing up the confusion @gre. Verification works now on my end. Cheers!

from ledger-live.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.