XMR-Miner

Why Verify?

Verifying downloads ensures:

• The file wasn't corrupted during download
• The file hasn't been tampered with
• You have an authentic release from the developer

This is especially important for security-sensitive applications like cryptocurrency software.

Verification Methods

We provide two verification methods:

1. SHA256 Checksum: Verifies the file matches the expected hash
2. GPG Signature: Cryptographically proves the file was signed by the developer

Using both methods provides the strongest assurance.

Method 1: SHA256 Checksum

Step 1: Download the checksum file

Download SHA256SUMS from this website.

Step 2: Calculate the APK checksum

On Linux/macOS (Terminal):

sha256sum xmr-miner-v1.0.0.apk

On Windows (PowerShell):

Get-FileHash xmr-miner-v1.0.0.apk -Algorithm SHA256

On Android (using Termux):

sha256sum /sdcard/Download/xmr-miner-v1.0.0.apk

Step 3: Compare

The output should match the hash in the SHA256SUMS file exactly. If it doesn't match, do not install the APK.

Method 2: GPG Signature

GPG verification is stronger than checksum verification because it proves the file was signed with the developer's private key.

Step 1: Install GPG

On Linux:

sudo apt install gnupg  # Debian/Ubuntu
sudo dnf install gnupg  # Fedora

On macOS:

brew install gnupg

On Windows:

Download and install Gpg4win.

Step 2: Import the project's public key

curl -O https://xmr-miner.com/pubkey.asc
gpg --import pubkey.asc

You should see output indicating the key was imported:

gpg: key ABCD1234: public key "XMR-Miner <[email protected]>" imported

Step 3: Download the signature file

Download signature.asc from this website.

Step 4: Verify the signature

gpg --verify signature.asc xmr-miner-v1.0.0.apk

Step 5: Check the result

A valid signature shows:

gpg: Good signature from "XMR-Miner <[email protected]>"

An invalid or missing signature shows:

gpg: BAD signature from "XMR-Miner <[email protected]>"

Public Key Fingerprint

To verify you have the correct public key, check its fingerprint:

gpg --fingerprint [email protected]

The fingerprint should be:

XXXX XXXX XXXX XXXX XXXX  XXXX XXXX XXXX XXXX XXXX

(Actual fingerprint will be published when the key is generated)

Verifying from Source

For maximum security, you can build the APK from source code:

1. Clone the repository: git clone https://github.com/user/xmr-miner
2. Verify the commit is signed: git verify-commit HEAD
3. Build the APK: ./gradlew assembleRelease
4. The built APK will be in app/build/outputs/apk/release/

Files Reference