Reproducible as far as we can go

Build it yourself

The published wallets are not signed by Apple or Microsoft. A checksum is the whole story. If you do not want to trust a download, compile the same crate the release was built from and compare the hash.

GitHub Actions builds the Windows binaries from this repository. macOS DMGs are built on the maintainer’s machines and checksummed here. Nobody notarizes them. That is a limitation, not a temporary skip.

1. Get the source

git clone https://github.com/Instinctes/nightfall
cd nightfall
git checkout v0.7.7   # or the tag printed next to the download
rustc --version

Use a current stable Rust. The lockfile pins crates; it does not pin the compiler. Two people with different rustc versions can get different bytes and the same behaviour. Compare behaviour and the published checksum of the released file — do not expect your local binary to match the DMG byte-for-byte unless you use the same OS, the same rustc, and the same build script.

2. Build Core, the CLI wallet, the node

cargo build --release -p nightfall-core
cargo build --release -p nightfall-wallet
cargo build --release -p nightfall-node

Binaries land in target/release/ as nightfall-core, nightfall-wallet, nightfalld. On Windows the names end in .exe.

3. Check a downloaded file

macOS / Linux:

shasum -a 256 NIGHTFALLCOIN-Core-0.7.7-macOS-arm64.dmg
grep NIGHTFALLCOIN-Core-0.7.7-macOS-arm64.dmg SHA256SUMS-0.7.7.txt

Windows (PowerShell):

Get-FileHash .\\nightfall-core-0.7.7-windows-x64.exe -Algorithm SHA256
Get-Content .\\SHA256SUMS-0.7.7-windows.txt

The two lines must match. Checksums for the current desktop release: SHA256SUMS-0.7.7.txt, SHA256SUMS-0.7.7-windows.txt, SHA256SUMS-0.7.7-linux.txt. Phone builds are still 0.7.0 and have their own lists.

4. What this does not prove

It does not prove the source is free of bugs. It proves the file you have is the file we published.
It does not replace an outside audit. See the internal review.
It does not make the binary trusted by the OS. Gatekeeper and SmartScreen will keep warning. That is expected.

Linux node without the wallet

Read the installer, then run it. Do not pipe curl into bash. The same file is on this site and on GitHub.

curl -fsSL https://nightfallcoin.org/scripts/install-node-linux.sh -o install-node.sh
less install-node.sh
sudo bash install-node.sh          # relay only
sudo bash install-node.sh --mine   # also mines; holds a key

Prebuilt binaries, if you would rather not compile: nightfalld-0.7.7-linux-x64, nightfall-wallet-0.7.7-linux-x64, nightfall-core-0.7.7-linux-x64 (Core needs GTK). Check SHA256SUMS-0.7.7-linux.txt.

A public seed (always-on, no keys, TCP 17891 open) uses install-seed-node-linux.sh instead. Both check genesis 061a052d49607ff8f4b306c75d622ebd230cff4ec3a45a6dffc2f7738d4b20de before they enable the service.