# Code & Binary Verify

Some users of this software have relatively high requirements for security, so here are instructions on how to verify
whether the code and executable files have been tampered with.If you find that the signature is incorrect, please stop
using it immediately.

## Code compilation

When you see the document, every binary file version released on github is automatically compiled after submission using **Github Actions**. The generation of the final code is completely done by Github Actions. I will not compile the code on my local machine, but may use my machine to sign the packaged code. The code for all release versions comes from the main branch of the Github repository.

All commands and environment configuration at compile time can be consulted in the project
code(`.github/workflow/release.yml`).

## Introduction of third-party libraries

For safety reasons, GnuPG will not be available in the major releases of GpgFrontned. GpgFrontnend will not use insecure or non-open source third-party libraries. The compiled version of the third-party library comes from the public code repository.

## Verify Code

If you have the need, interest or time, you are welcome to review the code that I use and write. When you have any
questions, please feel free to [Contact ME](../contract.md).

I will sign most new git commit. The key I use is the key that I use to perform Git related operations:
Saturneric\<eric@bktus.com\>. It will be given at the end of this description. For information about signing git commits, you
can see it on the github interface.

The fingerprint of the key is now given:

```text
E3379489C39B7270E70E2E303AAF1C64137CEE57
```

## Verify Release Binary Verify

### ZIP package Sign

Starting from version 1.0.5, I will use the Gpg key to sign the ZIP package that contains the binary executable file.
Each ZIP compressed package will be accompanied by a signature file in the Release (end with sig suffix). You can use
the gpg command tool to verify them before use. 

The key used for binary signature is Saturneric\<eric@bktus.com\>. This is my official key and will be given below.

The fingerprint of the key is now given:

```text
E3379489C39B7270E70E2E303AAF1C64137CEE57
```

## Check on About Interface

There is an About interface under the help option in the top menu.You can check the version and platform of this binary
file. More importantly, you can view the github repository branch and commit hash code corresponding to the source code
used for compilation of this binary version on the second line.

![About Interface](https://github.com/saturneric/Blob/blob/master/screenshots/check-build.png?raw=true)

## Pubkey Mentioned Above

#### Fingerprint

```text
E3379489C39B7270E70E2E303AAF1C64137CEE57
```

#### Pubkey Content (OpenPGP)

```text
-----BEGIN PGP PUBLIC KEY BLOCK-----

[encoded data, 5070 characters]
hHHFn9+/wu20
=bgvm
-----END PGP PUBLIC KEY BLOCK-----

```