MORANANETWORK
Download Wallet ↓
Users

Verify Your Download

There is currently no way to authenticate a Morana binary, and we are not going to pretend otherwise. Build from source until the update root below is live.

Why this page used to say something else

This page used to publish a minisign public key and tell you to pin it: "that one-time pin is your root of trust." That was a second root of trust standing next to TUF, and a weaker one. Two roots never add up — an attacker goes after whichever is easier, so the weaker root quietly becomes the security of every update the project ships.

A single online signing key is the weaker root:

  • no threshold — one compromised key is a valid release;
  • no expiry — a key that leaked a year ago still verifies today;
  • no rotation path — replacing it means asking every tester to re-pin out of band, which most will never see;
  • no rollback protection — an attacker who can serve you files can serve you an old signed release with a known hole, and the signature checks out.

Verifying a signature under those conditions tells you less than it feels like it does. That gap between felt safety and actual safety is the thing worth removing.

The one root: TUF

Morana updates will be authenticated by The Update Framework and by nothing else. TUF makes the four properties above structural rather than a matter of discipline: separate roles (root / targets / snapshot / timestamp), a key threshold per role, metadata that expires so a stalled or frozen mirror is detected rather than trusted, and explicit rollback protection.

The Morana updater is not built yet. When it lands, the TUF root metadata and the pinning steps will be published on the verify page — one root, described in exactly one place.

There is no auto-updater and there will not be a silent one (that would leak metadata about

who runs the app and when). Updating stays an act you take deliberately.

What to do today

Compile it yourself:


git clone https://github.com/Morana-Network/morana-wallet-rs
cd morana-wallet-rs
git log --oneline -5      # exactly what you are about to build
cargo build --release

For the desktop app:


cd apps/desktop && npm install && npm run tauri build

If someone hands you a "Morana build"

Treat it as hostile. Nobody — including us — can currently prove where a distributed binary came from. If you are offered one, or you find one being circulated, report it through the disclosure channel in /.well-known/security.txt.

This is a public testnet and the coins have no value, so the realistic damage from a malicious build is to your machine rather than your balance. That is still worth avoiding.