+ The Keybase.io website allows you to independently verify that the public key provided is authentic and that it belongs to the organization it claims to represent. + Keybase has checked the pubkey cryptographically when it was saved in the 3 separate online locations. These are: on www.twitter.com/seedsigner, on the website www.seedsigner.com , and in the software repository at Github www.github.com/seedsigner. + You can verify those 3 separate Key locations yourself, by clicking the 3 blue badges on www.keybase.io/seedsigner. (The Twittter blue badge one is the most human-readble.) + + If you need more information, please open the website KeyBase.io/SeedSigner (it opens in a separate tab or window) +
++ +More specifically, the verify command determines *which* key pair of those already installed on your computer, actually signed the sha256.sig file. It does this by cryptographically comparing the sha25.sig file to its unsigned equivalent (the .sha256 file), looping through the public keys already imported into your computer. whichever installed/imported key is able to perform the comparision successfully, then that is the pubkey of the keypair that was used! + +
+- The Keybase.io website allows you to independently verify that the public key provided is authentic and that it belongs to the organization it claims to represent. - Keybase has checked the pubkey cryptographically when it was saved in the 3 separate online locations. These are: on www.twitter.com/seedsigner, on the website www.seedsigner.com , and in the software repository at Github www.github.com/seedsigner. - You can verify those 3 separate Key locations yourself, by clicking the 3 blue badges on www.keybase.io/seedsigner. (The Twittter blue badge one is the most human-readble.) + The Keybase.io website allows you to independently verify that the public key provided is authentic and that it belongs to the organization it claims to represent. + Keybase has already checked the three pubkey files cryptographically when they were saved, however, if you would like to, you can further verify the three Key publications, either: + + - via Keybase: By clicking on any of the three blue badges at www.keybase.io/seedsigner. (The blue badge for the publication on Twitter is in the most human-readable form), or, + - without using keybase at all: By using these 3 links directly: [Twitter](https://twitter.com/seedsigner/status/1530555252373704707) , [Github](https://gist.github.com/SeedSigner/5936fa1219b07e28a3672385b605b5d2) and [Seedsigner.com](https://seedsigner.com/keybase.txt). This method can be used if you would like to make an even deeper, independent inspection without relying on Keybase at all, or if the Keybase.io site is no longer valid or it is removed entirely. + If you need more information, please open the website KeyBase.io/SeedSigner (it opens in a separate tab or window)
From 3c43ea3a291b5d73d8f374430e00e49973937d9d Mon Sep 17 00:00:00 2001 From: Marc G <91296549+Marc-Gee@users.noreply.github.com> Date: Sun, 29 Jan 2023 12:07:04 +0000 Subject: [PATCH 15/41] Updates to shorten the verification instructions --- README.md | 82 +++++++++++++++++++++++++++---------------------------- 1 file changed, 40 insertions(+), 42 deletions(-) diff --git a/README.md b/README.md index eaf01cfe..e46d1b0c 100644 --- a/README.md +++ b/README.md @@ -102,30 +102,27 @@ You can quickly verify that the downloaded software is both authentic and unalte These next steps assume you are running the commands from a computer where both [GPG](https://gnupg.org/download/index.html) and [shasum](https://command-not-found.com/shasum) are already installed, and that you also know [how to navigate on a terminal](https://terminalcheatsheet.com/guides/navigate-terminal). -### 1. Import the public key of the SeedSigner project into your computer +### 1. Import the public key of the SeedSigner project into your computer: -The *fetch-keys* command below will import the SeedSigner projects public key from a popular online keyserver called *Keybase.io*, into your computers *keychain*. +Run the *fetch-keys* command to import the SeedSigner projects public key from the popular online keyserver called *Keybase.io*, into your computers *keychain*. -To begin, you will run the *fetch-keys* command as shown below (run it from inside the *same folder* that you saved the downloaded files into). ``` gpg --fetch-keys https://keybase.io/SeedSigner/pgp_keys.asc ``` -When the command completes successfully, it will show that this key was either imported or updated from Keybase.io. -A numeric ID, as circled in red in the example below is known as the key's fingerprint. Please ignore the email address shown, because it is not part of any verification. +When the command completes successfully, it should display that a key was either imported or updated. Ignore any email address shown. - The Keybase.io website allows you to independently verify that the public key provided is authentic and that it belongs to the organization it claims to represent. - Keybase has already checked the three pubkey files cryptographically when they were saved, however, if you would like to, you can further verify the three Key publications, either: +Keybase.io allows you to independently verify that the public key saved on Keybase.io, is both authentic and that it belongs to the organization it claims to represent. + Keybase has already checked the three pubkey files cryptographically when they were saved. However, if you like, you can further verify the Key publications, either : - - via Keybase: By clicking on any of the three blue badges at www.keybase.io/seedsigner. (The blue badge for the publication on Twitter is in the most human-readable form), or, - - without using keybase at all: By using these 3 links directly: [Twitter](https://twitter.com/seedsigner/status/1530555252373704707) , [Github](https://gist.github.com/SeedSigner/5936fa1219b07e28a3672385b605b5d2) and [Seedsigner.com](https://seedsigner.com/keybase.txt). This method can be used if you would like to make an even deeper, independent inspection without relying on Keybase at all, or if the Keybase.io site is no longer valid or it is removed entirely. + - *via Keybase*: By clicking on any of the three blue badges at [Keybase.io/seedsigner](www.keybase.io/seedsigner) to see what was published there. (The blue badge for the publication on Twitter is in the most human-readable form and it is also bi-directional), or, + - *without keybase*: By using these 3 links directly: [Twitter](https://twitter.com/seedsigner/status/1530555252373704707) , [Github](https://gist.github.com/SeedSigner/5936fa1219b07e28a3672385b605b5d2) and [Seedsigner.com](https://seedsigner.com/keybase.txt). This method can be used if you would like to make an even deeper, independent inspection without relying on Keybase at all, or if the Keybase.io site is no longer valid or it is removed entirely. - - If you need more information, please open the website KeyBase.io/SeedSigner (it opens in a separate tab or window) +Once you have used one of these methods, you will know if the Public Key stored on Keybase, is genuinely from the SeedSinger Project or not.
Since you are going to now match the outputted fingerprint ID against Keybase.io/seedsigner, you can ignore this warning message: + +``` +> WARNING: This key is not certified with a trusted signature! +> There is no indication that the signature belongs to the owner. + ``` -This warning message can be safely ignored *because* you are still going to be visually comparing the fingerprint ID outputted against Keybase.io/seedsigner. -> gpg: WARNING: This key is not certified with a trusted signature! -> gpg: There is no indication that the signature belongs to the owner. - -**If** you received the phase **"good Signature"**, then the last output line will display a 16 character fingerprint ID. -That is the all-important *signers* fingerprint ID. -You **must** now visually compare that ID to the one shown at Keybase.io/SeedSigner, **yourself**. -Any email address is JUST informational. Ignore it completely. *Only* the matching fingerprints count. +
+-More specifically, the verify command determines *which* key pair of those already installed on your computer, actually signed the sha256.sig file. It does this by cryptographically comparing the sha25.sig file to its unsigned equivalent (the .sha256 file), looping through the public keys already imported into your computer. whichever installed/imported key is able to perform the comparision successfully, then that is the pubkey of the keypair that was used! +More specifically, the verify command determines *which* key pair of those already installed on your computer, actually signed the sha256.sig file. It does this by cryptographically comparing the sha256.sig file to its unsigned equivalent (the .sha256 file), while looping through the public keys already imported into your computer. Whomever's pre-imported Pubkey is able to perform the comparison successfully, is the Pubkey of the keypair used in the signing process. That 'winning' Public key must match the Public Key we have previously found, and verified as genuine on keybase.io.
Since you are going to now match the outputted fingerprint ID against Keybase.io/seedsigner, you can ignore this warning message:
@@ -161,7 +161,8 @@ Ignore any email addresses. *Only* matching fingerprints count here.
Now open the website [Keybase.io/seedsigner](www.keybase.io/seedsigner) and compare the 16 character fingerprint ID (circled red in the screenshot below), to the *rightmost* 16 characters from your *verify* command. **Make sure that they match exactly**.
Since you are going to now match the outputted fingerprint ID against Keybase.io/seedsigner, you can ignore this warning message:
+ Since you are going to now match the outputted fingerprint ID against the source proofs at Keybase.io/seedsigner, you can ignore this warning message:
```
> WARNING: This key is not certified with a trusted signature!
> There is no indication that the signature belongs to the owner.
```
-
-
-Keybase.io allows you to independently verify that the public key saved on Keybase.io, is both authentic and that it belongs to the organization it claims to represent.
- Keybase has already checked the three pubkey files cryptographically when they were saved. However, if you like, you can further verify the Key publications, either :
-
- - *via Keybase*: By clicking on any of the three blue badges at [Keybase.io/seedsigner](www.keybase.io/seedsigner) to see what was published there. (The blue badge for the publication on Twitter is in the most human-readable form and it is also bi-directional), or,
- - *without keybase*: By using these 3 links directly: [Twitter](https://twitter.com/seedsigner/status/1530555252373704707) , [Github](https://gist.github.com/SeedSigner/5936fa1219b07e28a3672385b605b5d2) and [Seedsigner.com](https://seedsigner.com/keybase.txt). This method can be used if you would like to make an even deeper, independent inspection without relying on Keybase at all, or if the Keybase.io site is no longer valid or it is removed entirely.
-
-Once you have used one of these methods, you will know if the Public Key stored on Keybase, is genuinely from the SeedSinger Project or not.
- Since you are going to now match the outputted fingerprint ID against the source proofs at Keybase.io/seedsigner, you can ignore this warning message:
+ Since you are about to match the outputted fingerprint/ID against the proofs at Keybase.io/seedsigner, and thereby confirm who the pubkey really belongs to-, you can safely ignore this warning message:
```
> WARNING: This key is not certified with a trusted signature!
@@ -157,30 +139,49 @@ On the *last* output line, look at the *rightmost* 16 characters (circled in red
+The verify command will attempt to decrypt the signature file (sha256.sig) by trying each public key already imported into your computer. If the public key we just imported (via fetch-keys), manages to: (a) successfully decrypt the .sig file , and (b), that result matches exactly to the clear-text equivalent (.sha256) of the .sig file, then its "a good signature"!
+
+Crucially, we must still manually check who *exactly* owns the Key ID which gave us that "Good signature". Thats what the warning message means- Who does the matching key really belong to? We will start by looking at keybase.io to see if it is "The Seedsigner project"'s public Key or not.
+Note that it is the file hashes of .sig and .sha256 that *verify* compares, not their raw contents.
+
+
+Keybase.io allows you to independently verify that the public key saved on Keybase.io, is both authentic and that it belongs to the organization it claims to represent.
+ Keybase has already checked the three pubkey file locations cryptographically when they were saved there. You can further verify the key publications if you would like:
+
+ - *via Keybase*: By clicking on any of the three blue badges to see that the "proof" was published at that location. (The blue badge marked as tweet, is in the most human-readable form and it is also a bi-directional link on Twitter)
+or,
+ - *without keybase (out-of-band)*: By using these 3 links directly: [Twitter](https://twitter.com/seedsigner/status/1530555252373704707), [Github](https://gist.github.com/SeedSigner/5936fa1219b07e28a3672385b605b5d2) and [Seedsigner.com](https://seedsigner.com/keybase.txt). This method can be used if you would like to make an even deeper, independent inspection without relying on Keybase at all, or if the Keybase.io site is no longer valid or it is removed entirely.
-More specifically, the verify command determines *which* key pair of those already installed on your computer, actually signed the sha256.sig file. It does this by cryptographically comparing the sha256.sig file to its unsigned equivalent (the .sha256 file), while looping through the public keys already imported into your computer. Whomever's pre-imported Pubkey is able to perform the comparison successfully, is the Pubkey of the keypair used in the signing process. That 'winning' Public key must match the Public Key we have previously found, and verified as genuine on keybase.io.
-
+Once you have used one of these methods, you will know if the Public Key stored on Keybase, is genuinely from the SeedSinger Project or not.
-
+
+
If the two fingerprint ID's match exactly, then you have successfully confirmed that your .sig file is authentic!
From 615460736c65f68b55f5a2ff243cd9ca0b03ae74 Mon Sep 17 00:00:00 2001
From: Marc G <91296549+Marc-Gee@users.noreply.github.com>
Date: Sun, 29 Jan 2023 08:16:05 -0800
Subject: [PATCH 17/41] Improved Screenshots
(nicer masking in the image)
---
README.md | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/README.md b/README.md
index 0cc4f43b..a295851c 100644
--- a/README.md
+++ b/README.md
@@ -142,19 +142,17 @@ gpg --verify seedsigner_0_*_*.img.zip.sha256.sig
When the command completes successfully, it should look like this:
-
-It must show "**good** signature". Ignore any email addresses. *Only* matching fingerprints count here.
+
+It must display "**Good** signature". Ignore any email addresses. *Only* matching fingerprints count here. Stop here immediately if it displays "*Bad signature*"!
On the *last* output line, look at the *rightmost* 16 characters (circled in red in the picture above). That is *who* made the signature file (.sig).
- About warning messages:
- About the warning message:
+
@@ -167,7 +165,7 @@ Now open the website [Keybase.io/seedsigner](www.keybase.io/seedsigner) and comp
If the two fingerprint ID's match exactly, then you have successfully confirmed that your .sig file is authentic!
-If they do ***not match exactly***, or your verify command displays "BAD signature", then you must stop here immediately. Do not continue. Contact us for assistance in the Telegram group address above.
+If they do ***not match exactly***, or your verify command displayed "Bad signature", then you must stop here immediately. Do not continue. Contact us for assistance in the Telegram group address above.
Learn more about signature file verification
From b04383d087aed29462232f4334e1f2d0e8621be2 Mon Sep 17 00:00:00 2001
From: Marc G <91296549+Marc-Gee@users.noreply.github.com>
Date: Sun, 29 Jan 2023 20:02:19 +0000
Subject: [PATCH 18/41] Verification: Shortening, reordering & clarify
---
README.md | 96 +++++++++++++++++++++++++++++--------------------------
1 file changed, 50 insertions(+), 46 deletions(-)
diff --git a/README.md b/README.md
index a295851c..ec5b3313 100644
--- a/README.md
+++ b/README.md
@@ -90,64 +90,46 @@ Download these files to your computer:
2. seedsigner_0_5_x.img.zip.sha256
3. seedsigner_0_5_x.img.zip.sha256.sig
-Once the files have all finished downloading, follow the steps below to verify, and to write the software onto a MicroSD card. Then insert the MicroSD into your assembled hardware and turn on the USB power. Allow about 45 seconds for our logo to appear, and then you can begin using your Seedsigner!
-
**Note:** The version numbers of the latest files will be higher than this example, but the naming format will be the same.
+Once the files have all finished downloading, follow the steps below to verify them, and then to write the software onto a MicroSD card. Insert the MicroSD into your assembled hardware and turn on the USB power. Allow about 45 seconds for our logo to appear, and then you can begin using your Seedsigner!
+
+
## Verifying that the downloaded files are authentic (optional but highly recommended!)
-You can quickly verify that the downloaded software is both authentic and unaltered, by following these instructions.
-
-These next steps assume you are running the commands from a computer where both [GPG](https://gnupg.org/download/index.html) and [shasum](https://command-not-found.com/shasum) are already installed, and that you also know [how to navigate on a terminal](https://terminalcheatsheet.com/guides/navigate-terminal).
+You can quickly verify that the software you just downloaded is both authentic and unaltered, by following these instructions.
+We assume you are running the commands from a computer where both [GPG](https://gnupg.org/download/index.html) and [shasum](https://command-not-found.com/shasum) are already installed, and that you also know [how to navigate on a terminal](https://terminalcheatsheet.com/guides/navigate-terminal).
-### 1. Import the public key of the SeedSigner project into your computer:
+### Step 1. Verify that the signature (.sig) file is genuine:
-Run the *fetch-keys* command to import the SeedSigner projects public key from the popular online keyserver called *Keybase.io*, into your computers *keychain*.
+Run GPG's *fetch-keys* command to import the SeedSigner projects public key from the popular online keyserver called *Keybase.io*, into your computers *keychain*.
```
gpg --fetch-keys https://keybase.io/SeedSigner/pgp_keys.asc
```
-When the command completes successfully, it should display that a key was either imported or updated. Ignore any email address shown.
+The result should confirm that 1 key was *either* imported or updated. *Ignore* any key ID's or email addresses shown.
-Learn more about how keybase.io helps you check that someone is who they say they are
-
-
-
-### 2. Checking that the *signature file* is genuinely from the SeedSigner Project:
-
-Running this *verify* command, will determine *who* created the signature file (.sig) you downloaded already.
-The output will display the all-important *signers* fingerprint, and it is this fingerprint ID which you will want to match to keybase, by yourself.
-
+Next, you will run the *verify* command on the signature (.sig) file. (*Verify* must be run from inside the same folder that you downloaded the files into earlier. The `*`'s in this command will auto-fill the version from your current folder, so it should be copied and pasted as-is.)
```
gpg --verify seedsigner_0_*_*.img.zip.sha256.sig
```
-**Note:** *Verify* must be run from inside the *same folder* that you downloaded the files into. The `*`'s in the command will auto-fill the version from your current folder, so it should be copied and pasted as-is.
-When the command completes successfully, it should look like this:
+When the verify command completes successfully, it should display output like this:
-It must display "**Good** signature". Ignore any email addresses. *Only* matching fingerprints count here. Stop here immediately if it displays "*Bad signature*"!
+The result must display "**Good signature**". Ignore any email addresses - *only* matching Key fingerprints count here. Stop immediately if it displays "*Bad signature*"!
-On the *last* output line, look at the *rightmost* 16 characters (circled in red in the picture above). That is *who* made the signature file (.sig).
+
+On the *last* output line, look at your *rightmost* 16 characters (the 4 blocks of 4).
+**Crucially, we must now check WHO that Primary key fingerprint /ID belongs to.** We will start by looking at Keybase.io to see if it is the *Seedsigner project* 's public key or not.
+
About the warning message:
-
-Now open the website [Keybase.io/seedsigner](www.keybase.io/seedsigner) and compare the 16 character fingerprint ID (circled red in the screenshot below), to the *rightmost* 16 characters from your *verify* command. **Make sure that they match exactly**.
+ More about how the verify command works:
+
+
+Now to determine ***who*** the Public key ID belongs to: Goto [Keybase.io/seedsigner](www.keybase.io/seedsigner)
-If the two fingerprint ID's match exactly, then you have successfully confirmed that your .sig file is authentic!
+**You must now *manually* compare: The 16 character fingerprint ID (as circled in red above) to, those *rightmost* 16 characters from your *verify* command.**
+
+**If they match exactly, then you have successfully confirmed that your .sig file is authentically from the Seedsigner Project!**
-If they do ***not match exactly***, or your verify command displayed "Bad signature", then you must stop here immediately. Do not continue. Contact us for assistance in the Telegram group address above.
-
-Learn more about signature file verification
+Learn more about how keybase.io helps you check that someone (online) is who they say they are:
+
+If the two ID's do *not* match, then you must stop here immediately. Do not continue. Contact us for assistance in the Telegram group address above.
-### 3. Verifying that the *software files* are genuine
+### 2. Verifying that the *software images/binaries* are genuine
-Running the *shasum* command, is the final verification step and will confirm (via file hashing) that the software code (ie the binary files inside the zip file), were not altered, or added to, since publication or during your download. (Not by even one single character!)
+Now that you have confirmed that you do have the real Seedsigner Project's Public Key (ie the 16 characters match) - you can return to your terminal window. Running the the *shasum* command, is the final verification step and will confirm (via file hashing) that the software code/image files (ie the binary files inside the zip file), were also not altered since publication, or even during your download process.
**On Linux or OSX:** Run this command
```
@@ -191,21 +192,24 @@ shasum -a 256 -c seedsigner_0_*_*.img.zip.sha256
```
CertUtil -hashfile seedsigner_0_*_*.img.zip SHA256 | findstr /v "hash"
```
+
-Wait about 30 seconds for the command to complete
+Wait about 30 seconds for the command to complete, and it should display:
```
seedsigner_0_5_x.img.zip: OK
shasum: WARNING: 4 Lines are improperly formatted
```
-**If you receive the "OK" message** for the **seedsigner_[VersionNumber].img.zip file**, as shown above, then your verification is fully complete!
-**All of your downloaded files have now been confirmed as both authentic and unaltered!** 😄😄 !!
+**If you receive the "OK" message** for your **seedsigner_[x.x.x.VersionNumber].img.zip file**, as shown above, then your verification is fully complete!
+**All of your downloaded files have now been confirmed as both authentic and unaltered!** You can proceed to create/write your MicroSD card😄😄 !!
The warning message describing '4 lines being improperly formatted' can be safely ignored.
If your file result shows "FAILED", then you must stop here immediately. Do not continue. Contact us for assistance at the Telegram group address above.
+
Please recognize that this process can only validate the software to the extent that the entity that first published the key is an honest actor, and their private key is not compromised or somehow being used by a malicious actor.
+
## Writing the software to your MicroSD card
From a136a863552f9e1b0ff010d8036435e0d9aadc87 Mon Sep 17 00:00:00 2001
From: Marc G <91296549+Marc-Gee@users.noreply.github.com>
Date: Mon, 30 Jan 2023 15:52:52 -0800
Subject: [PATCH 19/41] Fix Spelling, grammar and shasum command
Spelling, grammar edits were made, - as suggested by the reviewers comments.
Additionally: 1) the Windows certutil (aka shasum) command for windows was clarified.
2) the shasum command on osX and Linux now includes the ignore-missing flag for compatibility with the expected new 0.5.2 shasum file format. The 0.5.2 shasum file will include hashes for multiple binaries now , but the user will likely only be checking one single binary. hence we tell shasum command to skip any missing files and to not report "missing files" error.
---
README.md | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/README.md b/README.md
index ec5b3313..6c948301 100644
--- a/README.md
+++ b/README.md
@@ -91,7 +91,7 @@ Download these files to your computer:
3. seedsigner_0_5_x.img.zip.sha256.sig
**Note:** The version numbers of the latest files will be higher than this example, but the naming format will be the same.
-Once the files have all finished downloading, follow the steps below to verify them, and then to write the software onto a MicroSD card. Insert the MicroSD into your assembled hardware and turn on the USB power. Allow about 45 seconds for our logo to appear, and then you can begin using your Seedsigner!
+Once the files have all finished downloading, follow the steps below to verify the download before continuing on to write the software onto a MicroSD card. Next, insert the MicroSD into your assembled hardware and connect the USB power. Allow about 45 seconds for our logo to appear, and then you can begin using your Seedsigner!
@@ -179,20 +179,21 @@ If the two ID's do *not* match, then you must stop here immediately. Do not cont
-### 2. Verifying that the *software images/binaries* are genuine
+### Step 2. Verifying that the *software images/binaries* are genuine
Now that you have confirmed that you do have the real Seedsigner Project's Public Key (ie the 16 characters match) - you can return to your terminal window. Running the the *shasum* command, is the final verification step and will confirm (via file hashing) that the software code/image files (ie the binary files inside the zip file), were also not altered since publication, or even during your download process.
**On Linux or OSX:** Run this command
```
-shasum -a 256 -c seedsigner_0_*_*.img.zip.sha256
+shasum -a 256 --ignore-missing -check seedsigner_0_*_*.img.zip.sha256
```
**On Windows (inside Powershell):** Run this command
```
CertUtil -hashfile seedsigner_0_*_*.img.zip SHA256 | findstr /v "hash"
```
-
+On Windows, you must manually compare the above resulting hash value to the corresponding hash value shown inside the .SHA256 cleartext file.
+
Wait about 30 seconds for the command to complete, and it should display:
```
From e1090ba0c5d4ef525900462fded4b45a29842d0b Mon Sep 17 00:00:00 2001
From: Marc G <91296549+Marc-Gee@users.noreply.github.com>
Date: Tue, 31 Jan 2023 05:21:38 -0800
Subject: [PATCH 20/41] Fix SHASUM option flag typo --check
---
README.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/README.md b/README.md
index 6c948301..de7e54a5 100644
--- a/README.md
+++ b/README.md
@@ -185,7 +185,7 @@ Now that you have confirmed that you do have the real Seedsigner Project's Publi
**On Linux or OSX:** Run this command
```
-shasum -a 256 --ignore-missing -check seedsigner_0_*_*.img.zip.sha256
+shasum -a 256 --ignore-missing --check seedsigner_0_*_*.img.zip.sha256
```
**On Windows (inside Powershell):** Run this command
From d8de405acc632d9ab91d5d681195b3abaf4913d7 Mon Sep 17 00:00:00 2001
From: Marc G <91296549+Marc-Gee@users.noreply.github.com>
Date: Thu, 2 Feb 2023 17:12:22 -0800
Subject: [PATCH 21/41] Inserted instructions on MicroSD writing.
1st draft of MicroSD.
Thus far I am holding back on elaborating on the DD usage, until the commands are tested some more.
I have/can insert screenshots of the Pi Imager/Etcher basic actions, but I am concerned its getting too long.
---
README.md | 27 ++++++++++++++++++++++++---
1 file changed, 24 insertions(+), 3 deletions(-)
diff --git a/README.md b/README.md
index de7e54a5..996f8328 100644
--- a/README.md
+++ b/README.md
@@ -213,9 +213,30 @@ Please recognize that this process can only validate the software to the extent
-## Writing the software to your MicroSD card
- Insert more instructions here.
- (to be done by MarcG)
+## Writing the software onto your MicroSD card
+
+To write the SeedSigner software onto your MicroSD card, there are a few options available:
+| Application | Description | Platform and official Source |
+|--------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------|
+| Balena Etcher | The application is called Etcher, and the company that wrote it is called Balena. Hence *Etcher by Balena* or *Balena Etcher* | [Available for Windows, Mac and Linux](https://www.balena.io/etcher#download-etcher) |
+| Raspberry Pi Imager | Produced by the Raspberry Pi organization. | [Available for Windows, Mac and Linux](https://www.raspberrypi.com/software/) |
+| DD Command Line Utility | Built-in to Linux and MacOS, the DD (Data Duplicator) is a tool for advanced users. If not used carefully it can accidentally format the incorrect disk! | Built-in to Linux and MacOS |
+
+Be sure to download the software from the genuine publisher.
+Either of the Etcher or Pi Imager software is recommended. Some seedsigner users have reported a better experience with one or the other. So, if the one application doesn’t work well for your particular machine, then please try the other one.
+
+### **General Considerations:**
+Make sure to set any write-protection physical slider on the MicroSD Card Adapter to UN-locked.
+You *dont* need to unzip the .zip file beforehand. You also don’t need to pre-format the MicroSD beforehand.
+Please use Etchers or Pi Imagers *verify* feature to make sure the card was written successfully! This can save a lot of effort troublsshooting issues where your seedsigner device doesn’t boot up or nothing displays on the SeedSigner screen at power on.
+Writing the MicroSd card is also known as flashing.
+It will overwrite everything on the MicroSD card.
+If the one application fails for you, then please try again using the other application.
+#### **Specific considerations for Windows users:**
+Windows can sometimes flag the writing of a MicroSD as risky behaviour and hence it may prevent this activity. If this happens, your writing/flashing will fail, hang or wont even begin, in which case you should to try to run the Etcher/Pi-Imager app "As administrator", (right-click and choose that option). It can also be blocked by windows security in some cases, so If you have the (non-default) *Controlled Folder Access* option set to active, try turning that *off* temporarily.
+
+
+Advanced users may want to try the Linux/MacOS *DD* command instead of Etcher or Pi Imager, however, a reminder is given that DD can overwrite the wrong disk if you are not careful !
---------------
From e901621ff91ae6494b4085142400b8dfbb9400a2 Mon Sep 17 00:00:00 2001
From: ValueOverflow <124897511+ValueOverflow@users.noreply.github.com>
Date: Mon, 13 Feb 2023 10:44:14 -0500
Subject: [PATCH 22/41] Add files via upload
The files may need to be in place before the readme.md can link to them. I'll submit a PR for an edited readme if these are approved for inclusion.
---
docs/21x21_A4_trading_card_2sided.pdf | Bin 0 -> 112100 bytes
docs/21x21_letter_trading_card_2sided.pdf | Bin 0 -> 101557 bytes
docs/25x25_A4_trading_card_2sided.pdf | Bin 0 -> 132136 bytes
docs/25x25_letter_trading_card_2sided.pdf | Bin 0 -> 130064 bytes
docs/29x29_A4_trading_card_2sided.pdf | Bin 0 -> 144916 bytes
docs/29x29_letter_trading_card_2sided.pdf | Bin 0 -> 143302 bytes
6 files changed, 0 insertions(+), 0 deletions(-)
create mode 100644 docs/21x21_A4_trading_card_2sided.pdf
create mode 100644 docs/21x21_letter_trading_card_2sided.pdf
create mode 100644 docs/25x25_A4_trading_card_2sided.pdf
create mode 100644 docs/25x25_letter_trading_card_2sided.pdf
create mode 100644 docs/29x29_A4_trading_card_2sided.pdf
create mode 100644 docs/29x29_letter_trading_card_2sided.pdf
diff --git a/docs/21x21_A4_trading_card_2sided.pdf b/docs/21x21_A4_trading_card_2sided.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..01946eea088748a5fe06a930b8b5bac4d9214793
GIT binary patch
literal 112100
zcmdSBWmFv7)-K#QK@%icAh<*0?(Pr>5Zs*xfKXHSj`bNm_q}Ww2d-^J$
zvFZp6B1sTwhDM>$lT*D;ti{^-+r@u|5fthyN{J)6PUfznzhhLEHnyv_vAefE_{`m3
ztA`PhQj(qmSyDtH$|uz~#R$N95Gd8MsM)ot?~{qMU1@#;i1XWIo57<9x7SF!u}>}E
zhR#Rze!-3}45%#K^&`1;wMx6(Vd|THrDIS^=bvJMw80=$BxG~EH|H*v!YI%JR@gcX
zR2ko&2$cvD;`2t?+7