Skip to main content

Reproducible builds

Zunia aims for bit-for-bit verifiable wallet artifacts so users and auditors can rebuild what they install.

Kernel (zunia-core)​

The signing kernel ships npm WASM, native mobile libraries, and Dart FFI bindings. Release process, tags, checksums, and consumer update PRs are documented in:

zunia-core/RELEASING.md

Verify release artifacts against SHA256SUMS (and GPG signatures when the release key is published).

Browser extension​

Extension packaging must be rebuildable from a signed git tag. The draft rebuild steps are in zunia-extension/docs/reproducible-builds.md. No external rebuild has passed them yet, so the Chrome Web Store build is not claimed reproducible. Store rewrapping means a bit-identical Chrome Web Store package is not a goal yet either.

What is not claimed yet​

  • App Store / Play Store binaries are not asserted reproducible until the release pipeline and public instructions are complete.
  • Do not treat draft docs or local pnpm build output as an audited release.