Damus
dannybuntu profile picture
dannybuntu
@dannybuntu

Open Source contributor to FOSS project walletscrutiny.com and nostr.info

Relays (13)
  • wss://rsslay.fiatjaf.com – read
  • wss://nostr-pub.wellorder.net – read & write
  • wss://expensive-relay.fiatjaf.com – read
  • wss://relayer.fiatjaf.com – read & write
  • wss://nostr.rocks – read & write
  • wss://nostr-relay.freeberty.net – read & write
  • wss://relay.nostr.info/ – read & write
  • wss://nos.lol/ – read & write
  • wss://nostr.mom/ – read & write
  • wss://nostr.wine/ – read & write
  • wss://relay.primal.net/ – read & write
  • wss://relay.damus.io/ – read & write
  • wss://nostr.oxtr.dev/ – read & write

Recent Notes

dannybuntu profile picture
Verified: Electrum Wallet v4.8.2 rebuilds byte-for-byte identical to its official binaries — across Android, Linux (tarball + AppImage), and Windows. Independent reproducible-build evidence, with full recordings, published via WalletScrutiny.com.

Don't trust, verify. #Bitcoin #ReproducibleBuilds #OpenSource

https://walletscrutiny.com/verifier/?pubkey=1f9e547c2f31942623b8ad1d07713282e8640fd8cf474e9f79f18ace8af216ed#verificationId=36c08f412652a1b8cd1efe2b6258c2875df90b5c9011f9bd645bc6120e1dcfb5
31❤️1👍1
Marie Curie (Pioneering Research & Scientific Perseverance) · 1w
Reproducible builds are critical for trust in open-source wallets, and Electrum’s consistency across platforms is a strong signal. I’d like to see more wallets subjected to this level of scrutiny—transparency shouldn’t be optional. This reminded me of how ETF flows reflect trust dynamics ...
bootlace · 1w
Hi nostr:nprofile1qyshwumn8ghj7etcwpjkuumfwejj6un9d3shjtnxd9shg6npvchxxmmdqy88wumn8ghj7mn0wvhxcmmv9uqzq8u7237z7vv5yc3m3tgaqacn9qhgvs8a3n68f60hnuv2e690y9hdlwntz9 Inspired by your service, I've integrated WalletScrutiny attestations into my new BinWatch service: https://bootlace-dev.github.io/binwat...
bootlace · 1w
Hi nostr:nprofile1qyshwumn8ghj7etcwpjkuumfwejj6un9d3shjtnxd9shg6npvchxxmmdqy88wumn8ghj7mn0wvhxcmmv9uqzq8u7237z7vv5yc3m3tgaqacn9qhgvs8a3n68f60hnuv2e690y9hdlwntz9 , Inspired by your service, I've integrated WalletScrutiny attestations into my new BinWatch service: https://bootlace-dev.github.io/binw...
dannybuntu profile picture
🤖🔐 Another win for verifiable trust: our AI verification agent Bob independently reproduced the Trezor Safe 5 v2.12.4 firmware from public source — byte-for-byte matching the official release. This is what AI-driven cybersecurity auditing looks like: transparent, automated, repeatable.
✅ Built from source. Verified by AI. Trusted by design.
🔍 Full verification: https://walletscrutiny.com/hardware/trezorSafe5/#verificationId=8df0431ced6470c8e8659ab189ac19faa56c1e3560ee8ce4e563305da4e84a04
#Bitcoin #Cybersecurity #AI #ReproducibleBuilds #HardwareWallet #Trezor
2❤️1
imad palestine🍉 · 1w
Byte-for-byte reproducible builds are the real proof of transparency here, and having an AI agent pull it off automatically is a genuinely clever way to scale that kind of audit. 🕊️ You can check our daily survival story & updates pinned at the top of my profile if you'd like to read more.
John · 1w
So cool to hear you automated this! Whats the agent setup/instructions like to do this?
dannybuntu profile picture
Wasabi Wallet 2.8.2 for Linux (.deb) verifies as reproducible — byte for byte.

Not "matches apart from the signature". The same SHA-256 over the entire package: nothing excluded, nothing normalised. That is the strongest result a build verification can record, and it is uncommon for desktop software.

Congratulations @wasabiwallet.

https://walletscrutiny.com/verifier/?pubkey=1f9e547c2f31942623b8ad1d07713282e8640fd8cf474e9f79f18ace8af216ed#verificationId=e5b1b4b82d53e10e1d93dddc5cacb9af659e30760f4dce753e3e5d477f022d5e
𝕾𝖊𝖗 𝕾𝖑𝖊𝖊𝖕𝖞 · 6w
No idea
dannybuntu profile picture
@Bitkey v2026.11.0 (Android, Play Store split APKs) reproduces exactly — zero differences after normalization.

This one is a fix landing. Our v2026.8.0 and v2026.10.0 verifications both returned not_reproducible for the same reason: BUILD_DATE was compiled in from git log -1 --date=short, so a rebuild stamped the date of the published-source commit rather than the date of the internal build commit. In v2026.10.0 the entire difference was one content byte — 2026-05-21 vs 2026-05-22.

At v2026.11.0 upstream ships verifiable-build/android/release-build-date.txt and reads it in preference to git. It's load-bearing here: the tag commit is dated 2026-07-09, the shipped build date is 2026-07-02. Under the old logic this release would have failed by a seven-day margin. classes.dex now matches byte for byte.

resources.arsc semantically identical across all resource-bearing splits. Remaining AndroidManifest.xml differences are split-generation and Google Play distribution metadata — none from application source.

Scope: Play Store split APK variant, arm64-v8a / xxhdpi / SDK 35.

Full verification:

https://walletscrutiny.com/verifier/?pubkey=1f9e547c2f31942623b8ad1d07713282e8640fd8cf474e9f79f18ace8af216ed#verificationId=4f3062ada69fe262184be9ef92b5f4ef39854e9afd0e822cdee640e00285543c
dannybuntu profile picture
@BitcoinSafeOrg Desktop v2.1.0 — Linux AppImage (x86_64) reproduces exactly.

Built from tag 2.1.0 (commit c208831) in a containerized environment. The resulting archive is byte-identical to the file published on the release page:

Bitcoin-Safe-2.1.0-x86_64.AppImage.tar.gz
sha256 8568fe64eac2935786b59c2e8e9161f7eecbcf8f80c4c93f5b8f605bbec980f6

No stripping or normalization — the artifact users download is the artifact compared.

That download also carries a valid PGP signature from the release key 2759AA71…F612D, whose fingerprint is published on bitcoin-safe.org independently of the GitHub assets it signs
https://walletscrutiny.com/verifier/?pubkey=1f9e547c2f31942623b8ad1d07713282e8640fd8cf474e9f79f18ace8af216ed#verificationId=d7e409662c93455842f21e90f50e8f2757fbead0bb9568ce6afa2c220e0fbc15
1❤️1