SignerOS v1.2.0: Secure Boot, stricter PSBT checks, reproducible builds
A few weeks ago I posted here about my project to turn a regular PC into an air-gapped Bitcoin signing device.
I honestly didn't expect that the project to get this much attention in a short time. Thank you to everyone who tested it, gave feedback, opened issues, or simply took the time to discuss the idea.
I also received some Lightning and on-chain donations, which I really did not expect. Thank you for that as well. It was a nice surprise and gave me extra motivation to keep working on the project.
Since the last post, SignerOS has moved quite a bit further.
v1.2.0 is now released, with three things I consider especially important:
Secure Boot: you can now sign an already built image with your own key. There is also a shim-based option for machines that don't allow users to enroll their own Secure Boot keys.
Stricter PSBT checks: SignerOS now refuses some transactions that could previously only generate a warning, including non-SIGHASH_ALL transactions.
Reproducible builds: the published image can now be reproduced and independently verified.
There is still a lot to do. I want to keep the project small and simple rather than turning it into another full-featured wallet or operating system.
The main idea is still the same: use an ordinary PC as a temporary, stateless, air-gapped Bitcoin signing device.
Thanks again to everyone who showed interest in the project.
Project:
https://github.com/signeros/signeros
I would especially appreciate feedback from people who have experience with hardware wallets, multisig, Secure Boot, or air-gapped signing.
[link] [comments]