WAM Coin v0.1.8 -- x86_64-w64-mingw32

These binaries were cross-compiled on Linux by the platform-build workflow
and then run against the live test chain on a Windows runner, which synced
from the genesis block over the real peer-to-peer protocol and compared four
blocks the Linux nodes have held since August: 0, 1, 5000 and 6000. Block 1
is where the 5% treasury rule is first enforced, so a binary that disagrees
about consensus disagrees there.

The miner in the separate archive was cross-compiled the same way and then
ran --self-test on a Windows machine, which checks SHA-256, stratum byte
order, the difficulty targets, and RandomX against the two official test
vectors. A miner whose RandomX disagreed with the network would hash all day,
find nothing, and report no error at all, so that check is the whole question.

That is what is being claimed, and all of it. What is NOT claimed:

  * no human had double-clicked these before the release that carries them
  * the packaging and the signature had never covered a second platform
    before v0.1.8, so this path is newer than the Linux one

YOUR ANTIVIRUS WILL PROBABLY OBJECT TO THE MINER, AND IT IS WRONG.

On 12 September, during testing, Windows Defender deleted wam-miner.exe
fourteen seconds after it started hashing and called it

    Trojan:Win32/Bearfoos.A!ml      (Severe)

!ml means a machine-learning guess. A program that opens a network
connection and then uses every core is behaving exactly like the
cryptojacking malware that infects people's computers without asking, and
no scanner can tell the two apart by behaviour -- the difference is that
you chose this one and it mines to your address only.

We have not paid for a publisher certificate, which is the only thing that
removes the warning, so we are telling you about it instead of letting it
surprise you. What to do:

  1. Check the file yourself. The SHA256 below and the signature on
     SHA256SUMS are proof that these are the bytes we built. An antivirus
     verdict is an opinion; a signature is evidence.
  2. If you want to run it, allow that one file by name in your antivirus
     -- not a whole folder, and never the whole machine.
  3. If you would rather not, do not. The node in the other archive is not
     a miner and is not usually flagged, and you can run a node without
     ever mining.

Anyone claiming to be us and asking you to switch your antivirus off
entirely is not us.

VERIFY BEFORE YOU RUN IT. The checksum file is signed with a key kept
offline, and the fingerprint is published in SECURITY.md in the source
repository and nowhere else:

  4BD4 A8D3 AFD4 3F5C BCB5  00E2 3798 462F E00A DBA4

  curl -LO .../SHA256SUMS
  curl -LO .../SHA256SUMS.asc
  curl -LO .../scripts/verify_release.sh
  curl -LO .../SIGNING-KEY.asc
  bash verify_release.sh .

A release without SHA256SUMS.asc beside it cannot be checked. Do not run it.
