WAM Coin v0.1.9 -- x86_64-w64-mingw32

These binaries were cross-compiled on Linux by the
platform-build workflow.

They were then run against the live test chain on a Windows machine, which
synced from the genesis block over the real peer-to-peer protocol and
compared four blocks the Linux nodes have held since August: 0, 1, 5000 and
6000. Block 1 is where the 5% treasury rule is first enforced, so a binary
that disagrees about consensus disagrees there.

The chain was synced with the files in THIS archive, after stripping and
packaging, not with an earlier build of them.

The miner in the separate archive was cross-compiled the
same way. Linux cannot run it, so --self-test was run on a Windows machine
afterwards.

That check covers SHA-256, stratum byte order, the difficulty targets, and
RandomX against the two official test vectors. A miner whose RandomX
disagreed with the network would hash all day, find nothing, and report no
error at all, so it is the whole question.

That is what is being claimed, and all of it. What is NOT claimed:

  * no human had double-clicked these before the release that carries them
  * before v0.1.9 the packaging and the signature covered Linux and
    nothing else, so this path is newer and less worn than that one

YOUR ANTIVIRUS WILL PROBABLY OBJECT TO THE MINER, AND IT IS WRONG.

On 12 September, during testing, Windows Defender deleted wam-miner.exe
fourteen seconds after it started hashing and called it

    Trojan:Win32/Bearfoos.A!ml      (Severe)

!ml means a machine-learning guess. A program that opens a network
connection and then uses every core is behaving exactly like the
cryptojacking malware that infects people's computers without asking, and
no scanner can tell the two apart by behaviour -- the difference is that
you chose this one and it mines to your address only.

We have not paid for a publisher certificate, which is the only thing that
removes the warning, so we are telling you about it instead of letting it
surprise you. What to do:

  1. Check the file yourself. The SHA256 below and the signature on
     SHA256SUMS are proof that these are the bytes we built. An antivirus
     verdict is an opinion; a signature is evidence.
  2. If you want to run it, allow that one file by name in your antivirus
     -- not a whole folder, and never the whole machine.
  3. If you would rather not, do not. The node in the other archive is not
     a miner and is not usually flagged, and you can run a node without
     ever mining.

Anyone claiming to be us and asking you to switch your antivirus off
entirely is not us.

VERIFY BEFORE YOU RUN IT. The checksum file is signed with a key kept
offline, and the fingerprint is published in SECURITY.md in the source
repository and nowhere else:

  4BD4 A8D3 AFD4 3F5C BCB5  00E2 3798 462F E00A DBA4

  curl -LO .../SHA256SUMS
  curl -LO .../SHA256SUMS.asc
  curl -LO .../scripts/verify_release.sh
  curl -LO .../SIGNING-KEY.asc
  bash verify_release.sh .

A release without SHA256SUMS.asc beside it cannot be checked. Do not run it.
