signeros — boot log

SIGNEROS▮

A USB stick that turns a computer you already own into an offline Bitcoin signing device. While it is running, that machine cannot go online and cannot see its own hard drives. Switch it off and everything you did is gone.

NEVER ONLINE LEAVES NO TRACE BOOTS FROM USB SIGNS PSBT FILES FREE & OPEN SOURCE
▼ Download the image Source on GitHub
SCROLL ▾
01The premise

The safest computer is the one that was never connected.

SignerOS starts from a USB stick and runs entirely in the computer's memory. It has no way to reach the internet, no way to touch the machine's hard drives, and nowhere to keep a history. The only place it can save anything is the stick you booted from, and the only things it saves there are files that are safe to share — a signed transaction, or the public keys your everyday wallet needs to watch your balance. Switch the power off and the session, your recovery words included, is gone.

See the signing ritual ↓
A-01

It cannot go online

There is nothing to switch off and nothing to remember to switch off. The ability to use a network was left out of this system entirely, so Wi-Fi, Ethernet and Bluetooth do not merely fail — they are not there. Plugging in a cable does nothing at all, and neither would a program that somehow got onto the stick and wanted to phone home.

NO WI-FINO ETHERNETNO BLUETOOTH
A-02

It leaves the computer alone

The whole system lives in memory and never installs itself. It cannot even see the hard drives of the machine you borrowed — your Windows or Linux installation is invisible to it, so it cannot be read, changed or infected. Nothing you do is written anywhere except, when you ask for it, one file on your own stick.

NOTHING INSTALLEDYOUR DISKS UNTOUCHED
A-03

One app, and no way out of it

The stick boots straight into the signer and there is nothing else on it: no desktop, no browser, no file manager, no command line, no way to install anything. Fewer moving parts means fewer places for something to hide — and a much smaller amount of code for anyone to check.

1 APPLICATIONNOTHING ELSE TO RUN
A-04

No trace afterwards

Any reasonably modern PC with a USB port becomes a signer for as long as it is switched on — an old laptop is ideal, and it does not need to be a good one. Take the stick out, start the machine normally, and it is as if SignerOS was never there.

USE ANY PCSTART IT, THEN FORGET IT
02The app

Three things. Create a wallet. Export keys. Sign.

There is one app on the stick and its first screen offers exactly those three choices. Below is a walkthrough of each one, screen by screen, with the same headings, buttons and warnings you will see on the machine. It is a redrawing rather than a photograph — but the words are the real ones, and so is everything else on it: the wallet shown is a famous test seed (abandon … about) that has been public for years and holds nothing, so every key and address here is genuine and anyone can check it.

▸ “CREATE A NEW WALLET”

READ THIS FIRST

This machine will generate a seed and show you the recovery words once. The words are never written to the USB stick, to this machine, or to anywhere else. There is no backup, no copy and no recovery service.

Anyone who reads those words owns everything the wallet will ever hold. Anyone who cannot read them — including you, if you lose the paper — has lost it permanently.

The only file that will be written is a watch-only one: the public keys your everyday wallet needs to see this wallet's balance and prepare payments for it. It cannot spend anything.

▸ HOW MANY WORDS

12 words15 words18 words21 words24 words

// Both lengths are far beyond anything anyone can guess — nobody has ever broken a properly generated 12-word seed. 24 is the convention for large, long-lived holdings; 12 is meaningfully easier to write down without making a mistake, and a copying error is a real risk where guessing is not.

BackI understand - continue

▸ “WHERE YOUR SEED COMES FROM”

// A wallet is exactly as safe as the randomness it was made from, so this screen does not rely on any single source of it. It mixes four together — including your own hand moving the mouse, which is the one source no software anywhere can watch. Only one of the four has to be unpredictable for the result to be safe, and if the machine cannot offer a source it trusts, it refuses to generate at all rather than asking you to decide.

▸ WHAT THE SCREEN REPORTS

this computer's own randomness ready · the processor's built-in generator available
Move the mouse around in here
(or tap, or just type - anything counts)

143 of 256 movements collected.

BackGenerate my seed

▸ “WRITE THESE 12 WORDS DOWN, IN ORDER”

01abandon
02abandon
03abandon
04abandon
05abandon
06abandon
07abandon
08abandon
09abandon
10abandon
11abandon
12about

// On paper, not on a phone and not in a photograph. This is the only copy that will ever exist — the machine keeps none, and neither does anybody else.

Discard and start overI have written them down

▸ “NOW TYPE EVERY WORD BACK”

01···
02···
03···
04···
05···
06···
07···
08aban_
09
10
11
12

word 8 of 12: aban_
7 of 12 words entered and correct so far.

// The words are hidden here on purpose: you are meant to be copying from your paper, and a readable screen would let you copy from that instead while believing you had checked the paper. A word that stops matching turns red straight away, while it is still in front of you, and you fix it where it stands — going back to word 3 costs you word 3 and nothing else. If your handwriting is genuinely ambiguous, Show the words again is always there and does not throw away what you have typed.

Show the words againClearOn-screen keys (F2)Continue

▸ “ADD A PASSPHRASE? (OPTIONAL)”

// A passphrase is a 25th word of your own choosing. The same recovery words with a different passphrase are a completely different wallet, with different addresses and a different balance. It protects you against someone who finds your written words — and destroys the wallet if you forget it, with no way to recover or reset it. Leave it empty if you are not certain you want one; most wallets have none.

▸ PASSPHRASE — SHOWN ON SCREEN, TYPED TWICE

correct horse battery staple
(28 characters)
correct horse battery staple
both entries match

// It is shown rather than hidden behind dots because the machine treats every keyboard as a US one. On a Turkish-Q or a German layout the punctuation keys land somewhere else, so what gets typed is not what is printed on your keys — and nothing, anywhere, will ever tell you afterwards. Seeing the characters catches that; typing it a second time catches an ordinary slip, which no amount of looking will.

BackOn-screen keys (F2)Continue

▸ “WHAT WILL BE WRITTEN TO THE USB STICK”

# SignerOS watch-only export # # PUBLIC KEYS ONLY. Everything in this file can watch this wallet and # build transactions for it. Nothing in it can spend: there is no # private key, no seed and no mnemonic here, and this device never # wrote one anywhere. # # master fingerprint 73c5da0a # network mainnet # account 0 # BIP39 passphrase yes - this export belongs to the passphrase you entered. # # =========================================================== # BIP84 - Native SegWit (P2WPKH) (addresses start bc1q) # derivation m/84'/0'/0' # account xpub xpub6CatWdiZiodmUeTDp8LT5or8nmbKNcuyvz7WyksVFkKB4RHwCD3XyuvPEbvqAQY3rAPshWcMLoP2fMFMKHPJ4ZeZXYVUhLv1VMrjPC7PW6V # first address bc1qcr8te4kr609gcawutmrza0j4xv80jy8z306fyu # =========================================================== # receive and change in one line: wpkh([73c5da0a/84h/0h/0h]xpub6CatWdiZiodmUeTDp8LT5or8nmbKNcuyvz7WyksVFkKB4RHwCD3XyuvPEbvqAQY3rAPshWcMLoP2fMFMKHPJ4ZeZXYVUhLv1VMrjPC7PW6V/<0;1>/*)#qf45pmyh # the same keys as two lines, for wallets that want the chains # separately (Blockstream Green): receive first, then change. wpkh([73c5da0a/84h/0h/0h]xpub6Cat…C7PW6V/0/*)#afwvtk2s wpkh([73c5da0a/84h/0h/0h]xpub6Cat…C7PW6V/1/*)#vatdkr6g # ( the same three lines follow for BIP86 taproot, BIP49 nested # segwit and BIP44 legacy ) # end of export

// This is the whole of what leaves the machine, and there is nothing in it that can spend. It covers all four address styles a wallet might use, and prints the keys in both of the shapes wallets ask for, so you copy the one line your wallet wants — Sparrow takes the first, Blockstream Green wants the pair underneath it. The file also shows you the first address of each style, which is what you check against your wallet after importing.

BackWrite the watch-only file

▸ NAME THE FILE

FILE NAME
signeros-73c5da0a-20260815-164210.descriptors.txt

written to the USB stick
type to change the name · Enter accepts it

// Every file this machine writes, you name. The dated name is only the suggestion, so pressing Enter is still the whole interaction — and if a file of that name is already on the stick you are told, rather than having the old one quietly replaced.

BackOn-screen keys (F2)ClearSave
WRITTEN

The file is on your USB stick. The recovery words have been erased from the machine's memory — your paper is now the only copy in existence.

// Use Secure shutdown and wait for the machine to switch itself off before pulling the stick out. That is what makes sure the file is really written, and what wipes the leftovers of your key out of the memory.

Back to the startSecure shutdown

▸ “TYPE YOUR RECOVERY WORDS” — HOW MANY WORDS

1215182124

▸ THE SAME GRID, SHOWN IN CLEAR

01abandon
02abandon
03abandon
04abandon
05abandon
06abandon
07abandan
08abandon
09abandon
10abandon
11abandon
12abou_

// Here your paper is the source, so the words stay readable — Hide covers them if you are not alone in the room. Recovery words come from a fixed list of 2048, and anything you type that is not on that list is outlined in red the moment you type it, so a slip is caught on the spot instead of at the end.

▸ PASSPHRASE — A CLICK OR F3 MOVES THE TYPING HERE

empty — the wallet is the words alone
BackHideClearOn-screen keys (F2)Derive the keys

▸ REVIEW — BEFORE ANY FILE EXISTS

MASTER FINGERPRINT73c5da0a
ACCOUNT0
0123456789

▸ THE FIRST ADDRESS OF EACH ADDRESS STYLE

Native SegWit — the usual onebc1qcr8te4kr609gcawutmrza0j4xv80jy8z306fyu
Taprootbc1p5cyxnuxmeuwuvkwfem96lqzszd02n6xdcjrs20cac6yqjjwudpxqkedrcr
Nested SegWit37VucYSaXLCAsxYyAPfbSi9eh4iEcbShgf
Legacy1LqBGSKuX5yYUonjxT5qGfpUsXKYYWeabA

// This page is the whole point of this flow, and it appears before any file is written. A mistyped word gets caught by the machine itself, twice over. A mistyped passphrase never does — any passphrase is a valid one, so the wrong one quietly gives you a different, perfectly normal, empty wallet. So compare what is on this screen against the wallet you already have. If the fingerprint and the first address match, you typed everything correctly. If they do not, nothing has been written and you can simply go back.

// The numbered buttons are there for the same reason. Most people want the first one; if your existing wallet is a later one, step through until the address matches.

BackWrite the watch-only file

▸ NAME THE FILE

FILE NAME
signeros-73c5da0a-20260815-171304.descriptors.txt

written to the USB stick · type to change the name · Enter accepts it

BackSave
WRITTEN

Exactly the same file creating a wallet would have produced — where the words came from makes no difference to it. Your words, and the key worked out from them, were erased from the machine on the way out of this screen.

Back to the startSecure shutdown

▸ “CHOOSE A TRANSACTION TO REVIEW”

unsigned.psbt429 B
payment-to-alice.psbt1.2 kB

// These are the transaction files you copied onto the stick, and they are all the machine looks at — it does not open anything else on it, and nothing on the stick can be run as a program no matter what it claims to be. You can plug the stick in after starting up; it appears here within a second or two.

BackRefreshReview transaction

▸ “REVIEW BEFORE SIGNING” — SUMMARY

fileunsigned.psbt
networkmainnet
txid (unsigned)bf9595421accc7d958e4f5b2ff99e67386a965d301645f5d2533c1b34e64172e
spending0.00240000 BTC (240 000 sat)
to outputs0.00238000 BTC (238 000 sat)
leaving younot yet known - change is identified once you enter your key
miner fee0.00002000 BTC (2 000 sat)
fee rate9.6 sat/vB (approx. 209 vbytes signed)

// Every recipient is listed underneath with its full address and amount. Read them the way you would read a receipt: this machine can tell you exactly what the transaction does, but it cannot know which address you meant — check that against something you trust.

// Notice what is not claimed yet. Until you enter your key, the machine has no way to know which of these addresses is your own change, so it says so rather than guessing. Money that looks like it is going to a stranger and money coming back to you are worth being sure about.

// If the file does not contain enough information to work out the fee, SignerOS refuses to sign it and tells you what to ask your wallet for. It will not estimate, and there is no way to override it — a transaction whose fee you cannot see is one that can quietly pay your balance to a miner.

BackPage upPage downSign this transaction

▸ “ENTER YOUR KEY TO SIGN”

BIP39 mnemonicExtended private key

▸ BOTH FIELDS ON SCREEN — A CLICK OR F3 MOVES THE TYPING

RECOVERY WORDS ◂ typing here
··· ··· ··· ··· ··· ··· ··· ··· ··· ··· ··· abou_
BIP39 PASSPHRASE
empty

// Your words go straight into a protected area of memory that is erased the moment it is finished with, and they are never held anywhere else — not in a file, not in a log, not in a temporary copy. Both fields are visible at once on purpose: a passphrase hidden behind a button is a passphrase people forget they had.

BackOn-screen keys (F2)Check keyReview and sign

▸ “CONFIRM WHAT YOU ARE ABOUT TO SIGN” — THE LAST SCREEN

master fingerprint73c5da0a
signs2 of 2 inputs

▸ WHERE THE MONEY GOES

bc1q64e0lhyc7sg7tvx8ctarm72xr5txvhvtmgaycz0.00200000 BTC
bc1q8c6fshw2dlwun7ekn9qwf37cu2rn755upcp6el
checked — this one comes back to you0.00038000 BTC
miner fee0.00002000 BTC (2 000 sat)
leaving you0.00202000 BTC

// The transaction file gets to claim which address is your own change. Believing that claim would mean whoever handed you the file also decides which address this screen paints green as "coming back to you" — and you would then approve the loss yourself, having read the screen correctly. So the machine works the address out from your key instead and only calls it change when the two agree exactly. If a file claims your change on an address your key does not produce, signing is blocked. Not warned about — blocked.

BackSign now

▸ IT SIGNS, ERASES YOUR KEY, THEN ASKS WHAT TO CALL THE FILE

FILE NAME
signed_20260815-171820.psbt

written to the USB stick

// Your key is already gone by the time this page appears, so nothing secret is sitting around while you pick a name — and if the write fails, you can just try again from here. The file you brought in is never altered; the signature is written alongside it as a new file.

BackSave
SIGNED

The signed file is on the stick, next to the one you brought in. Carry it back to your everyday machine and broadcast it from there. It is the same transaction you just approved — signing changed nothing about it except adding your signature.

// Shut down and wait for the machine to switch off before pulling the stick out.

Sign anotherSecure shutdown
1 / 8

◆ These are redrawings of the real screens, not photographs and not a working app — nothing on this web page can generate a key or sign anything. The wallet is a well-known public test seed that holds no money, and the transaction is the one shipped with the project for testing, so every address and amount above is a genuine value rather than a made-up one.

03The signing ritual

One file crosses the gap — nothing else does.

Your everyday machine prepares the transaction; the offline machine approves it. The only thing that travels between them is a file on a USB stick — the SignerOS stick itself does fine. There is no camera and no QR scanning here, and nothing that crosses ever contains a secret.

01

Compose

In your everyday wallet, build the payment as usual and save it as an unsigned transaction file instead of sending it.

ONLINE PC
02

Carry

Copy that file onto the stick. Any name will do as long as it ends in .psbt. Nothing on this stick is secret at any point.

USB COURIER
03

Start up

Start the offline computer from the stick. The app lists the transaction files it finds and you pick the one to look at.

SIGNEROS
04

Review

Who gets paid, how much, and what the fee is — all worked out from the file itself rather than taken on trust. Read it like a receipt.

SIGNEROS
05

Sign

Type your recovery words. The machine shows you one last summary in plain terms — what is really leaving your wallet, what is coming back — you confirm, and it signs. Your key is erased immediately afterwards.

SIGNEROS
06

Shut down

The signed file is saved next to the original, which is left untouched. Use Secure shutdown and wait for the machine to switch off before pulling the stick out.

SIGNEROS
07

Broadcast

Take the stick back to your everyday machine and send the signed transaction from there. Done — nothing secret ever left the offline machine.

ONLINE PC
04Two ways to use it

Your only key, or one of several.

SignerOS can hold the single key to a wallet — or be one signature of several, alongside a hardware wallet you already own. The same stick does both: it hands your everyday wallet the public keys it needs, and signs whatever that wallet passes back. The third tab is the multisig case done concretely rather than described: two SignerOS seeds into one 2-of-2 in Sparrow, a payment signed twice, and broadcast.

ONLINE PC

Your everyday wallet, set up from the public keys SignerOS exported. It can watch your balance and prepare payments — but it cannot send one.

unsigned──▶◀──signedUSB STICK
SIGNEROS PC

Your personal computer, booted from the SignerOS USB. Reviews and signs. Never online — it has no way to be.

One key, kept offline. Only the offline machine can approve a payment, and only while it is switched on. Everything else stays an ordinary, everyday computer.

YOUR EVERYDAY WALLET · ONLINE PC

Software like Sparrow puts the three devices' public keys together into one wallet, prepares the payment, and collects signatures until it has enough.

SIGNEROS · PC A

Key #1. A personal computer booted from the SignerOS stick.

SIGNEROS · PC B

Key #2. A second, separate personal computer — ideally kept in another place.

HARDWARE WALLET

Key #3. Any hardware wallet that can sign transaction files completes the trio.

Any two of the three. Two signatures approve a payment, so one lost key is survivable and one stolen key is useless on its own. One thing to know: with a setup like this, your recovery words alone are not enough to get your money back — you also need the file that describes the wallet, including the other two devices' public keys. Back that file up somewhere alongside your words. It cannot spend anything, so keeping copies of it is safe.

The smallest multisig there is, done once from end to end: two SignerOS wallets joined into one 2-of-2 in Sparrow, a payment signed on one machine and then on the other, and broadcast from the everyday one. Every step below is either a menu in Sparrow or a screen on the stick — nothing else is involved, and nothing secret moves between them.

▲ 2-of-2 needs both keys for every payment, so it survives neither a lost key nor a forgotten passphrase. It is the clearest one to learn the mechanics on, and it is a fine arrangement for a joint account where both parties must agree. For savings you keep alone, build the 2-of-3 in the previous tab instead — same steps, one more key, and one of them may be lost.

01
SIGNEROS · TWICE

Create the wallet twice

Run Create a new wallet once on each of the two machines — or twice on the same one, in two separate sessions, if you are only trying this out. Each run gives you a set of recovery words to write on paper and one watch-only file on the stick. That is two sets of words and two files, and from here on everything depends on knowing which is which.

Name them apart as you save them — signer-a.descriptors.txt and signer-b.descriptors.txt will do. Each file's header carries a master fingerprint, eight characters that identify that seed and nothing else; Sparrow will show you the same eight later, which is how you check you pasted what you meant to.

02
ONLINE PC · A TEXT EDITOR

Find the one line that matters

Almost all of the export describes single-signature wallets, and none of that is what a multisig wants. Scroll past it, to the block at the very end headed MULTISIG COSIGNER KEYS (BIP48), and inside that to BIP48/2h — Native SegWit multisig (P2WSH). The line you want is the one that is not commented out: fingerprint, derivation path and public key in a single string.

# =========================================================== # MULTISIG COSIGNER KEYS (BIP48) # … # =========================================================== # BIP48/2h - Native SegWit multisig (P2WSH) # derivation m/48'/0'/0'/2' # account xpub xpub6E… # =========================================================== # the same key with its origin, which is what a coordinator # asks for - fingerprint, path and key in one line: [73c5da0a/48h/0h/0h/2h]xpub6E8dqk4M8LZ5X…J9tqRw

Take the 2h block and not the 1h one underneath it: 2h is native SegWit, which is what you are about to build, and 1h is the older nested form — take that one only if some wallet explicitly asks for it. Copy the same line out of the second file. Two lines, one per seed, is the whole of what Sparrow needs; the rest of both files can be ignored for this.

Nothing here can spend. These are public keys, and they are meant to be handed to the wallet that coordinates the multisig — which is exactly what the next step does.

03
ONLINE PC · SPARROW

Start an empty 2-of-2

▸ File → New Wallet → name it, e.g. joint-2of2

In the wallet's settings, set Policy Type to Multi Signature and Script Type to Native Segwit (P2WSH) — that is the same script type as the 2h block you just copied, and the two have to agree. Then set the threshold to 2 of 2.

Sparrow now shows one Keystore tab per cosigner: two of them, both empty.

04
ONLINE PC · SPARROW

One line into each keystore

▸ Keystore 1 → xPub / Watch Only → paste the line from file A
▸ Keystore 2 → xPub / Watch Only → paste the line from file B

Paste the whole line, brackets included. Sparrow reads the bracketed part and fills in the master fingerprint and the derivation path by itself. If your version leaves those two boxes empty, fill them from the same line by hand: the eight characters before the first slash are the fingerprint, and what follows is the path — m/48'/0'/0'/2'.

Check the fingerprint against the file it came from, both times. It is printed in the export's header and it is the one thing that tells you the key in front of you belongs to the seed you think it does. Give the keystores names you will recognise later — the machine, the room, whatever distinguishes them — because at signing time you need to know which words go with which.

Then Apply. Which key you put in which tab makes no difference: Sparrow's multisig wallets sort the keys before building addresses, so both orders produce the same wallet.

05
ONLINE PC · SPARROW

Back the wallet file up before it holds anything

▸ File → Export Wallet (keep the output with your two sets of words)

This is the step people skip and regret. In a multisig your recovery words are not enough to get the money back: you also need to know the other key, the threshold and the script type — which is precisely what this exported file records. It contains no private key and cannot spend, so keeping several copies of it is safe and losing all of them is not.

Do it now, while the wallet is empty and losing it would cost you nothing but the setup.

06
ONLINE PC · SPARROW

Receive, then build a payment and save it unsigned

Send a small amount to an address from the wallet's Receive tab and let it confirm. (Sparrow needs its connection to a node or an Electrum server for this, and again to broadcast at the end — the online half of this arrangement is entirely ordinary.)

▸ Send → address, amount, fee → Create Transaction → Finalize Transaction for Signing
▸ File → Save Transaction… → payment.psbt, onto the USB stick

Sparrow will report 0 of 2 signatures. That unsigned file is what crosses the gap, and there is nothing secret in it.

07
SIGNEROS · MACHINE A

The first signature

Boot machine A from its stick, pick payment.psbt from the list, and read the review: who is being paid, how much, and the fee. Change is recognised here as it is in a single-signature wallet, because Sparrow puts the multisig script into the file and the machine re-derives the address from it rather than believing the label.

Type the first set of recovery words — and the passphrase, if that seed has one — confirm the summary, and sign. Name the result something that says what it is: payment-a.psbt. Then Secure shutdown, and take the stick out once the machine is off.

One signature of the two now exists. The original file is untouched next to the new one.

08
SIGNEROS · MACHINE B

The second signature goes on the first one's output

▲ Carry payment-a.psbt to the second machine — the file the first signing produced, not the original. Signing the original again would give you two separate files with one signature each, and neither of them can be broadcast.

Boot machine B, open payment-a.psbt, review it exactly as before, and type the second set of words. The first signature is carried through untouched and the second is added beside it. Save as payment-ab.psbt.

With the pair complete, SignerOS also writes a .tx file next to it — the finished transaction, ready to broadcast by any means at all. You do not need it if you are going back through Sparrow, and it is there for the case where you would rather not.

09
ONLINE PC · SPARROW

Broadcast

▸ File → Open Transaction… → payment-ab.psbt

Sparrow reports 2 of 2 and offers Broadcast Transaction. Press it and the payment goes out. Both seeds approved it, neither one ever left the machine it was typed on, and every file that crossed the gap between them was public.

What you now have. Two sets of words, on paper, in two places — and one wallet file that describes how they fit together. All three are needed to recover, and none of them alone can spend a thing. Do the whole of the above on testnet or with an amount you would shrug at first: the point of a rehearsal is to find out which of the nine steps you misread, while it costs nothing.

05Get the image

Download it to start. Rebuild it to trust it.

There is a ready-made image, and it is the sensible way to try SignerOS this afternoon. But a file somebody else prepared is a signer you are trusting them with — and the checksum next to it was published by the same people as the file, so on its own it only proves the download did not get corrupted. Building it yourself is what settles the question: the build is designed so that everyone who compiles the same version gets a byte-for-byte identical result, which means you can check it against what we published. Download it today; build it before the wallet matters.

LATEST RELEASE

signeros-1.0.1-x86_64.img

1.0.1 <2026-09-17> 385 MiB WRITTEN ANY MODERN PC MIT
▼ Download the image

Also: every version and its release notes · the source code, which anybody is free to read.

What you get is a ready-made image of a complete USB stick — the startup files and the area your transaction files will live in are already in it. You do not format anything and you do not choose any settings; you write the image and the stick is done.

▲ The image we publish is not signed for Secure Boot, because that signature would have to be made with a key held by someone other than you. It boots with Secure Boot switched off. If you would rather leave Secure Boot switched on, build the image yourself with a key of your own — section 07 walks through it.

Check what you downloaded

The quick check: that the file arrived intact and is the one that was published. Run one command and compare the result with this, character by character.

6456296ba0ea0a4e9a70ca4b560a6be9c73ae1c5856df5f92e1781edef72ba34

LINUX / MACOS

$ sha256sum signeros-1.0.1-x86_64.img

WINDOWS (POWERSHELL)

> Get-FileHash signeros-1.0.1-x86_64.img -Algorithm SHA256

✕ Not the same? Delete the file and download it again. Never start a computer from an image you could not confirm.

Then be clear about what that proves: the file matches the number on this page. It does not prove the number itself is honest, because we published both. Only building it yourself settles that — which is the next step, and it is the one that makes this signer genuinely yours.

Rebuild it, and compare the payload

You need a Linux computer and some patience: everything is compiled from scratch, so the first run takes 30-90 minutes and later ones take minutes. You do not need the file you downloaded — this is the same source the released image was made from.

$ git clone https://github.com/signeros/signeros signeros && cd signeros
$ git checkout 1.0.1
$ ./scripts/build.sh

THE NUMBER THAT MATTERS

Check the file called bzImage rather than the disk image. That single file is the whole of what the machine actually runs, so agreeing on it is agreeing on everything. The disk image is deliberately not comparable: it carries a signature that differs for every person who builds it, so two honest builds of it never match anyway.

$ sha256sum output/images/bzImage

That number is published with every release, and two people on two different computers should get the same one. If yours comes out different, say so publicly — that is the check doing its job.

AND WATCH IT PROVE ITSELF

The first starts the real image in a simulated computer and puts it through the whole job: read a transaction, show it, sign it, save it — and refuse a transaction that lies about which address belongs to you. The second is the quick one, and it re-checks every signature with a second, completely separate implementation written from scratch for the purpose. Asking a program to confirm its own work proves nothing; two independent programs agreeing is evidence.

$ ./scripts/test_in_qemu.sh
$ ./scripts/host_selftest.sh --build-wally

✕ This kind of check lets you find out that something was tampered with, by comparing with other people. It cannot prevent it. That is exactly why the comparison is worth actually doing rather than assuming.

06Write the USB

Write it to a stick — five minutes, either OS.

The image is a picture of a finished stick, not a file you copy onto one. Everything is already inside it, so you do not format anything and you do not pick any settings — you write the image over the whole stick and it is ready. Unpack the download first if it arrived compressed.

◆ANY USB STICK OF 1 GB OR MORE ◆WRITTEN WHOLE, NOT COPIED AS A FILE ◆TAKES ABOUT FIVE MINUTES ◆THE STICK IS COMPLETELY ERASED

Linux → the project's own script

If you have the source — because you built the image, or just downloaded the source — the script that writes the stick comes with it. It reads the make and size of the drive back to you and asks you to confirm before touching it, then writes the image and reads it back to check the stick is correct.

$ sudo ./scripts/flash_usb.sh /dev/sdX --expand-data

It writes output/images/signeros.img by default. For an image you downloaded instead, point it at the file:

$ sudo IMAGE=~/Downloads/signeros-1.0.1-x86_64.img ./scripts/flash_usb.sh /dev/sdX --expand-data

--expand-data gives the rest of the stick over to your transaction files afterwards, which is what you want on anything bigger than the image itself.

◆ NO SOURCE CODE, OR PREFER TO CLICK?

balenaEtcher needs nothing but the image file: choose it, choose the USB device, press Flash. It handles this kind of image correctly and refuses to write over your computer's own disk — you just do not get the read-back check, or the leftover space handed to your files.

Windows → Rufus or Etcher

Download the image, or build it on Linux (or in WSL) and copy output/images/signeros.img across. Back up anything on the stick first; it will be wiped.

  1. Download Rufus from rufus.ie — a single free file, nothing to install.
  2. Insert your USB stick and start Rufus. Under Device, pick that stick — and read the model and size twice.
  3. Click SELECT and choose signeros.img.
  4. Rufus recognises this kind of image and switches to DD Image mode by itself. Leave it there, and ignore the partition-scheme and file-system boxes — they do not apply, because the image already contains everything.
  5. Press START, accept the “all data will be destroyed” warning, and wait for the green READY.
  6. Click CLOSE, then eject the stick safely. It is now a SignerOS drive.

◆ ALLERGY TO TECHNICAL DETAILS?

Use balenaEtcher instead: pick the image → pick the USB → press Flash. Three clicks, works on Windows and Linux, no settings to think about.

// Afterwards the stick shows up with a drive named PSBT_DATA on Windows, macOS and Linux alike. That is where your transaction files go — loose on it, not inside a folder. Whatever you do, do not reformat the stick “to fix it”: the part you would be erasing is the part that starts the computer.

07Secure Boot

Sign the payload with your own key — or open the latch.

Secure Boot is a setting in your computer's start-up menu that lets it run only software carrying a signature it has been told to trust. Out of the factory it trusts Microsoft and nobody else, and SignerOS is not signed by Microsoft — so you have two honest choices, and the first is better than it sounds.

RECOMMENDED Sign it, enrol it, leave Secure Boot on

  1. Make yourself a signing key — one command, once ever — then build the image. It comes out signed by you, and the build checks the signature before it finishes.
  2. Copy the small certificate file that came with your key onto the stick, so your computer's start-up menu can find it.
  3. Go into that menu and look for Secure Boot Key Management, usually under Security or Advanced. Switch it from Factory Default to Custom.
  4. Choose db — the list of things the machine is willing to run — then Enroll key from file, and pick your certificate. The screen shows you a long number; check it matches the one the key-making command printed.
  5. Save & Exit, then start the stick with Secure Boot still switched on.

// Now the machine runs your signer because you vouched for it, and it still refuses everything else. If you are a Linux user reaching for mokutil — that tool manages a different list and will not work here. It has to be done from the start-up menu.

OR Build unsigned, turn Secure Boot off

  1. Use the image as it comes. It works perfectly — a machine with Secure Boot switched on simply refuses to start it, usually saying the device has been blocked by the current security policy.
  2. Restart and press the setup key repeatedly as the screen lights up (table below).
  3. Set Secure Boot → Disabled, Save & Exit, and start the stick.
  4. When you are finished, go back in and switch it on again — for your everyday system's sake, not for SignerOS.

THE SETUP KEY, BY MAKE

DellF2 / F12
LenovoF1 / F2 (or Fn+F2)
HPF10 / Esc
ASUSF2 / Del
AcerF2
MSIDel

// On HP machines, permission to start from a USB stick is a separate setting from Secure Boot, and both have to allow it. And SignerOS needs a computer made in roughly the last decade — very old machines start up in a way it does not support.

⚠

Add your key. Never clear the existing ones.

That same menu usually offers Clear All Secure Boot Keys right next to Enroll, and it does exactly what it says: it throws away the trust your own Windows or Linux installation depends on, and the machine stops starting up normally. Add yours to the list; do not replace the list. If you do press the wrong thing, Restore Factory Keys is in the same menu and undoes it — nothing here can permanently break a computer.

Some machines will not let you do this at all — a few hide the key menu until you set a password on the start-up settings, and a few only accept certificates in a form this project does not produce. On those, switching Secure Boot off is the answer. And it is worth knowing what the signature is actually for: it is what stops somebody who gets hold of your stick from quietly replacing what it starts up. Without it, that swap would go unnoticed — so either way, keep the stick somewhere you control.

08Questions

Asked, answered.

Does SignerOS ever touch the internet?
It cannot, and that is stronger than "it does not". The ability to use a network is not switched off in this system — it was left out of it. There is no Wi-Fi, no Ethernet, no Bluetooth, and no program on the stick that could use them if they existed. Plugging in a cable does nothing. This is also not a promise anyone has to take on trust: the project refuses to produce an image at all if that ever stops being true, and it is tested again on the finished system before release.
Can anything persist after I power off?
Nothing except the file you asked it to save. Everything runs in the computer's memory, and the machine's own hard drives are invisible to it, so it could not write to them even if something on it tried. The only place it can save anything is your stick, and the only things it saves there are files that are safe to share: a signed transaction, or the public keys your everyday wallet needs. Your recovery words are never written anywhere at all — not to the stick, not to a log, not to a temporary file. That last one is checked automatically before every release rather than being a promise on a web page.
Which wallets work with it?
Any wallet that can watch a balance from public keys and can save a payment to a file instead of sending it. Sparrow and Bitcoin Core are the usual choices; Blockstream Green works too, and the exported file is deliberately written so that all three can use it directly — you copy the one line your wallet asks for. Everything travels as files on the stick: there is no camera and no QR scanning here.
Where do I type my recovery words?
Only on the SignerOS screen, on a machine that has no way to reach anywhere. As you type, the words go into a protected area of memory that is erased as soon as it is finished with, and nowhere else. If what you hold is a private key from a wallet rather than a set of words, that works here too.
Can I use a passphrase — the “25th word”?
Yes, everywhere you can type recovery words — and it is shown on screen and asked for twice. That is on purpose. Any passphrase is a valid passphrase, so a wrong one does not produce an error: it quietly gives you a different, empty wallet, and nothing anywhere will tell you why your money is missing. The machine also treats every keyboard as a US one, so on a Turkish or German layout the punctuation is not where your keys say it is — seeing the characters is what catches that. Leaving it empty is perfectly normal; most wallets have none.
What will it refuse to sign?
Two things above all. First, a transaction file that does not contain enough information for the machine to work out the fee: leave a piece out and a transaction can look like it pays a trivial fee while actually handing most of your balance to a miner. SignerOS says exactly what is missing and what to ask your wallet for, and there is no way to override it. Second, a file that claims one of the payments is your own change when your key says otherwise. Working that out from your key rather than believing the file is the difference between showing you a real receipt and showing you one written by whoever sent you the file. A deliberately forged example of that attack is part of the project's own tests, and a version that signed it could not be released.
What hardware do I need?
An ordinary PC or laptop that can start from a USB stick — an old one is ideal, and it does not need to be fast or in good shape, since nothing is installed on it. Roughly anything made in the last decade will do; very old machines start up in a way this does not support. Plus a USB stick of 1 GB or more, which you do not need to format. A keyboard is expected, and a mouse, trackpad or touchscreen all work.
Should I download the release or build it myself?
Download it to try it — that is what it is published for, and an afternoon spent watching the thing work is not wasted. Build it before you trust a wallet to it. The two are not rivals: everyone who builds the same version gets an identical result, so building it and finding the same number we published is what turns "their file" into "the file I checked myself". It also gets you the one thing a published image cannot have — a signature made with a key you hold instead of one somebody else does. And if your number ever comes out different from ours, say so publicly. That is the whole point of doing it this way.
Is it free?
Yes, and it always will be. SignerOS is open source under the MIT license: anyone may read it, build it, change it or check it, and there is nothing to buy, register or subscribe to. Donations keep the kettle on, nothing more.