SignerOS v1.2.0: Secure Boot, stricter PSBT checks, reproducible builds

A few weeks ago I posted here about my project to turn a regular PC into an air-gapped Bitcoin signing device.

I honestly didn't expect that the project to get this much attention in a short time. Thank you to everyone who tested it, gave feedback, opened issues, or simply took the time to discuss the idea.

I also received some Lightning and on-chain donations, which I really did not expect. Thank you for that as well. It was a nice surprise and gave me extra motivation to keep working on the project.

Since the last post, SignerOS has moved quite a bit further.

v1.2.0 is now released, with three things I consider especially important:

Secure Boot: you can now sign an already built image with your own key. There is also a shim-based option for machines that don't allow users to enroll their own Secure Boot keys.

Stricter PSBT checks: SignerOS now refuses some transactions that could previously only generate a warning, including non-SIGHASH_ALL transactions.

Reproducible builds: the published image can now be reproduced and independently verified.

There is still a lot to do. I want to keep the project small and simple rather than turning it into another full-featured wallet or operating system.

The main idea is still the same: use an ordinary PC as a temporary, stateless, air-gapped Bitcoin signing device.

Thanks again to everyone who showed interest in the project.

Project:

https://signeros.org/

https://github.com/signeros/signeros

I would especially appreciate feedback from people who have experience with hardware wallets, multisig, Secure Boot, or air-gapped signing.