Downloads
The node, the command line and the desktop wallet, for every platform a build exists for. One archive per platform, and it is the one that joins a network.
The release list could not be reached, so the version is not named above. Every button below still works: each one points at the releases page, which always resolves to the current release.
Desktop wallet#
A window around the same wallet interface zcd ui serves, built on the same
wallet/session — so it is structurally incapable of being more permissive than
the command line, rather than merely intended not to be. It holds keys;
the eight rules are worth reading before you move anything.
| Your machine | Zycord Wallet |
|---|---|
| LinuxDebian, Ubuntu — 64-bit | Download .deb |
| LinuxFedora, RHEL, openSUSE — 64-bit | Download .rpm |
| Windows64-bit Intel or AMD | Download |
| macOSApple Silicon and Intel | Install |
Every one of these carries the wallet and the zycordd node it runs, because a wallet with no node has nothing to sync, nothing to transact through and nothing to mine with. The node is the RandomX build, which is what mainnet and the public testnet accept. The Linux packages also add Zycord Wallet to the applications menu.
There is no Windows-on-ARM or Linux-on-ARM wallet.
On a server, from the terminal#
The installer script below ships from the next release onward. Until then, take the archive for your platform from the table above and unpack it by hand — Installation has the commands.
The installer script#
It downloads the right archive for the machine it is running on, verifies the checksum, and only then installs. Fetch it, read it, then run it:
curl -fsSLO https://zycord.com/releases/vX.Y.Z/install.sh
less install.sh
sh install.sh --version vX.Y.Z--version is required and there is no latest: a release you did not
name is a release you did not choose. The tag above is filled in from the newest release when this
page loads; if you are reading it with scripts off, take the tag from
the releases page.
On a Mac#
There is no macOS download, and that is not a build nobody got to. The wallet reaches the platform webview through cgo and the node carries the RandomX engine in C++; both need Apple's SDK, which exists only on a Mac. Nothing on the build machine can cross-compile them.
So the script below builds it on your machine, which buys one thing besides the
binary: a locally built application carries no quarantine attribute, so
Gatekeeper has nothing to refuse. A downloaded .app would be
refused, because signing it needs an Apple Developer ID and that certificate publishes
the developer's legal name — which this project does not have.
It needs the Xcode command line tools (xcode-select --install) and Go.
Fetch it, read it, then run it:
curl -fsSLO https://zycord.com/releases/vX.Y.Z/install-macos.sh
less install-macos.sh
sh install-macos.sh --version vX.Y.ZIt verifies the source against a signed checksum before compiling anything, builds
the wallet with the node inside it, and puts Zycord Wallet.app in
/Applications. A few minutes, most of it the compiler.
Verify before you run it#
Your operating system will warn you, and there is no code-signing certificate here by construction, not by budget: such a certificate is an authority attesting to a verified legal identity, and there is no version of one without a legal name in it. What stands in its place is a build anyone can reproduce.
| Checksums, the archives above | SHA256SUMS.randomx |
|---|---|
| Checksums, the Debian packages | SHA256SUMS.deb |
| Checksums, desktop wallet | SHA256SUMS.desktop |
| Checksums, the RPM package | SHA256SUMS.rpm |
| Checksums, the source tarball | SHA256SUMS.source |
| Release signing key | zycord-release-key.asc |
sha256sum --check --ignore-missing SHA256SUMS.randomx # shasum -a 256 on macOS--ignore-missing is not leniency. The file covers every archive the release
publishes and you downloaded one, so without the flag the ones you do not have are reported as
failures and the command exits non-zero on a perfectly good download.
The release ships zycord-release-key.asc, the project's public key, and it signs
the updater's manifest — but none of the checksum files. There is no
SHA256SUMS.randomx.asc, and none of them is clearsigned. So a checksum proves the
file arrived intact from this page and nothing more; it cannot tell you the page itself
is genuine. Until the checksums are signed too, the check that carries the weight is the
rebuild, below: it needs no signature and no trust in the publisher, because you produce
the bytes yourself and compare.
The fingerprint is published here so that a signature, whenever one appears, can be checked against something you read on a page you navigated to yourself rather than against whatever the release hands you:
E724 39CE DD85 11F9 D607 550B 87FD 60D5 EB4A 0B29The rest — where to get the key, why keys.openpgp.org serves a copy GnuPG
refuses, and how to rebuild a tag and compare hashes — is
Verifying a download.
Or build it yourself#
The stronger route, and the one the reproducible tier exists to make checkable: you build the tag you checked out rather than whatever a proxy served you.
git clone https://gitlab.com/zycord-group/zycord-node.git
cd zycord-node
make build-randomx # bin/zcd-randomx, bin/zycordd-randomx -- joins a network
make build # bin/zcd, bin/zycordd -- reproducible, devnet onlyThe Go toolchain is pinned to go1.26.2 and the build refuses to run under anything
else, because two Go releases compile one source into different machine code and a mismatch would
look exactly like tampering. Details under
Installation.