fix(setup): skip sudo apt when the Windows toolchain is already installed

setup.sh --win ran `sudo apt-get install` (and update-alternatives)
unconditionally, forcing the whole run under sudo even when mingw-w64 was
already present. Running setup as root makes the daemon cross-compile run as
root, leaving root-owned artifacts under external/dragonx that break `make
clean` on a later non-sudo build (stale objects relink -> mingw link failure
recurs). Gate the apt/update-alternatives block behind a presence check so
`./setup.sh --win` runs sudo-free (and the daemon build as the invoking user)
when the toolchain is already installed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitignore

@@ -11,8 +11,8 @@ prebuilt-binaries/dragonxd-win/*
 !prebuilt-binaries/dragonxd-win/.gitkeep
 prebuilt-binaries/dragonxd-mac/*
 !prebuilt-binaries/dragonxd-mac/.gitkeep
-prebuilt-binaries/xmrig-hac/*
+prebuilt-binaries/drg-xmrig/*
-!prebuilt-binaries/xmrig-hac/.gitkeep
+!prebuilt-binaries/drg-xmrig/.gitkeep
 
 
 # External sources / toolchains (created by scripts/setup.sh)
@@ -33,7 +33,7 @@ imgui.ini
 *.bak*
 *.params
 asmap.dat
-/external/xmrig-hac
+/external/drg-xmrig
 /memory
 /todo.md
 /.github/

README.md

@@ -81,8 +81,8 @@ Download linux and windows binaries of latest releases and place in binary direc
 - prebuilt-binaries/dragonxd-win/
 - prebuilt-binaries/dragonxd-mac/
 
-**xmrig HAC fork** (https://git.dragonx.is/dragonx/xmrig-hac):
+**DRG-XMRig fork** (https://git.dragonx.is/DragonX/drg-xmrig):
-- prebuilt-binaries/xmrig-hac/
+- prebuilt-binaries/drg-xmrig/
 
 
 ## Build Steps

build.sh

@@ -386,7 +386,7 @@ build_release_linux() {
         [[ -f bin/sapling-output.params ]]   && cp bin/sapling-output.params "$dist_dir/"
     fi
     # Bundle xmrig for mining support
-    local XMRIG_LINUX="$SCRIPT_DIR/prebuilt-binaries/xmrig-hac/xmrig"
+    local XMRIG_LINUX="$SCRIPT_DIR/prebuilt-binaries/drg-xmrig/xmrig"
     [[ -f "$XMRIG_LINUX" ]] && { cp "$XMRIG_LINUX" "$dist_dir/"; chmod +x "$dist_dir/xmrig"; info "Bundled xmrig"; } || warn "xmrig not found — mining unavailable in zip"
     cp -r bin/res "$dist_dir/" 2>/dev/null || true
 
@@ -419,7 +419,7 @@ build_release_linux() {
         [[ -f bin/sapling-output.params ]] && cp bin/sapling-output.params "$APPDIR/usr/bin/"
     fi
     # Bundle xmrig for mining support
-    local XMRIG_LINUX_AI="$SCRIPT_DIR/prebuilt-binaries/xmrig-hac/xmrig"
+    local XMRIG_LINUX_AI="$SCRIPT_DIR/prebuilt-binaries/drg-xmrig/xmrig"
     [[ -f "$XMRIG_LINUX_AI" ]] && { cp "$XMRIG_LINUX_AI" "$APPDIR/usr/bin/"; chmod +x "$APPDIR/usr/bin/xmrig"; }
 
     # Desktop entry
@@ -638,8 +638,8 @@ HDR
             info "Lite mode: skipping embedded daemon binaries"
         fi
 
-        # ── xmrig binary (from prebuilt-binaries/xmrig-hac/) ────────────────
+        # ── xmrig binary (from prebuilt-binaries/drg-xmrig/) ────────────────
-        local XMRIG_DIR="$SCRIPT_DIR/prebuilt-binaries/xmrig-hac"
+        local XMRIG_DIR="$SCRIPT_DIR/prebuilt-binaries/drg-xmrig"
         # The published DRG-XMRig archives ship the binary inside a versioned subdir, not as a flat
         # xmrig.exe. Extract it from the matching win-x64 zip if it isn't already staged — otherwise
         # the embed below never fires (HAS_EMBEDDED_XMRIG stays undefined) and the wallet ships with
@@ -791,7 +791,7 @@ HDR
     fi
 
     # Bundle xmrig for mining support
-    local XMRIG_WIN="$SCRIPT_DIR/prebuilt-binaries/xmrig-hac/xmrig.exe"
+    local XMRIG_WIN="$SCRIPT_DIR/prebuilt-binaries/drg-xmrig/xmrig.exe"
     [[ -f "$XMRIG_WIN" ]] && { cp "$XMRIG_WIN" "$dist_dir/"; info "Bundled xmrig.exe"; } || warn "xmrig.exe not found — mining unavailable in zip"
 
     cp -r bin/res "$dist_dir/" 2>/dev/null || true
@@ -1088,8 +1088,8 @@ TOOLCHAIN
         info "Lite mode: skipping macOS daemon and Sapling/asmap bundling"
     fi
 
-    # xmrig binary (from prebuilt-binaries/xmrig-hac/)
+    # xmrig binary (from prebuilt-binaries/drg-xmrig/)
-    local XMRIG_MAC="$SCRIPT_DIR/prebuilt-binaries/xmrig-hac/xmrig"
+    local XMRIG_MAC="$SCRIPT_DIR/prebuilt-binaries/drg-xmrig/xmrig"
     if [[ -f "$XMRIG_MAC" ]]; then
         cp "$XMRIG_MAC" "$MACOS/xmrig"
         chmod +x "$MACOS/xmrig"

scripts/legacy/build-windows.sh

@@ -256,8 +256,8 @@ HEADER_START
         echo -e "${YELLOW}Note: Daemon binaries not found in prebuilt-binaries/dragonxd-win/ — wallet only${NC}"
     fi
 
-    # ── xmrig binary (from prebuilt-binaries/xmrig-hac/) ────────────────
+    # ── xmrig binary (from prebuilt-binaries/drg-xmrig/) ────────────────
-    XMRIG_DIR="$SCRIPT_DIR/prebuilt-binaries/xmrig-hac"
+    XMRIG_DIR="$SCRIPT_DIR/prebuilt-binaries/drg-xmrig"
     if [ -f "$XMRIG_DIR/xmrig.exe" ]; then
         cp -f "$XMRIG_DIR/xmrig.exe" "$EMBED_RES_DIR/xmrig.exe"
         echo "  Staged xmrig.exe ($(du -h "$XMRIG_DIR/xmrig.exe" | cut -f1))"

scripts/sign-daemon-release.sh

@@ -1,25 +1,31 @@
 #!/usr/bin/env bash
-# Sign dragonx full-node release archives for the wallet's in-app daemon updater (ed25519).
+# Package the prebuilt dragonx full-node binaries into per-platform release archives and sign them
+# for the wallet's in-app daemon updater (ed25519 over the EXACT archive bytes).
 #
-# The wallet verifies a detached ed25519 signature over the EXACT archive bytes against a public
+# The wallet verifies a detached ed25519 signature over the archive bytes against a public key
-# key pinned in src/util/daemon_updater.h (kDaemonSignaturePublicKeyBase64). Verification is
+# pinned in src/util/daemon_updater.h (kDaemonSignaturePublicKeyBase64). Verification is MANDATORY
-# MANDATORY (kDaemonRequireSignature = true): an in-app update is refused unless a valid signature
+# (kDaemonRequireSignature = true): an in-app update is refused unless a valid "<archive>.sig" is
-# is published. For each archive <name>.zip this produces <name>.zip.sig holding the base64 of the
+# published next to the archive. The wallet also checks each archive's SHA-256 against a markdown
-# raw 64-byte ed25519 signature — upload that .sig next to the .zip as a release asset.
+# checksum table in the release body, so `release` prints that table for you to paste in.
 #
-# Uses OpenSSL (>= 1.1.1) only — no Python/PyNaCl needed. OpenSSL's ed25519 is PureEdDSA (RFC 8032),
+# Uses OpenSSL (>= 1.1.1) only — no Python/PyNaCl. OpenSSL's ed25519 is PureEdDSA (RFC 8032), the
-# the same primitive libsodium's crypto_sign_verify_detached checks, so signatures are compatible
+# same primitive libsodium's crypto_sign_verify_detached checks, so the signatures are compatible.
-# (the same flow the wallet's unit tests verify for the miner updater).
 #
 # Usage:
 #   scripts/sign-daemon-release.sh keygen [out-prefix]         # -> <prefix>.ed25519.{key,pub.b64}
 #   scripts/sign-daemon-release.sh pubkey <secret.key>         # print the base64 public key to pin
-#   scripts/sign-daemon-release.sh sign <secret.key> <file>...# -> <file>.sig per file
+#   scripts/sign-daemon-release.sh sign   <secret.key> <file>...  # sign existing files -> <file>.sig
+#   scripts/sign-daemon-release.sh release <secret.key> <version> [--src DIR] [--out DIR]
+#       # zip prebuilt-binaries/dragonxd-{linux,mac,win}/ into dragonx-<version>-{linux-amd64,macos,
+#       # win64}.zip, sign each, and print the SHA-256 checksum table. Platforms with no dragonxd
+#       # binary staged are skipped.
 #
-# Keep the secret key (.ed25519.key) OFFLINE. Paste the base64 public key into
+# Keep the secret key (.ed25519.key) OFFLINE (mode 600). Paste the base64 public key into
 # kDaemonSignaturePublicKeyBase64 in src/util/daemon_updater.h.
 
 set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 die() { echo "error: $*" >&2; exit 1; }
 command -v openssl >/dev/null || die "openssl not found (need >= 1.1.1 with ed25519)"
 
@@ -27,6 +33,26 @@ command -v openssl >/dev/null || die "openssl not found (need >= 1.1.1 with ed25
 # ed25519 is a fixed 12-byte prefix + the 32-byte key, so the trailing 32 bytes are the raw key.
 pubkey_b64() { openssl pkey -in "$1" -pubout -outform DER | tail -c 32 | openssl base64 -A; }
 
+sha256_of() {
+  if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}';
+  else shasum -a 256 "$1" | awk '{print $1}'; fi
+}
+
+# Detached ed25519 signature over the raw file bytes -> <file>.sig (base64 of the 64-byte sig).
+sign_file() {
+  local key="$1" f="$2" raw
+  raw="$(mktemp)"
+  openssl pkeyutl -sign -inkey "$key" -rawin -in "$f" -out "$raw"
+  openssl base64 -A -in "$raw" > "$f.sig"
+  printf '\n' >> "$f.sig"
+  rm -f "$raw"
+}
+
+# platform -> (staging dir under prebuilt-binaries, release token, expected daemon binary name)
+plat_dir()    { case "$1" in linux) echo dragonxd-linux;; mac) echo dragonxd-mac;; win) echo dragonxd-win;; esac; }
+plat_token()  { case "$1" in linux) echo linux-amd64;;   mac) echo macos;;        win) echo win64;; esac; }
+plat_daemon() { case "$1" in win) echo dragonxd.exe;;    *)   echo dragonxd;; esac; }
+
 cmd="${1:-}"; shift || true
 case "$cmd" in
   keygen)
@@ -42,26 +68,90 @@ case "$cmd" in
     echo "Pin this in src/util/daemon_updater.h (kDaemonSignaturePublicKeyBase64):"
     echo "  $pub"
     ;;
+
   pubkey)
     [ $# -ge 1 ] || die "usage: pubkey <secret.key>"
     pubkey_b64 "$1"
     ;;
+
   sign)
     [ $# -ge 2 ] || die "usage: sign <secret.key> <file>..."
     key="$1"; shift
     [ -f "$key" ] || die "no such key: $key"
     for f in "$@"; do
       [ -f "$f" ] || die "no such file: $f"
-      raw="$(mktemp)"
+      sign_file "$key" "$f"
-      openssl pkeyutl -sign -inkey "$key" -rawin -in "$f" -out "$raw"
-      openssl base64 -A -in "$raw" > "$f.sig"
-      printf '\n' >> "$f.sig"
-      rm -f "$raw"
       echo "signed: $f -> $f.sig"
     done
     echo "Upload each .sig as a release asset next to its archive."
     ;;
+
+  release)
+    [ $# -ge 2 ] || die "usage: release <secret.key> <version> [--src DIR] [--out DIR]"
+    key="$1"; version="$2"; shift 2
+    src="$PROJECT_ROOT/prebuilt-binaries"
+    out="$PROJECT_ROOT/release/daemon"
+    while [ $# -gt 0 ]; do
+      case "$1" in
+        --src) [ $# -ge 2 ] || die "--src needs a value"; src="$2"; shift 2 ;;
+        --out) [ $# -ge 2 ] || die "--out needs a value"; out="$2"; shift 2 ;;
+        *) die "unknown option: $1" ;;
+      esac
+    done
+    [ -f "$key" ] || die "no such key: $key"
+    [ -d "$src" ] || die "no such source dir: $src"
+    command -v zip >/dev/null 2>&1 || die "zip not found (install 'zip')"
+    mkdir -p "$out"
+
+    # Sanity: warn if this key does not match the public key pinned in the wallet (the wallet would
+    # then reject every signature made with it — only expected when deliberately rotating the key).
+    pinned="$(grep -oE '"[A-Za-z0-9+/]{43}="' "$PROJECT_ROOT/src/util/daemon_updater.h" 2>/dev/null | head -1 | tr -d '"')"
+    mine="$(pubkey_b64 "$key")"
+    if [ -n "$pinned" ] && [ "$pinned" != "$mine" ]; then
+      echo "WARNING: this key's public key does not match the one pinned in daemon_updater.h:" >&2
+      echo "         signing key -> $mine" >&2
+      echo "         pinned key  -> $pinned" >&2
+      echo "         The wallet will REJECT these signatures unless you are rotating the pinned key." >&2
+      echo >&2
+    fi
+
+    made=0
+    table=""
+    for plat in linux mac win; do
+      d="$src/$(plat_dir "$plat")"
+      daemon="$d/$(plat_daemon "$plat")"
+      if [ ! -f "$daemon" ]; then
+        echo "skip $plat: no $(plat_daemon "$plat") staged in $d" >&2
+        continue
+      fi
+      archive="dragonx-$version-$(plat_token "$plat").zip"
+      apath="$out/$archive"
+      rm -f "$apath"
+      # Zip the staged files at the archive root (binaries + sapling params + asmap), excluding
+      # the .gitkeep placeholder. The updater flattens paths via baseName(), so a flat zip is fine.
+      files=()
+      while IFS= read -r fn; do files+=("$fn"); done < <(cd "$d" && ls -A | grep -vx '.gitkeep')
+      [ "${#files[@]}" -gt 0 ] || { echo "skip $plat: nothing to package in $d" >&2; continue; }
+      ( cd "$d" && zip -q -X "$apath" "${files[@]}" )
+      sign_file "$key" "$apath"
+      sum="$(sha256_of "$apath")"
+      table+="| $archive | \`$sum\` |"$'\n'
+      echo "packaged + signed: $apath (+ .sig)  sha256=$sum"
+      made=$((made + 1))
+    done
+    [ "$made" -gt 0 ] || die "no platform had a staged daemon binary under $src/dragonxd-{linux,mac,win}/"
+
+    echo
+    echo "Checksum table (paste into the release body so the wallet can verify SHA-256):"
+    echo "| Archive | SHA-256 |"
+    echo "|---|---|"
+    printf '%s' "$table"
+    echo
+    echo "Upload each .zip AND its .zip.sig as release assets. Wallet enforces the ed25519 signature"
+    echo "(kDaemonRequireSignature=true) and the SHA-256 from the table above."
+    ;;
+
   *)
-    die "usage: $0 {keygen [prefix] | pubkey <secret.key> | sign <secret.key> <file>...}"
+    die "usage: $0 {keygen [prefix] | pubkey <secret.key> | sign <secret.key> <file>... | release <secret.key> <version> [--src DIR] [--out DIR]}"
     ;;
 esac

setup.sh

@@ -284,6 +284,14 @@ fi
 header "Windows Cross-Compile"
 
 if $SETUP_WIN; then
+    # Only touch apt / update-alternatives (which need sudo) when the toolchain is missing. If it is
+    # already installed, skip them so `./setup.sh --win` can run WITHOUT sudo — important because the
+    # daemon cross-compile that follows should run as the invoking user. Running the whole setup under
+    # sudo leaves root-owned build artifacts under external/dragonx, which then break `make clean` on
+    # a later non-sudo build (stale objects get relinked -> the mingw link failure recurs).
+    if has_cmd x86_64-w64-mingw32-g++-posix || has_cmd x86_64-w64-mingw32-g++; then
+        ok "Windows cross-compile toolchain already present — skipping apt install"
+    else
         win_pkgs="$(get_pkgs win)"
         if [[ -n "$win_pkgs" ]]; then
             install_pkgs "$win_pkgs" "Windows cross-compile"
@@ -298,6 +306,7 @@ if $SETUP_WIN; then
                     /usr/bin/x86_64-w64-mingw32-g++-posix 2>/dev/null || true
             fi
         fi
+    fi
 
     # Fetch libsodium for Windows
     if [[ ! -f "$PROJECT_DIR/libs/libsodium-win/lib/libsodium.a" ]]; then
@@ -699,11 +708,13 @@ if [[ "$STALE_DAEMON" -eq 1 ]]; then
     warn "  Linux: ./setup.sh   ·   Windows: ./setup.sh --win   ·   macOS: ./setup.sh --mac"
 fi
 
-# ── 7. xmrig-hac (mining binary) ────────────────────────────────────────────
+# ── 7. drg-xmrig (mining binary) ────────────────────────────────────────────
-header "xmrig-hac Mining Binary"
+header "drg-xmrig Mining Binary"
 
-XMRIG_SRC="$PROJECT_DIR/external/xmrig-hac"
+XMRIG_SRC="$PROJECT_DIR/external/drg-xmrig"
-XMRIG_PREBUILT="$PROJECT_DIR/prebuilt-binaries/xmrig-hac"
+# Output dir bundled by build.sh (Linux zip, AppImage, Windows embed, mac .app)
+# and scripts/legacy/build-windows.sh — keep this path in sync with those.
+XMRIG_PREBUILT="$PROJECT_DIR/prebuilt-binaries/drg-xmrig"
 
 # Clean previous prebuilt xmrig binaries so we always rebuild
 # Only clean the binary for the platform(s) we are actually building,
@@ -715,14 +726,14 @@ if ! $CHECK_ONLY; then
     fi
 fi
 
-# Helper: clone xmrig-hac if not present
+# Helper: clone drg-xmrig if not present
 clone_xmrig_if_needed() {
     if [[ ! -d "$XMRIG_SRC" ]]; then
-        info "Cloning xmrig-hac..."
+        info "Cloning drg-xmrig..."
-        git clone https://git.dragonx.is/dragonx/xmrig-hac.git "$XMRIG_SRC"
+        git clone https://git.dragonx.is/DragonX/drg-xmrig.git "$XMRIG_SRC"
     else
-        ok "xmrig-hac source already present"
+        ok "drg-xmrig source already present"
-        info "Pulling latest xmrig-hac..."
+        info "Pulling latest drg-xmrig..."
         (cd "$XMRIG_SRC" && git pull --ff-only 2>/dev/null || true)
     fi
 }
@@ -743,15 +754,15 @@ else
     rm -rf "$XMRIG_SRC/build"
 
     # Build dependencies (libuv, hwloc, openssl)
-    info "Building xmrig-hac dependencies (libuv, hwloc, openssl)..."
+    info "Building drg-xmrig dependencies (libuv, hwloc, openssl)..."
     (
         cd "$XMRIG_SRC/scripts"
         sh build_deps.sh
     )
-    ok "xmrig-hac dependencies built"
+    ok "drg-xmrig dependencies built"
 
     # Build xmrig
-    info "Building xmrig-hac (Linux)..."
+    info "Building drg-xmrig (Linux)..."
     mkdir -p "$XMRIG_SRC/build"
     (
         cd "$XMRIG_SRC/build"
@@ -768,7 +779,7 @@ else
     mkdir -p "$XMRIG_PREBUILT"
     if [[ -f "$XMRIG_SRC/build/xmrig" ]]; then
         cp "$XMRIG_SRC/build/xmrig" "$XMRIG_LINUX"
-        ok "xmrig (Linux) built and installed to prebuilt-binaries/xmrig-hac/"
+        ok "xmrig (Linux) built and installed to prebuilt-binaries/drg-xmrig/"
     else
         err "xmrig (Linux) build failed — binary not found"
         MISSING=$((MISSING + 1))
@@ -792,7 +803,7 @@ else
     # Clean previous Windows build
     rm -rf "$XMRIG_SRC/build-windows"
 
-    info "Building xmrig-hac (Windows cross-compile)..."
+    info "Building drg-xmrig (Windows cross-compile)..."
     (
         cd "$XMRIG_SRC/scripts"
         bash build_windows.sh
@@ -802,7 +813,7 @@ else
     mkdir -p "$XMRIG_PREBUILT"
     if [[ -f "$XMRIG_SRC/build-windows/xmrig.exe" ]]; then
         cp "$XMRIG_SRC/build-windows/xmrig.exe" "$XMRIG_WIN"
-        ok "xmrig.exe (Windows) built and installed to prebuilt-binaries/xmrig-hac/"
+        ok "xmrig.exe (Windows) built and installed to prebuilt-binaries/drg-xmrig/"
     else
         err "xmrig.exe (Windows) build failed — binary not found"
         MISSING=$((MISSING + 1))
@@ -812,7 +823,7 @@ fi
 # ── 8. Binary directories ───────────────────────────────────────────────────
 header "Binary Directories"
 
-for platform in dragonxd-linux dragonxd-win dragonxd-mac xmrig; do
+for platform in dragonxd-linux dragonxd-win dragonxd-mac drg-xmrig; do
     dir="$PROJECT_DIR/prebuilt-binaries/$platform"
     if [[ -d "$dir" ]]; then
         # Count actual files (not .gitkeep)

src/daemon/xmrig_manager.cpp

@@ -2,7 +2,7 @@
 // Copyright 2024-2026 The Hush Developers
 // Released under the GPLv3
 //
-// xmrig_manager.cpp — Pool mining process management via xmrig-hac.
+// xmrig_manager.cpp — Pool mining process management via drg-xmrig.
 // Spawns xmrig, monitors via HTTP API, tracks hashrate and shares.
 
 #include "xmrig_manager.h"