Firmware Mirror Provenance: SHA-256 and Attested Origin for Every File

Every file D-Central mirrors under /dl/ is listed here with its SHA-256, what the file itself proves about its own origin, and — where we can establish it — where it came from. Where we cannot establish that, this page says Unknown. We do not reconstruct a vendor URL from a filename.

This directory is a mirror, not an official channel. Where the vendor still distributes a file, get it from the vendor. Our copy is for the builds that are no longer distributed anywhere else — and a mirror is only worth using if it publishes a hash you can check, which is what this page is for. See Mining Firmware Security for the full provenance test, and How to Verify Mining Firmware Authenticity for how to run the check.

How to read the “attested author” column

The author shown for each file is what that file says about itself — a signing-key path inside an installer script, a vendor string inside a binary, an embedded PDF metadata field. It is not what we believe, and it is not read from the file’s name.

That distinction matters most on the filenames carrying a bracket. 42 of the 112 filenames carry a [Bitmain] or [Innosilicon] tag. That tag is D-Central’s own shelving label, applied in 2022 to describe the equipment the document is about — it is not a claim about who wrote the document. 16 of those 42 files name a different author entirely in their own embedded metadata (zeusbtc.com / ZEUS MINING), including all 10 of the [Innosilicon]-tagged ones. 8 name Bitmain, and 18 name nobody at all. Where a row says Unknown next to a bracketed filename, the bracket is the reason the file is shelved where it is, and the Unknown is the honest answer about who authored it.