Download

Download Shrike

Every release is published on GitHub with a SHA256SUMS file covering every artifact, signed with the release key.

Verifying takes a minute and is worth it: it checks that the file you downloaded is exactly the file that was published, and not something altered in transit or served by a site pretending to be this one. A wallet is a bad thing to take on trust. Do it before you run anything.

Not audited

Shrike has not been audited, and comes with no warranty of any kind. It is an unofficial fork and is not affiliated with the Sparrow project.

Latest release on GitHub Build from source

Which file to take #

Artifact names carry the version, so pick the matching file from the latest release rather than a link that goes stale here.

Platform	File
Debian, Ubuntu (x86_64)	`shrike_<version>_amd64.deb`
Debian, Ubuntu (arm64)	`shrike_<version>_arm64.deb`
Linux tarball (x86_64)	`shrike-<version>-x86_64.tar.gz`
Linux tarball (aarch64)	`shrike-<version>-aarch64.tar.gz`
macOS (Apple silicon)	`Shrike-<version>-arm64-unsigned.dmg`
macOS (Intel)	`Shrike-<version>-x86_64-unsigned.dmg`
Windows	`Shrike-<version>.msi` or `Shrike-<version>.zip`

The shrikeserver- and shrikeserver_ artifacts are the headless server build, for running without a desktop.

Verify the download #

There are two ways to do this. If you already have Shrike installed, it can check the download for you. Otherwise it is a few commands.

If you already have Shrike #

Download SHA256SUMS and SHA256SUMS.asc from the release, then drag either one onto the Shrike window. The verify dialog opens and checks the file for you. You can also reach it from Tools → Verify Download.

This is the easiest route, and it works for a fresh download of a new version while your existing install stays untouched.

From the command line #

You need gpg. It is preinstalled on most Linux systems; on macOS and Windows you will need to install GnuPG first.

Put three files in the same folder as the installer you downloaded, all from the same release: privkeyio-signing-key.asc, SHA256SUMS and SHA256SUMS.asc. Then open a terminal in that folder, for example cd ~/Downloads.

Step 1. Import the signing key.

gpg --import privkeyio-signing-key.asc

Step 2. Check the signature on the checksum file.

gpg --verify SHA256SUMS.asc SHA256SUMS

A successful check reports a good signature from the release key:

gpg: Signature made ...
gpg:                using RSA key A47D99B6DB0D715D40C59A2023AE8A8EA7E24E38
gpg: Good signature from "Kyle Santiago <kyle@privkey.io>" [unknown]

The warning underneath is normal

gpg will almost certainly add something like WARNING: This key is not certified with a trusted signature. That is not a failure. It only means you have not told your own gpg that you personally trust this key, which is true of any key you have just imported.

What matters is the line above it. Good signature means the file was signed by the holder of that key, and the fingerprint on the using RSA key line matches the one below. If you see BAD signature instead, stop and do not install anything.

The release key belongs to Kyle Santiago <kyle@privkey.io>. Compare the fingerprint yourself:

A47D 99B6 DB0D 715D 40C5  9A20 23AE 8A8E A7E2 4E38

Step 3. Check the installer against the checksums. Step 2 only proved the checksum file is genuine. It said nothing about the installer, so now compare the two. The command depends on your system.

Linux:

sha256sum --ignore-missing -c SHA256SUMS

macOS:

shasum -a 256 --ignore-missing -c SHA256SUMS

Windows, in PowerShell, then compare the result by eye against the matching line in SHA256SUMS:

Get-FileHash Shrike-<version>.msi -Algorithm SHA256

On Linux and macOS you want to see your file named with OK after it. Anything reporting FAILED means the file does not match what was signed: delete it and download again.

Unsigned installers

The macOS builds are not notarized and the Windows installer is not Authenticode signed, so both are reported as untrusted on first launch. Verify SHA256SUMS first: clearing the macOS quarantine flag removes the check that would otherwise stop a tampered download.

xattr -dr com.apple.quarantine /Applications/Shrike.app

What else you need #

A node that is up to date: Bitcoin Knots v29.4.1.knots20260508 or any later release, connected directly or behind your own Electrum server. Shrike ships with no public servers, because the ones it inherited from upstream stopped at the activation height. For an Electrum server, use a Fulcrum build with BLAKE2b support or the StartOS package; stock Fulcrum stops at the activation height. See connecting a node.

If you would rather follow along, Bitcoin University has a walkthrough of installing Shrike and pointing it at a node, covering Start9 and Umbrel. It is a community recording made before the current release.

Installing next to Sparrow #

Shrike uses its own home folder, packages, desktop entries and bundle identifier, so it installs alongside an existing Sparrow without sharing or overwriting any of its state. Wallet files are not shared between the two.