Topic: [GUIDE] How to Safely Download and Verify Electrum [Guide] - page 3. (Read 20693 times)

Indeed that was super easy (However I needed the explanation so thanks a lot)
I am not sure 100% that it works because I can't open the file  (.asc) but I guess it's normal because GPG is not installed yet.

Choose Finder > Preferences > Advanced. Now you can check "Show all filename extensions." if it isn't already checked. Now go to the directory you've saved your .txt file and rename it to .asc.

There's no need to download any software for this. It's as simple as renaming a file.

1) I am able to save it (From File>Save as ...) in .txt but not in .asc (you seem to say that it's possible to direct convert in asc. for the link but I don't see the option. Am I wrong somewhere ?
2) I have made my search on internet. To convert a .txt fil in .asc it needs to download again a new software. Do you know which one I can trust (if possible available in the App Store) ?
3) I am wondering in using this tutorial if the solution for verifying Electrum is really good. Indeed, to verify Electrum, I need to download others softwares (PGP and the soft for converting txt into asc). However, how can I be sure that PGP and other are secure and not full of malware. I should also verify PGP and Co. And it's becoming an infinite circle ... What do you think ?

 

You copy all the text. Actually, you don't need to copy it at all, just save it as a .asc file.

You can save it as a .txt, if it doesn't allow you directly as .asc, but it should be trivial to change it to .asc later. In the directory you've saved it, doesn't it show you the file extensions? If not, check: https://duckduckgo.com/?q=mac+show+file+extension

Hello,

Thank you for your quick answer.

I have still 2 questions for Thomas Key :
1. Do I copy all the text ? (including "Begin PGP Public key block" etc ...) Or only the key ?
2. I have tried with TextEdit on Mac BUT when I try to save I don't see the .asc extension. There are .txt, .html, RTF, .docx, .doc, .odt ...
But NOT .asc. There is also "Document d'archive web" and I have saved on doc with it but I don't think that it is and I don't see the extension on the doc ...

Please can you help ?

Besides the method provided by DireWolfM14 you can also highlight the link from ThomasV's key and press "CTRL" + Mouse click which should prompt the right click menu on Safari. Then just select the option "Save Link as..." and you'll be able to save directly the file/key (.asc) into a directory of your choosing.

The version of Electrum isn't important, the method I described works for v4.2.1 and should work for future releases as well.  You don't need to uninstall Electrum to verify the .dmg file.  You just need to download the .asc signature file associated with the .dmg file, save it into the same directory as the .dmg file, and then run the verification.  If it passes then you know the software you've already installed is authentic.  If it doesn't pass verification, then you should definitely purge the installation.  Personally, if the verification fails I would purge the entire system, but I'm paranoid.



Yes, those are trusted sources for ThomasV's key.  The easiest way to save the key is by copying the text from that first link, and pasting it into your favorite text editor.  You can then save it on your system with the name that you choose.  The name of the file isn't important, but remember where you saved it so that you can browse back to that location while importing into your GPG app.

Hello,

Thanks for this interesting post.

I am considering verify Electrum with your method. I have read carefully your tutorial but I still need to start the process.

I am a Mac user and I had several questions :
-I have already downloaded Electrum (from the original website : electrum.org) --> Do I have to uninstall Electrum and install it again after installing GPG, generate private key (I am not sure to understand the reason of the private key either) and Imprt ThomasV's PGP Key on MacOS ? Or I can verify Electrum while it's already on my MacOS ?
-For info, I am using the Electrum version 4.2.1

I had another question concerning :

"Import ThomasV's PGP Key on Mac OS
Download ThomasV's PGP Key from a trusted source.  If it's not already running, launch the GPG Keychain app, and click the import button.  Browse to the location where you saved the ThomasV.asc file, and select it."

Are these links are the trusted source for ThomasV's PGP key (in the beginning of your tutorial) :

"Redundant links to ThomasV's public key:
https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/ThomasV.asc
https://keys.openpgp.org/search?q=6694D8DE7BE8EE5631BED9502BD5824B7F9470E6
https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x6694d8de7be8ee5631bed9502bd5824b7f9470e6"

If yes. I have opened the first link and there is indeed a long public key BUT I have no idea how to download it in .asc format. (sorry I'm new in bitcoin AND also in MacOs). Can you explain ?

From first you, it's the only steps that are unclear for the moment.

Thanks for your help.

I made some significant updates to the OP to include and address the recent changes made by the development team to the way they sign the releases.  I also thought it was appropriate to provide a signature of my own for the tutorial, just in case.

Based on the previous releases, they have been consistent with the files' naming scheme except on those that needed hardware compatibility like the apk files.
So it will work, but sometime in the future, it could change.

You can actually browse to download.electrum.org using your browser to see the available files.

Most likely, but not necessarily.
They can give any name they want to the Electrum file and they can save it anywhere on the server. But, they probably won't in order to keep things organized and to maintain ease of access.
Just download the latest release directly from the website or copy its address from there and paste it in the command line.

Do I understand correctly that if a new electrum update is released, then it is enough to replace the version in the code? For example, 4.1.5 by 4.2, 4.3 etc.
That is, the code will take the form:

no luck with that last command; that just downloaded the sig file somewhere, but not in the bin directory. I already have the sig file after you mentioned its a seperate download, i'll just have to force it into bin somehow or try that dual command; i'll post again tomorrow, thanks

---

it doesn't seem to work;
after managing to force the sig file into the same bin directory as electrum, and running the following command:
"gpg --verify /usr/bin/electrum-4.1.5-x86_64.AppImage.asc"

the following errors come up:
gpg: no signed data
gpg: can't hash datafile: No data

any clues?
-just to check, 'certifying' is completely optional & not necessary to verify, right?

[moderator's note: consecutive posts merged]

Try this:


You might have to enter your password.

there seems to be a permissions issue for bin directory denying the sig file to be added there.
i'll have to try to get around this, or try your command for dual paths; i'll post the results tomorrow, thanks for helping!

No, it has to be downloaded separately.  If you downloaded the app image from the website, there's a link to the signature file just to the right of the link to download the app image. 

Otherwise, from the directory where the app image is:

path:  /usr/bin directory  --doesn't exist.

how would you locate the correct path for the sig file?
the sig file gets automatically downloaded/installed together with electrum, right?

also the command was tried with/without (~)... neither work.

The error seems rather clear; the signature file, which will have the .asc file extension isn't the directory ~/usr/bin.  Could it be in the /usr/bin directory instead?  Do you have the tilde (~) in your command by mistake?

Anyway, the easiest way to verify is the have the signature file in the same directory as the app image, then cd into that directory and run the following command:


Alternatively, you can verify with the files in two separate locations:

Thanks for making this guide, but i'm still having trouble verifying. The verify terminal command i'm entering is not turning up anything - its not able to find the file. If someone could shed some light on what the exact command needs to be, using the commands given on the guide isn't working; i'm sure i'm entering it wrong, but i can't find where the error is:

sys: linux-manjaro-kde x86_64
file-path: /usr/bin/electrum
file-vers: 4.1.5-2

command: "gpg --verify ~/usr/bin/electrum-4.1.5-2-x86_64.AppImage.asc"

errors using above command:
gpg: can't open '/home//usr/bin/electrum-4.1.5-2-x86_64.AppImage.asc': No such file or directory
gpg: verify signatures failed: No such file or directory

Okay I am going to just get rid of the keypair code I wrote down then since I figure it would be no use.


Okay I will not uninstall any of those programs.  Thanks man.