As a general rule, you do not need to update the offline signer as often as the online client. The signer has to do a narrow set of operations, and they are more often than not future proof. The client has to go online and keep up with OS/environment updates.
- Upgrade to 96.5 isn't possible on my cold ubuntu setup (12.04) because a dependency isn't satisfiable (libstdc++6 (>=4.8.0)). If I want to to use 96.5 as the signer I'll have to get a later version (between 14 and 18).
You would need ubuntu 14 to 18, 20 can work as well using the backport repo to install python2.
- I could try upgrading to 0.93 but correct me if I'm wrong, there's no need/improvement in my workflow since I don't use the 'clicking on a bitcoin:" link feature. Unless you recommend at least 0.93.3 for my signer because of BIP62.
You do not need to upgrade to 0.93 unless you want to spend from Armory P2SH addresses. If you end up sending coins to a P2SH address, you will have to update to spend them.
Malleability (BIP62) was an old soft attack on the network (circa 2015-16?). People would produce variants of someone's signature (flipping the sign on parts of the signature, pad a 0, whatever) which wouldn't invalidate the transaction but change the hash (since at least one bit changed). This made your transactions mine but under a different hash, breaking zero conf chains and inducing wallets/services in error.
RFC 6979 and other countermeasures were enforced in SegWit, malleable transactions are still valid, and I believe standard as well if you signal v1? It's been a while since I last heard of this TBH.
- I am hesitant to manually set the change address or modify the transaction for fear of a mistake on my part and sending any bitcoin to a change address I cannot access. I'd prefer to let the wallet software do its thing.
For any meaningful transaction, you should verify all recipients on your offline signer before signing. Armory decorates recipients it knows with relevant information (in this case, the wallet id the address belongs to). It should be evident in the GUI which address is yours, which isn't and how much bitcoin in aggregate is leaving your wallet.
I'm okay with transacting in legacy P2PKH addresses. My destination wallet in this case does allow for it, after which I can move to a segwit address.
You can send to P2SH addresses (even segwit nested in P2SH), you cannot spend from that. The risk is that the change address is in a format 0.92 cannot spend from, forcing you to update. So long as the offline signer recognizes the change address, it can spend from it.
So I think my options are 1) setup a cold ubuntu (v14 to 18) machine and install Armory 96.5 to act as the signer. I would still have to transact with a P2PKH address for the destination to be able to sign. Or 2) keep my current cold ubuntu machine and update to Armory 0.93.3.
Unless you want to use SegWit or P2SH schemes, you do not need to update the offline signer.