Problem verifying electrum | Bitcointalksearch.org

nc50lc

legendary

Activity: 2534

Merit: 6080

Self-proclaimed Genius

Quote from: highfarmer on March 20, 2021, 10:46:18 AM

The signature of this message is valid but utrusted. That means it has not been tampered with. It is untrusted though, because the key has not yet been verified.

You must have set the "trust level" or "owner trust" to a lower value or default, it needs a higher trust level to remove that warning.
The info on how to set it is in the second link to DireWolfM14's post I've provided in my previous post (the last step for "Import on Mac OS").

ranochigo

legendary

Activity: 3038

Merit: 4418

Crypto Swap Exchange

Quote from: highfarmer on March 20, 2021, 10:46:18 AM

The signature of this message is valid but utrusted. That means it has not been tampered with. It is untrusted though, because the key has not yet been verified.

Yeah, you'll have to certify it somehow. Not a problem though.

Quote from: highfarmer on March 20, 2021, 10:46:18 AM

So, is this enough? Should I do something more before I can fully trust this is a legit version?

Unless the PGP key has been compromised, which is quite unlikely, you can trust that this was signed by ThomasV. The fingerprint that I've imported matches yours, 6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6. If you trust that the public key is accurate, then you've downloaded the legit version.

highfarmer

jr. member

Activity: 30

Merit: 5

Thank you for the answers!

It seemed that the name of the electrum itself and the asc-file was not the same since I had downloaded a couple of dubplates and since them the name was slightly change. But when I renamed them to the name "electrum-4.0.9.dmg" and "electrum-4.0.9.dmg.asc" and right-click on the dmd itself and "services" > "OpenPGP: Verify Signature of File" it says the following:

Thomas Voegtlin <[email protected]>
6694 D8DE 8BE8 EE56 31BE D950 2BD5 824B 7F94 70E6

The signature of this message is valid but utrusted. That means it has not been tampered with. It is untrusted though, because the key has not yet been verified.

So, is this enough? Should I do something more before I can fully trust this is a legit version?

ranochigo

legendary

Activity: 3038

Merit: 4418

Crypto Swap Exchange

Quote from: Maus0728 on March 20, 2021, 12:07:47 AM

I think you forgot to import the developer's PGP public key that can be found on the [1] https://electrum.org/#download. Without it, you cannot verify the signature of your electrum.

[1] https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/ThomasV.asc

The signature isn't verified, OP has imported the public key before. It should still show the RSA key without knowledge of the PGP key, instead of a signature mismatch.

As said, changing the file extension to something other than .asc can make it unusable for validation. Make sure that the file name of your .asc matches your .dmg as well.

Maus0728

legendary

Activity: 1904

Merit: 1563

Quote from: highfarmer on March 19, 2021, 07:07:48 PM

When I then right click on the .dmd-file and choose "services" > "OpenPGP: Verify Signature of File" it just says "no signatures found".

I think you forgot to import the developer's PGP public key that can be found on the [1] https://electrum.org/#download. Without it, you cannot verify the signature of your electrum.

[1] https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/ThomasV.asc

Alternatively, you can also follow the guide for MAC.

[2] https://bitzuma.com/posts/how-to-verify-an-electrum-download-on-mac/

nc50lc

legendary

Activity: 2534

Merit: 6080

Self-proclaimed Genius

Where did you downloaded electrum?

The name of asc file should be the same as the dmg file including the extension except it has ".asc" as 'the' extension.
Example: the files should be named as electrum-4.0.9.dmg and electrum-4.0.9.dmg.asc, and should be in the same directory/folder.

Anyways, you can review this Guide by DireWolfM14:

highfarmer

jr. member

Activity: 30

Merit: 5

I am on mac and I am trying to verifying Electrum, but without any success unfortunately.

I have downloaded and installed the gpg suite. I have added Thomas Voegtlin to the "collection" and I have also been downloaded the .dmg (program itself) and the .asc-file (the code from the site).

First I opened the .asc-file and a messages comes up withing the gpg-program stating that "the signature does not match this message. You should not trust this message, because it was manipulated..."

When I then right click on the .dmd-file and choose "services" > "OpenPGP: Verify Signature of File" it just says "no signatures found".

What am I doing wrong here?

Topic: Problem verifying electrum (Read 111 times)