Topic: Verifying the PGP Signature to electrum? (Read 373 times)

When looking for how to verify Electrum file for Android 64 bits, I have found this thread, which I have read to notes. Taking into account its time (2023-24) and the signs of experience, it is highly probable that I already understood what is important to apply and this comment is about thanking to every contributer and, specially, who used the bird-eye-view and also quoted relevant urls

That said, I welcome any update or suggestion.

If you need to use Ledger Live on a smartphone, make sure you download the software from a link on the official website. In case of Ledger, it's https://www.ledger.com/ledger-live. Never search for any apps from the App Store or Play Store because there have been many instances of fake phishing apps being posted there. Their whole purpose is to steal your seed and gain access to your coins.

Thank you so much for this potentially helpful information. I will keep it in mind for the future in case I ever need to use it for a mobile device.

I know I'm a little late to the party here, but that's not strictly true.

I have the Ledger Live app installed on my Android device (Samsung Galaxy S20 FE), and can connect my Ledger Nano S to it using a "USB C to USB A adapter" like this:


and then using a standard USB-A to Micro USB cable to connect the Nano S. (I don't have a USB-C to Micro USB cable to try)


It's fully functional, if somewhat of a janky solution


NOTE: There is a Ledger Live app on the Apple store as well, but I don't have a suitable iOS device (nor the appropriate adapters) to try and test connecting the Nano S to iOS devices.

Skip the steps from the start to the importation and certification of Electrum developers' public keys.
You should go straight to verify Electrum with the signature (.asc) file, of course download the new signature file that's released with that version.

I keep forgetting exactly how I verified Electrum each time I'm required to do it again for a new update. I was hoping someone could tell me what steps of the PGP verification process do NOT need to be repeated and what steps I do need to repeat to verify it?

Thanks for the advice @o_e_l_e_o I will go check it out.

Both the official CLI/GUI wallet and Feather wallet work with hardware devices. The Monero subreddit is a good resource for Monero info: https://www.reddit.com/r/Monero/

Ledger Nano S devices are not compatible with phones.

You can use Electrum to interact with your Ledger device by following the guide here: https://support.ledger.com/hc/en-us/articles/115005161925-Set-up-and-use-Electrum

Once you've created your wallet, it's a simple as taking the next receiving address from Electrum and sending coins which you have bought to this address.

Okay I'll do that thanks and that's interesting. Ok and I'm hoping this is on topic... how exactly do I use a Bitcoin ATM alongside and Electrum Wallet? I use a hardware wallet too btw.

If it's about Monero, I doubt people here in Electrum board would be willing to give you answers since it's off-topic.
If you want, you can post a new topic in 'Altcoins' or 'Wallet Software' board regarding that matter.

As for sending or receiving cryptocurrencies in Android or iOS in general, there are a lot of SPV or centralized wallets out there that works in either platform.

Ok thank you so much I managed to do it thanks to that one video and your post, and I'd like to find a good Monero Wallet to use with my Hardware Ledger Nano S on my computer as I assume to date it's not possible to send or receive cryptocurrency via a iphone or android device?

I can confirm I hold the following keys locally:

Emzy - 0x9EDAFF80E080659604F4A76B2EBB056FD847F8A7, with subkey 0x637DB1E23370F84AFF88CCE03152347D07DA627C

SomberNight - 0x0EEDCFD5CAFB459067349B23CA9EEEC43DF911DC

ThomasV - 0x6694D8DE7BE8EE5631BED9502BD5824B7F9470E6

These three keys match the keys which have signed your Electrum download, so you are safe to install. As nc50lc says, if you want all three to verify fully you'll need to import and verify Emzy and SomberNight's keys as well.

That video if for the older Electrum binaries that are signed by ThomasV alone.
The latest now have 3 signatures. Namely; by ThomasV, SomberNight and Stephan Oste (Emzy).

The result that you get is "good enough" for having one valid signature and certified certificate out of the three.
But if you really want a "green result" you should redo the steps to "import" and "certify" the other two developer's PGP key.
You can find their keys here: https://github.com/spesmilo/electrum/tree/master/pubkeys

I think I did it but it looks different from the youtube video tutorial I watched here:https://www.youtube.com/watch?v=Y0zgZ4M1Bro



This is what it shows me (it had no green coloured background like in the video):


 "Verified ‘electrum-4.4.6-setup.exe’ with ‘electrum-4.4.6-setup.exe.asc’: 3 valid signatures."


                 Signature created on August 20, 2023 7:18:16 PM
With unavailable certificate:
ID: 0x637DB1E23370F84AFF88CCE03152347D07DA627C
You can search the certificate on a keyserver or import it from a file.

Signature created on August 17, 2023 4:59:29 PM
With unavailable certificate:
ID: 0x0EEDCFD5CAFB459067349B23CA9EEEC43DF911DC
You can search the certificate on a keyserver or import it from a file.

Signature created on August 17, 2023 3:09:34 PM
With certificate:
Thomas Voegtlin (https://electrum.org) <[email protected]> (2BD5 824B 7F94 70E6)
The signature is valid and the certificate's validity is fully trusted."

That would be for your own PGP/GPG key pair, you can leave the email field empty if you want.
For verifying Electrum signatures, it doesn't matter if you've set an email or not.

It's never been a requirement but optional for the users' own safety.

AFAIK, there's no Electrum in the 'App Store', if there's one, it isn't official.
For Electrum downloaded from Android's PlayStore, you should check if it's uploaded by "Electrum Technologies GmbH" since you can't verify an already installed app.
If you want to verify, download the ".apk" and its signature file from electrum.org to verify it in your PC before installing to your device.

Thanks a lot for the new guide ^   but my 1st question now (among many others) is does it matter what name and email address I use at step 1? I don't know where my "key" is located where I can back it up... is that step really necessary? I DON'T KNOW WHAT I'M READING trying to follow that tutorial!?

Also it seems i forgot my passphrase for my key do I just start over even though it says not to delete it?

OR I NEED a step-by-walthrough an up-to-date one if possible.... I'm using version 4.2.2 do I really need to update I know its old af but?



OFF-TOPIC: Is it possible to get Electrum on an iphone?

That is the PGP key of ThomasV, the lead dev of Electrum. You should import it in to Kleoparta by clicking on "Notepad", pasting it in, and then clicking on "Import Notepad".

You are almost there. You have confirmed that the Electrum file you have downloaded has been signed by three sets of keys. It is telling you the signatures cannot be verified because you have not yet told Kleopatra that you trust those three sets of keys as belonging to the Electrum devs.

---

Since you already have Kleopatra installed, the next step is to import the PGP keys of the three Electrum devs which sign the releases. As above, go to "Notepad", paste in the first key, and then click on "Import Notepad". Do this for each of three keys you will find here:
https://github.com/spesmilo/electrum/blob/master/pubkeys/ThomasV.asc
https://github.com/spesmilo/electrum/blob/master/pubkeys/Emzy.asc
https://github.com/spesmilo/electrum/blob/master/pubkeys/sombernight_releasekey.asc

Once you've done that, you should repeat what you did above to open the .asc file with Kleopatra. It should now show you that the three signatures are verified and you are safe to install.

Three guides for Windows, Linux, Android.
[Eng: Tutorial] PGP Signature - Encrypt/Decrypt message - Fingerprint
[Eng: Tutorial] PGP Signature - Encrypt/Decrypt message (Linux Only)
[Android Tutorial] PGP Signature - Encrypt/Decrypt message

Thanks that's most helpful guide posted so far, but in that video I'm sent to a file to download when I click signatures next to electrum download file but it doesn't bring to a webapge to copy and paste the text like the youtube video shows it just a file that when I open it now with GPG4Win/Kleopatra installed it brings up a bunch of options 1st one stating I got 3 signatures that cannot be verified?

I'm stuck now at the Command Prompt part of the video and I thought it was because I installed the files onto my desktop instead of the downloads folders so I typed in that location instead but it just says it won't work? Wtf am I doing wrong damnit! This whole entire proccess is sooo discouraging and I felt fairly knowledgeable and confident regarding this until now.





OMG I'm  beginning to remember why I gave up on trying to accomplish this seemingly mandatory task FFS!

BTW I'm using Windows 10 and I dd NOT verify the hash values of GPG4Win before I downloaded and installed it so I'm assuming it won't make a difference if I verify it now... even if it were worse case scenario?

Um thank you but now I'm stuck at step 3 due to the links for files I need leading me to a youtube video and the other leading me to this:


"-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBE34z9wBEACT31iv9i8Jx/6MhywWmytSGWojS7aJwGiH/wlHQcjeleGnW8HF
Z8R73ICgvpcWM2mfx0R/YIzRIbbT+E2PJ+iTw0BTGU7irRKrdLXReH130K3bDg05
+DaYFf0qY/t/e4WDXRVnr8L28hRQ4/9SnvgNcUBzd0IDOUiicZvhkIm6TikL+xSr
5Gcn/PaJFS1VpbWklXaLfvci9l4fINL3vMyLiV/75b1laSP5LPEvbfd7W9T6HeCX
63epTHmGBmB4ycGqkwOgq6NxxaLHxRWlfylRXRWpI/9B66x8vOUd70jjjyqG+mhQ
+1+qfydeSW3R6Dr2vzDyDrBXbdVMTL2VFXqNG03FYcv191H7zJgPlJGyaO4IZxj+
+O8LaoJuFqAr8/+NX4K4UfWPvcrJ2i+eUkbkDJHo4GQK712/DtSLAA+YGeIF9HAn
zKvaMkZDMwY8z3gBSE/jMV2IcONvpUUOFPQgTmCvlJZAFTPeLTDv+HX8GfhmjAJY
T5rTcvyPEkoq9fWhQiFp5HRpYrD36yLVrpznh2Mx7B1Iy8Rq/7avadwVn87C6scJ
ouPu+0PF3IeVmYfCScbfxtx1FaEczm8wGBlaB/jkDEhx0RR8PYKKTIEM7T2LH2p6
s/+Ei4V7mqkcveF/DPnScMPBprJwuoGNFdx2qKmgCKLycWlSnwec+hdyTwARAQAB
tBlUaG9tYXNWIDx0aG9tYXN2MUBnbXguZGU+iQI4BBMBAgAiBQJN+M/cAhsDBgsJ
CAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAr1YJLf5Rw5hlhD/9T4I/sBCleS9nH
njTJqcOnG28c9C3CRYIizjEui/pKmXz9fB1N9QrCaruPUQx2UacDVCl6dKxac+7s
s3/a6lsjaRn0/2OM/sCVLScyxNPNPQs2b6jkodSNPIM8zv51g+flhwtfrO6h6B4j
IhZgSjFdvqtZd5jaly9rA0uMX045CC4K6HGnq8n4F2p31z0L0LaHBf5EcsCM0MMp
QVkY0aUrNg9uVMGXBHn3osHnOtQaODqcIbpa/OG+Tlt6pVOiDJ7i8TkpQKT7sOaM
VdL//TEoDIOC7qVCN82q2q/gtiBXbziaERVs/eU0O52aX5qUhXu3VIjXTp/riRim
R/f9BPB1dgDZbF2aPZ/rJm26v82ft7gP1Sf52E9MrAaZATTfI0/TUHXeBzN93EA9
xb6/ENAMTX74u+NjlynWPD+hl64eBzJ2ionZF1bJFTgBkMfRYnhllvleCjcq9YfX
md5HKCwtxfygBIujUQSwyUzn0f5DbVCJ7/B19bKdvHGSSBgBEjxqXWQskm2wc0In
ww63goZAGDQliKhIT8xnwOBbLkqSobq4tD9zpQyxvMA2rhy7/gfFRp7TTak7MZHf
lTJ37S5LvcWHm/ccWUZDUN7akoEDc+m6jX3uIEPMD3PQvcHhWv0amco3zDr1qb/+
rXM7TJKd7DPX0E2dRzKu6aYRMTbklbQhVGhvbWFzIFZvZWd0bGluIDx0aG9tYXN2
MUBnbXguZGU+iQI4BBMBAgAiBQJTQDaRAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIe
AQIXgAAKCRAr1YJLf5Rw5hOBD/9o/NqHLvjhrCfy6/SblSC/udV9ujFnvhZZZprb
r8Oe6GdMwfw+ktZd2nYb09KjxXYmGoZeZKmvCb0LoMKSVWgisH1rgzDzI6UzFL4b
pV2+PqCSiWaekfnBm+oHbGgJCuAXebGXjVL8JsvhAl0HQZzTA1RX0u8TEAHOxOI5
l+mXSN+cwVZuDMpt5v+JDyPGHM/KqaXCw1WJY50mqlan6/15XHilmvY/CaxmbXNH
ZOXucmPxyCTeiQTqyhHsIBb4RxWYCaUXv9+svriotv2HZpQ110NN09ml1K1kDlNL
Zh3jNqMsbImFArbN8GikjqhRBV3K77Np4lccnsBPllQMqqQULG7UshcQTatkmTMb
j2TQ0oQWEZt0uJmnmxgz18ijs6m2fJZhlH0QYVYOwUvK6GfAFluHwOZHIXonv8Ck
uTW+P90lOB/9ZnREZeYb2wlvV6fCTMHxptIbT31kbLTzu4KEI6+ShQXT+YAKiC5S
JC9heheaeApH3wcLiZJcCKYv6ubY+3Uf/EoXcqWywwpS/nWkSpMSYjq+V9xCcGHI
MZ4vZkiZ6OS5Mu739rgGfP7Yi3pqUYLIpUa5QiNOMEhPtWbj/oH5ldaZowwgZ4MK
2Mzxex8IhFppPtZgqJfu9NZQLICpxcd2hUe3XWvB+jcvboZ1p7RO7ax3Vo9zy1fy
YEFML7Q9VGhvbWFzIFZvZWd0bGluIChodHRwczovL2VsZWN0cnVtLm9yZykgPHRo
b21hc3ZAZWxlY3RydW0ub3JnPokCOAQTAQIAIgUCVMYFygIbAwYLCQgHAwIGFQgC
CQoLBBYCAwECHgECF4AACgkQK9WCS3+UcOZ7BQ//VJuRmM7kQd5DcJS76BKpMtKt
gUNV3hi2h8kNGtkIeKhpeiK+PeweFJCb0nQDiEYsg5Xd/l5ZwN34cqlhgaQ8uWBY
rmNnSYGECLrxejx6WTWHp2AtD9BXrj73HEox2abC0Bdky39aCTyuRhSzbFnV2unh
L7IarKqr5bat6ywFZWsOcaisEjWXlTSD/hYqnkRX8vnBZRnRgHyi1yOvHsXGFB3x
O+P7JUb4E7BVzVRDJzMgcBhY5vTZ4Mnc8eIplNVI1TaF2hmhmnezvRF6XNYV1Ew9
t2/HE85+DqIBikUWYPTTxJiWUOwxXP9dVOEmNTcAgVThvMN7W+WoF7//qcNKmbPI
DyGU5xb/MLNrM+MWfavtkHNqcY0+cFf27z4mOxd2eEMDVxN/Fhq0HipugMEawaZ0
G9xsF/rZBzKgpu7+SvqRqxUn36vNz59vDlBYEXSng6nJobUdNb6iHo/rpZ6ZYHKx
mzrK5ROpmKs6zpPTOn8Hw29jxx07auzEIVEa8hzZaiqTfwI9yBwzhFQwNxmNaKRE
adxosvU1VyTvaEVmMmTx227MF1qhwq9yrSXtmKZJGiHRzyL4B4vAGrf9uK9GwzS2
TlyksRdjapw6Cqp8sUB2PUzHqYNWs0wSsZuxwVt6JSD4N8vpYTTF00LONKe2oLhj
GNxpH+BV3SqMHXQl9Ki5Ag0ETfjP3AEQAL5LYJiX5S4PG891TMihejh5KVgc36/R
zgWYJkE26K855t+WdAa6spHKR1RmpTTsnaTXaC/bNxJZq+0vi9GKlw94twEueu0v
Cniinpy6AFeydveCi+qdr5XQ4hx1DY11kntGBL2wMOtrZ4oAeFnntHYcAMYaMBY5
p8gd3WVR2dgIvpOcezQBLwhoMHnN6A+JEQ27ZHcolwDO9ic+t4YAtl552DP1xKbc
T4D1JD0J6W6FbUJElOXReSjNGCuSLZZTsCzMg0P6RHwWUKtDvRKrK/M3Nh/L2EsW
5mAQnYps6a+hyVkVd9kLsogtHPE4xv33pzbDB5Yj+2zqdjYUqO/ODfkP+HjNRvyj
uHL6W3bjU6FnuJQXX4llskls4hlKDPawa3cuWnsdafouAZOxWwBlGysRZ7BaHOFE
TOlAeUN1EYfFrckcfkYzTX7NDA0S99aX730z/c9XrnqM52OO9LrSFRnYZ+K3M8z2
FFvo9/ZtqqTDH0/oH+ay0CwtowSovZUoljAQ8zmmi8CtPDFHg4srae8YxW4fetn7
QtP6rOVRwQCyP12LztC7oYGOectU5G9GkVDubNW48Vuex0/upP9RORjKN8atBroS
cmomR5hShxmgdJBy4I/TDkVFbZq/hRPSTAHgnciEC67TYhszzXP3nTn5/Ah0wCGC
d3HfiNX6G7MdABEBAAGJAh8EGAECAAkFAk34z9wCGwwACgkQK9WCS3+UcOaJRA//
dLHRBjeAkNbRsY5GNTWUZzXr3VC5vNqpwpP9rK4QTAmpl3iU5F+wsgMG78iS2XOV
+ijZA8KvishletQJoNMxS1PU4sA4Y34hYb61ptHs+PmwNpcdgjAX+mCh9xQ0816G
yIaXtxtxacJJW3K07fqKIkJjISPOyTLSd+wl1LtRE2fA67pMmpMHG8t+RPq1dp/e
3qp6L7jc6X3U+bn2m7u2cgEVbuAnSaKGoMSMnsd71Ltf1b6/DwvZz/HBttEgcgSm
PleHUVyBD4LDrcjTDK7zdEMw7b/cPBnu6CmTcogFEqvB4n9Yodo+4ij7AndUTz4J
j1p8vFlnHvhRg82MDfGUPJ+ujBjbYXROs+WAmaCQ8TgjZ3dAFNFrOqAbYu6QlY2x
fu7vj+ruc6ArdmBrOlsJFmNsxFRJfgdUug5JFIUN77GbjisHjWem8cY3szuyEke8
H2pi803CAuVtkaoNmNDHsEBieft34Zo0V+A/q2wkix3S9vyRjOKqhGrW30qxnV6Z
FexueWuO3qOQ0ZU5/TIH0kft2n45/RexeBq/Ip52zE1vEvTkQmBCfCGZmqTu+9Ro
8qsjecxVNxyVPlwhlimryiQ+dPaJYaOSfiwEEMh2MyV5c6t6qN9n6jFdiCLOlmmH
ZFA8xDodsofQEmlv+I/xyEZ7na6nxbpZVuPC3B0JFtY=
=sUYl
-----END PGP PUBLIC KEY BLOCK-----"







 But idk if this ^ is what I need let alone useful to me in anyway at all to copy and paste it somewheere?