ThomasV Signature Not Verifying for Mac v4.1.4

[iBitcoinHongKong8]

Hi All,
Forgive me as I rarely have used this forum outside of the collectibles section. I seldomly use Electrum but when I do and have been prompted to update I've always been able to do so by downloading the Mac OS version then verifying the signature of ThomasV then I go ahead and install. That's worked fine for the last several updates. Well it's been a while since I opened Electrum and when I did so I was on v4.1.2. I went to the confirmed electrum download page and noticed they're had been some changes such as the addition of SomberNight and things just looked a bit different or updated. No issues, however ThomasV's signature couldn't be verified and also the 4.1.4 dmg file couldn't either. Anyone else have this issue or am I missing something? I did do a search for the last couple of pages to not just post without looking to see if this was an issue for others and I didn't see any so forgive me if there is. I'd be extremely grateful if anyone would let me know if I'm just missing something or etc....Cheers in advance.


iBHK8

[BitMaxz]

Are you sure it's 4.14 dmg file or 4.1.4? because there is no 4.14 version.

Try to redownload the dmg file and signature from this link and try to verify the signature and maybe there are some changes recently about their signature.

Here's the link https://download.electrum.org/4.1.4/

[iBitcoinHongKong8]

Are you sure it's 4.14 dmg file or 4.1.4? because there is no 4.14 version.

Try to redownload the dmg file and signature from this link and try to verify the signature and maybe there are some changes recently about their signature.

Here's the link https://download.electrum.org/4.1.4/

My apologies I meant 4.1.4.dmg and I just updated that in the OP and thread topic as well. Heck of a day.

iBHK8

[BitMaxz]

~snip~

Can you try to verify the signature with a different procedure?

Check these guides below to verify the signature and maybe your ways of verifying the signature are outdated.

- https://bitcointalk.org/index.php?topic=5105901.msg49695453#msg49695453
- https://bitcointalk.org/index.php?topic=5240594.0

If GnuPG doesn't work you can try the GPG Suite.

[HCP]

For the record... the various CRCs I get from 4.1.4 dmg are:

Code:

Name: electrum-4.1.4.dmg
Size: 42316173 bytes (40 MiB)
CRC32: F9853FEE
CRC64: 9A3A28002D2F68B8
SHA256: 2B9D06A881BC76CC521C60E8BB5EC25CD522B222B1AFDBC57849F51FF682999E
SHA1: 7FB3400E03C8FE137781ECD5DE61D8CD0B901ABD
BLAKE2sp: 870BF3C213043199C5A48D837035589639723940F1F4559171CDB3DBEF9DAEBE

and the contents of electrum-4.1.4.dmg.ThomasV.asc is:

Code:

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEZpTY3nvo7lYxvtlQK9WCS3+UcOYFAmDLRqwACgkQK9WCS3+U
cObSpg//e1wbIs5ftVrU0Brk7Q7JnKRiRRWqapPiYSZbG4SqGSJIEKN2Y4OkCE5a
DgENIIN+vCeNe49J/SZ4itQ6PO2frNYA6fLNm/Cd4496PacYBrcCAJxZnO8Khpv/
32Z39F4t6Zp1kDW34ae1FrVjK3RMheFmbNXwy7cqOyPdZyf1a5iI+FIYKuj8LDzh
2nrzFISc6Sfxf1Qq57wE2/ESRLTAei37s5eoAQgka3Tko0yH0B4WMUTxlYdgbRg/
5bH0K7Nmo0W66HIULDFsfaDs3mXyZqpu7I58v6bsWTgAWvWG5n9c/AvzkTv2sN2Z
URBNQVA7uElcI/8NAdtnEBy/Xg+AkZ/i57DAGRUNdJxFrunA347LGHCHi83O/ta2
Y1RtWAGHP/KHFV571dDTZRycVdHATPjz1tuxzCXWfsVKD491+W+vp1dpyDIDi1eQ
9ePW+U62cEGwNSRFFLKqpzGAUPRqGmhit8yD9J877lQjyDlFvrL3V2/7kF7WUmNg
CypFAneEOShQ1uSqqUApBP9MIgHh4/A6Y1rlZKJnVIvhqx+XJUQ34p1Xvbx3afMC
HLNuM7fOr7QZvAd56s5Fj05xFfCMiEHxjW3C+ps5RDc8/lmDVPw/FKwW/G7caAsh
AfvKOybhQAC4abEVNT9h48vQUXYAU9Bf0xJqzSYE9+RNObd8C3w=
=IjM5
-----END PGP SIGNATURE-----

These files seems to verify OK:



NOTE: I had to rename electrum-4.1.4.dmg.ThomasV.asc to electrum-4.1.4.dmg.asc so that Kleopatra would work properly

[iBitcoinHongKong8]

For the record... the various CRCs I get from 4.1.4 dmg are:

Code:

Name: electrum-4.1.4.dmg
Size: 42316173 bytes (40 MiB)
CRC32: F9853FEE
CRC64: 9A3A28002D2F68B8
SHA256: 2B9D06A881BC76CC521C60E8BB5EC25CD522B222B1AFDBC57849F51FF682999E
SHA1: 7FB3400E03C8FE137781ECD5DE61D8CD0B901ABD
BLAKE2sp: 870BF3C213043199C5A48D837035589639723940F1F4559171CDB3DBEF9DAEBE

and the contents of electrum-4.1.4.dmg.ThomasV.asc is:

Code:

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEZpTY3nvo7lYxvtlQK9WCS3+UcOYFAmDLRqwACgkQK9WCS3+U
cObSpg//e1wbIs5ftVrU0Brk7Q7JnKRiRRWqapPiYSZbG4SqGSJIEKN2Y4OkCE5a
DgENIIN+vCeNe49J/SZ4itQ6PO2frNYA6fLNm/Cd4496PacYBrcCAJxZnO8Khpv/
32Z39F4t6Zp1kDW34ae1FrVjK3RMheFmbNXwy7cqOyPdZyf1a5iI+FIYKuj8LDzh
2nrzFISc6Sfxf1Qq57wE2/ESRLTAei37s5eoAQgka3Tko0yH0B4WMUTxlYdgbRg/
5bH0K7Nmo0W66HIULDFsfaDs3mXyZqpu7I58v6bsWTgAWvWG5n9c/AvzkTv2sN2Z
URBNQVA7uElcI/8NAdtnEBy/Xg+AkZ/i57DAGRUNdJxFrunA347LGHCHi83O/ta2
Y1RtWAGHP/KHFV571dDTZRycVdHATPjz1tuxzCXWfsVKD491+W+vp1dpyDIDi1eQ
9ePW+U62cEGwNSRFFLKqpzGAUPRqGmhit8yD9J877lQjyDlFvrL3V2/7kF7WUmNg
CypFAneEOShQ1uSqqUApBP9MIgHh4/A6Y1rlZKJnVIvhqx+XJUQ34p1Xvbx3afMC
HLNuM7fOr7QZvAd56s5Fj05xFfCMiEHxjW3C+ps5RDc8/lmDVPw/FKwW/G7caAsh
AfvKOybhQAC4abEVNT9h48vQUXYAU9Bf0xJqzSYE9+RNObd8C3w=
=IjM5
-----END PGP SIGNATURE-----

These files seems to verify OK:



NOTE: I had to rename electrum-4.1.4.dmg.ThomasV.asc to electrum-4.1.4.dmg.asc so that Kleopatra would work properly

Okay so here's my issue. Bad news first  .  I'm not nearly as educated as I wish I was with all this stuff. However when I downloaded and named the signature file "electrum-4.1.4.dmg.asc" everything worked as normal in terms of verifying with regards to everything went just as it went with my previous times I've clicked on verify signature etc...I haven't proceeded with the actual install/upgrade yet as I first wanted to just thank you and BitMaxz for your help and time. Also if you have any ideas as to why this is happening I'd appreciate it and also look forward to understanding it more. I don't have a huge need for Electrum but I'd just know and to learn more. So thank you again and hopefully there is a reason why all of a sudden this update is requiring for such a change in things in the past. Cheers.

iBHK8

[HCP]

By default, the signature file (ie. the .asc file) needs to be: name_of_the_binary_file_being_checked.asc

That way, when you attempt to verify it, it will automatically, remove the .asc and then look for "name_of_the_binary_file_being_checked". ie. if your file is called "electrum-4.1.4.dmg", then the .asc file should be: "electrum-4.1.4.dmg.asc"

If it can't find that file, the process will generally error out.


However, for whatever reason, the Electrum peeps have decided to also include the name of person whose key was used to sign the file... ie. "name_of_the_binary_file_being_check.ThomasV.asc"

or, in this specific instance, "electrum-4.1.4.dmg.ThomasV.asc"

This causes problems because when the system then removes the .asc and goes looking for "electrum-4.1.4.dmg.ThomasV", it obviously doesn't exist... and it will not be able to automatically complete the verification.


TLDR: the .asc filename should be identical to the original binary with ONLY the .asc extension added for "automatic" verification to work.

[iBitcoinHongKong8]

By default, the signature file (ie. the .asc file) needs to be: name_of_the_binary_file_being_checked.asc

That way, when you attempt to verify it, it will automatically, remove the .asc and then look for "name_of_the_binary_file_being_checked". ie. if your file is called "electrum-4.1.4.dmg", then the .asc file should be: "electrum-4.1.4.dmg.asc"

If it can't find that file, the process will generally error out.


However, for whatever reason, the Electrum peeps have decided to also include the name of person whose key was used to sign the file... ie. "name_of_the_binary_file_being_check.ThomasV.asc"

or, in this specific instance, "electrum-4.1.4.dmg.ThomasV.asc"

This causes problems because when the system then removes the .asc and goes looking for "electrum-4.1.4.dmg.ThomasV", it obviously doesn't exist... and it will not be able to automatically complete the verification.


TLDR: the .asc filename should be identical to the original binary with ONLY the .asc extension added for "automatic" verification to work.

That makes perfect sense and looking back at my previous updates and copies in my Electrum folder I see exactly what you're saying as both the files are named the same like you described but yes for whatever reason this time when I grabbed the ThomasV file it was named differently. I went ahead and installed/updated and everything appears to be perfectly normal. Thanks so much for your help and time. Have a great weekend!

iBHK8

[khaled0111]

...

It's also important to note that both files have to be stored in the same directory. Otherwise, Kleopatra won't be able to automatically find the file you want to verify.
AFAIK, there is also an option which let's you specify the file you want to verify instead of looking for it automatically (by stripping the extention). This option is very useful when there are multiple signature files like in the case of Electrum (ThomasV.asc and sombernight_releasekey.asc)

[DireWolfM14]

TLDR: the .asc filename should be identical to the original binary with ONLY the .asc extension added for "automatic" verification to work.

It's also important to note that both files have to be stored in the same directory.

HCP and khaled0111 have explained the requirements for using automated verification, which (AFAIK) is the only way the graphical gpg programs work.  However, those restrictions can be overcome by using the command line interface.  In MacOS you'd use the terminal, or in Windows you can use PowerShell or a WSL instance.

For example:

Code:

gpg --verify C:\path\to\signature_file.asc C:\some\other\path\to\executable_file_with_a_different_name.exe