[GUIDE] How to Safely Download and Verify Electrum [Guide]

[DireWolfM14]

errors using above command:
gpg: can't open '/home/<username>/usr/bin/electrum-4.1.5-2-x86_64.AppImage.asc': No such file or directory
gpg: verify signatures failed: No such file or directory

The error seems rather clear; the signature file, which will have the .asc file extension isn't the directory ~/usr/bin.  Could it be in the /usr/bin directory instead?  Do you have the tilde (~) in your command by mistake?

Anyway, the easiest way to verify is the have the signature file in the same directory as the app image, then cd into that directory and run the following command:

Code:

gpg --verify ectrum-4.1.5-2-x86_64.AppImage.asc

Alternatively, you can verify with the files in two separate locations:

Code:

gpg --verify /path/to/ectrum-4.1.5-2-x86_64.AppImage.asc /different/path/to/ectrum-4.1.5-2-x86_64.AppImage

[2647s]

path:  /usr/bin directory  --doesn't exist.

how would you locate the correct path for the sig file?
the sig file gets automatically downloaded/installed together with electrum, right?

also the command was tried with/without (~)... neither work.

[DireWolfM14]

the sig file gets automatically downloaded/installed together with electrum, right?

No, it has to be downloaded separately.  If you downloaded the app image from the website, there's a link to the signature file just to the right of the link to download the app image. 

Otherwise, from the directory where the app image is:

Code:

wget https://download.electrum.org/4.1.5/electrum-4.1.5-x86_64.AppImage.asc

[2647s]

there seems to be a permissions issue for bin directory denying the sig file to be added there.
i'll have to try to get around this, or try your command for dual paths; i'll post the results tomorrow, thanks for helping!

[DireWolfM14]

there seems to be a permissions issue for bin directory denying the sig file to be added there.
i'll have to try to get around this, or try your command for dual paths; i'll post the results tomorrow, thanks for helping!

Try this:

Code:

sudo wget https://download.electrum.org/4.1.5/electrum-4.1.5-x86_64.AppImage.asc

You might have to enter your password.

[2647s]

no luck with that last command; that just downloaded the sig file somewhere, but not in the bin directory. I already have the sig file after you mentioned its a seperate download, i'll just have to force it into bin somehow or try that dual command; i'll post again tomorrow, thanks


it doesn't seem to work;
after managing to force the sig file into the same bin directory as electrum, and running the following command:
"gpg --verify /usr/bin/electrum-4.1.5-x86_64.AppImage.asc"

the following errors come up:
gpg: no signed data
gpg: can't hash datafile: No data

any clues?
-just to check, 'certifying' is completely optional & not necessary to verify, right?

[moderator's note: consecutive posts merged]

[m2017]

there seems to be a permissions issue for bin directory denying the sig file to be added there.
i'll have to try to get around this, or try your command for dual paths; i'll post the results tomorrow, thanks for helping!

Try this:

Code:

sudo wget https://download.electrum.org/4.1.5/electrum-4.1.5-x86_64.AppImage.asc

You might have to enter your password.

Do I understand correctly that if a new electrum update is released, then it is enough to replace the version in the code? For example, 4.1.5 by 4.2, 4.3 etc.
That is, the code will take the form:

Code:

sudo wget https://download.electrum.org/4.2.0/electrum-4.2.0-x86_64.AppImage.asc

[khaled0111]

Do I understand correctly that if a new electrum update is released, then it is enough to replace the version in the code? For example, 4.1.5 by 4.2, 4.3 etc.
That is, the code will take the form:

Code:

sudo wget https://download.electrum.org/4.2.0/electrum-4.2.0-x86_64.AppImage.asc

Most likely, but not necessarily.
They can give any name they want to the Electrum file and they can save it anywhere on the server. But, they probably won't in order to keep things organized and to maintain ease of access.
Just download the latest release directly from the website or copy its address from there and paste it in the command line.

[nc50lc]

That is, the code will take the form:

Code:

sudo wget https://download.electrum.org/4.2.0/electrum-4.2.0-x86_64.AppImage.asc

Based on the previous releases, they have been consistent with the files' naming scheme except on those that needed hardware compatibility like the apk files.
So it will work, but sometime in the future, it could change.

You can actually browse to download.electrum.org using your browser to see the available files.

[DireWolfM14]

I made some significant updates to the OP to include and address the recent changes made by the development team to the way they sign the releases.  I also thought it was appropriate to provide a signature of my own for the tutorial, just in case.

[NeoArkan]

Hello,

Thanks for this interesting post.

I am considering verify Electrum with your method. I have read carefully your tutorial but I still need to start the process.

I am a Mac user and I had several questions :
-I have already downloaded Electrum (from the original website : electrum.org) --> Do I have to uninstall Electrum and install it again after installing GPG, generate private key (I am not sure to understand the reason of the private key either) and Imprt ThomasV's PGP Key on MacOS ? Or I can verify Electrum while it's already on my MacOS ?
-For info, I am using the Electrum version 4.2.1

I had another question concerning :

"Import ThomasV's PGP Key on Mac OS
Download ThomasV's PGP Key from a trusted source.  If it's not already running, launch the GPG Keychain app, and click the import button.  Browse to the location where you saved the ThomasV.asc file, and select it."

Are these links are the trusted source for ThomasV's PGP key (in the beginning of your tutorial) :

"Redundant links to ThomasV's public key:
https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/ThomasV.asc
https://keys.openpgp.org/search?q=6694D8DE7BE8EE5631BED9502BD5824B7F9470E6
https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x6694d8de7be8ee5631bed9502bd5824b7f9470e6"

If yes. I have opened the first link and there is indeed a long public key BUT I have no idea how to download it in .asc format. (sorry I'm new in bitcoin AND also in MacOs). Can you explain ?

From first you, it's the only steps that are unclear for the moment.

Thanks for your help.

[DireWolfM14]

Hello,

Thanks for this interesting post.

I am considering verify Electrum with your method. I have read carefully your tutorial but I still need to start the process.

I am a Mac user and I had several questions :
-I have already downloaded Electrum (from the original website : electrum.org) --> Do I have to uninstall Electrum and install it again after installing GPG, generate private key (I am not sure to understand the reason of the private key either) and Imprt ThomasV's PGP Key on MacOS ? Or I can verify Electrum while it's already on my MacOS ?
-For info, I am using the Electrum version 4.2.1

The version of Electrum isn't important, the method I described works for v4.2.1 and should work for future releases as well.  You don't need to uninstall Electrum to verify the .dmg file.  You just need to download the .asc signature file associated with the .dmg file, save it into the same directory as the .dmg file, and then run the verification.  If it passes then you know the software you've already installed is authentic.  If it doesn't pass verification, then you should definitely purge the installation.  Personally, if the verification fails I would purge the entire system, but I'm paranoid.

I had another question concerning :

"Import ThomasV's PGP Key on Mac OS
Download ThomasV's PGP Key from a trusted source.  If it's not already running, launch the GPG Keychain app, and click the import button.  Browse to the location where you saved the ThomasV.asc file, and select it."

Are these links are the trusted source for ThomasV's PGP key (in the beginning of your tutorial) :

"Redundant links to ThomasV's public key:
https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/ThomasV.asc
https://keys.openpgp.org/search?q=6694D8DE7BE8EE5631BED9502BD5824B7F9470E6
https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x6694d8de7be8ee5631bed9502bd5824b7f9470e6"

If yes. I have opened the first link and there is indeed a long public key BUT I have no idea how to download it in .asc format. (sorry I'm new in bitcoin AND also in MacOs). Can you explain ?

From first you, it's the only steps that are unclear for the moment.

Thanks for your help.

Yes, those are trusted sources for ThomasV's key.  The easiest way to save the key is by copying the text from that first link, and pasting it into your favorite text editor.  You can then save it on your system with the name that you choose.  The name of the file isn't important, but remember where you saved it so that you can browse back to that location while importing into your GPG app.

[RickDeckard]

Yes, those are trusted sources for ThomasV's key.  The easiest way to save the key is by copying the text from that first link, and pasting it into your favorite text editor.  You can then save it on your system with the name that you choose.  The name of the file isn't important, but remember where you saved it so that you can browse back to that location while importing into your GPG app.

Besides the method provided by DireWolfM14 you can also highlight the link from ThomasV's key and press "CTRL" + Mouse click which should prompt the right click menu on Safari. Then just select the option "Save Link as..." and you'll be able to save directly the file/key (.asc) into a directory of your choosing.

[NeoArkan]

Hello,

Thank you for your quick answer.

I have still 2 questions for Thomas Key :
1. Do I copy all the text ? (including "Begin PGP Public key block" etc ...) Or only the key ?
2. I have tried with TextEdit on Mac BUT when I try to save I don't see the .asc extension. There are .txt, .html, RTF, .docx, .doc, .odt ...
But NOT .asc. There is also "Document d'archive web" and I have saved on doc with it but I don't think that it is and I don't see the extension on the doc ...

Please can you help ?

[BlackHatCoiner]

1. Do I copy all the text ? (including "Begin PGP Public key block" etc ...) Or only the key ?

You copy all the text. Actually, you don't need to copy it at all, just save it as a .asc file.

2. I have tried with TextEdit on Mac BUT when I try to save I don't see the .asc extension.

You can save it as a .txt, if it doesn't allow you directly as .asc, but it should be trivial to change it to .asc later. In the directory you've saved it, doesn't it show you the file extensions? If not, check: https://duckduckgo.com/?q=mac+show+file+extension

[NeoArkan]

1. Do I copy all the text ? (including "Begin PGP Public key block" etc ...) Or only the key ?

You copy all the text. Actually, you don't need to copy it at all, just save it as a .asc file.

2. I have tried with TextEdit on Mac BUT when I try to save I don't see the .asc extension.

You can save it as a .txt, if it doesn't allow you directly as .asc, but it should be trivial to change it to .asc later. In the directory you've saved it, doesn't it show you the file extensions? If not, check: https://duckduckgo.com/?q=mac+show+file+extension

1) I am able to save it (From File>Save as ...) in .txt but not in .asc (you seem to say that it's possible to direct convert in asc. for the link but I don't see the option. Am I wrong somewhere ?
2) I have made my search on internet. To convert a .txt fil in .asc it needs to download again a new software. Do you know which one I can trust (if possible available in the App Store) ?
3) I am wondering in using this tutorial if the solution for verifying Electrum is really good. Indeed, to verify Electrum, I need to download others softwares (PGP and the soft for converting txt into asc). However, how can I be sure that PGP and other are secure and not full of malware. I should also verify PGP and Co. And it's becoming an infinite circle ... What do you think ?

 

[BlackHatCoiner]

1) I am able to save it (From File>Save as ...) in .txt but not in .asc (you seem to say that it's possible to direct convert in asc. for the link but I don't see the option. Am I wrong somewhere ?

Choose Finder > Preferences > Advanced. Now you can check "Show all filename extensions." if it isn't already checked. Now go to the directory you've saved your .txt file and rename it to <any_name>.asc.

To convert a .txt fil in .asc it needs to download again a new software.

There's no need to download any software for this. It's as simple as renaming a file.

[NeoArkan]

1) I am able to save it (From File>Save as ...) in .txt but not in .asc (you seem to say that it's possible to direct convert in asc. for the link but I don't see the option. Am I wrong somewhere ?

Choose Finder > Preferences > Advanced. Now you can check "Show all filename extensions." if it isn't already checked. Now go to the directory you've saved your .txt file and rename it to <any_name>.asc.

To convert a .txt fil in .asc it needs to download again a new software.

There's no need to download any software for this. It's as simple as renaming a file.

Indeed that was super easy (However I needed the explanation so thanks a lot)
I am not sure 100% that it works because I can't open the file  (.asc) but I guess it's normal because GPG is not installed yet.

[BlackHatCoiner]

I am not sure 100% that it works because I can't open the file  (.asc) but I guess it's normal because GPG is not installed yet.

Yes, you should first install GPG and then open the file with it.

[NeoArkan]

I have completed it and the signature is verified. So good news Electrum software seems good!

For DireWolf, one complementary info for the tutorial :
-They ask me to create a "secret" sentence (I don't remember in which step sorry but it wasn't in the tutorial I think. except this, the tutorial was gratand really well explained)

Thanks for the help of everyone.