[GUIDE] How to Safely Download and Verify Electrum [Guide]

[Sidney986]

Yes, it serves as two functions but all in a single file which is usable by OpenKeyChain.

Thanks for the link to spesmilo. 

[vfilchef]

I downloaded Thomas Voegtlin's certificate, but Kleopatra cannot certify it. It gives me the error
 "An error occurred while attempting to verify Thomas Voegtlin (https://electrum.org) (7F9470E6): Invalid digest algorithm."

[nc50lc]

"An error occurred while attempting to verify Thomas Voegtlin (https://electrum.org) (7F9470E6): Invalid digest algorithm."

That's rare... the Key-ID looks fine but where did you downloaded the pubkey?
How about GPG, have you downloaded the latest version from the legit source or is it preinstalled in your system?
Try to get everything to the latest version, then retry.

For reference, here's a reliable source of their public keys: github.com/spesmilo/electrum/tree/master/pubkeys

[vfilchef]

"An error occurred while attempting to verify Thomas Voegtlin (https://electrum.org) (7F9470E6): Invalid digest algorithm."

That's rare... the Key-ID looks fine but where did you downloaded the pubkey?
How about GPG, have you downloaded the latest version from the legit source or is it preinstalled in your system?
Try to get everything to the latest version, then retry.

For reference, here's a reliable source of their public keys: github.com/spesmilo/electrum/tree/master/pubkeys

The problem was with my PGP keys.
They were very old, from 2013. I deleted the old ones and created two new keys, and I was able to verify Thomas Voegtlin's public key.

[nc50lc]

-snip-
Try to get everything to the latest version, then retry.

The problem was with my PGP keys.
They were very old, from 2013. I deleted the old ones and created two new keys, and I was able to verify Thomas Voegtlin's public key.

That checks out.
It's "rare" since it's mostly caused by keys with the old SHA1 digest which shouldn't occur nowadays.

This is why I instructed to update or look for updated keys, turns out, it's you keys that's old.

[PoseidonMoe]

Thank you for your hard work, I really benefited from your guide! The step-by-step instructions made everything so clear and easy to follow

[DireWolfM14]

Today I updated my GPG key that's staked here on the forum, so I'm providing a new signature for the OP.

Instructions on how to verify the OP are included in the second post in this thread:
https://bitcointalk.org/index.php?topic=5240594.msg54223765#msg54223765

Code:

-----BEGIN PGP SIGNATURE-----

iJEEABYKADkWIQSDKQOwpoQIzXtHg5etMmUFuYeFVAUCaaTAaxsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwyLDEACgkQrTJlBbmHhVSHEgEAisDJoucB+FA2wz77QPE+
tH90Yhj9hlXWDlIfzVqyZ74BAMT6onrNOm9PmNYWTKkR52cEWJ/kMcrJC/p3z5D3
I08A
=vccM
-----END PGP SIGNATURE-----

GPG key staked here.

Here's the old signature for archival reference:

Code:

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEE5uCk8qpATL256qefg7ozyN3KpUcFAmPURNEACgkQg7ozyN3K
pUfxtg//WiYnADw/JA7jvyeVanOBO/9XMaDcz1iNIEzLnCgIxPkKEcFLSA7484Hc
5EtRU92gzaNLtyyEBnHgigYFLyZ1vl6SZmn9VYhgRgnD6xEA+pudTGE6SkovOheR
8tpx4zCTB9WPYCUOFnwpRHAzBVvh2IiinSvut8DvW3UIVirslfnbk5NDzBlmPR+b
Rc+fCruYf21p+YUFOMmvkdOofRpUSZgMna5DsXCZrSSeRF6apjJpBez5zd0mEad+
9Lxv6DjFLNjG87cF3A2dcNSfuCL2tUD/QTaqbx4a0g+8p0CH9pkfN2k2HH7xbOry
UmdDOG+r8IckUKzK71fEhs0Vpk+EoiPYbtsSMDWx8ssd60qbXRM5XRGi6jdUOH7v
LxM0P6fw/iH3bFDMefMtAlzlGbMirQkbsxOf6AGoa8AoXNeezNjWfoWO8pD71cMS
tKVc6QGrgHH4BCswarGhP/k8ReUYtk6lKhr6qsOVfQqIvvpApzsoDwo3UkAlUG3y
j62EbYfhxCDTT8k7Qz2FjkRHaMus90QJZhuapZZIqCEX+LmMCEADw/vSA5n64qY4
H1KL9oGN8ldU5+So3poKV/fN5TTumVmURq9yjvPJJccSmq+immXFPeaNQZlcsKqR
5Z5pWfLuNlDXoTP5/nrSiUFf5sJXiv+EZrEG/MoNTuny4dy55GU=
=iya1
-----END PGP SIGNATURE-----

GPG key staked here.