Armory - Discussion Thread

[molecular]

Is there a config option or cmd-line option to "not show splash screen"?

It annoys the hell out of me because it covers my stuff and can neither be moved nor closed (using weird window manager).

[etotheipi]

---------

Bugfixes Bugfixes Bugfixes
Version 0.82.4-alpha

Three fixes:  Network fix (already in 0.82.3), URL handling, and some issues with the send & receive buttons on the main window.

Also:  I'm testing signing the installers again with my offline GPG key.  Please test it -- details at the bottom of this post!


http://dl.dropbox.com/u/1139081/ArmoryTestingReleases/armory_0.82.4-alpha_win32_and_win64.msi
http://dl.dropbox.com/u/1139081/ArmoryTestingReleases/armory_0.82.4-1_amd64.deb
http://dl.dropbox.com/u/1139081/ArmoryTestingReleases/armory_0.82.4-1_i386.deb

I'm continuing to get reports of strange behaviors in Windows.  Perhaps the Win32 version doesn't actually work as well on Windows 64-bit...?  If you are currently using an old 64-bit version and it does work, then please try this one for me.  I need some empirical evidence to suggest whether this is a good or bad idea!



You should be able to verify the following signature with the Armory Signing Key (98832223) (which should also be distributed to the major key servers by now, so you don't have to trust a forum link if you don't want to):

The signed MD5 hashes are below: or download it directly, here

Code:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

213c76e709c5cb6e80980a6f7bd4dca0  armory_0.82.4-1_amd64.deb
9602fd85514b247d55bc6c19f076860f  armory_0.82.4-1_i386.deb
e3fa56fee145986bace4f51199778005  armory_0.82.4-alpha_win32_and_win64.msi
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQIcBAEBAgAGBQJQQlolAAoJEEqxauqYgyIjsFEP/36qGu0/ZbBFt8nQc3XBVDnp
8p1lwrsN/LYTz7l9j4Oe1xMWJDJ68XkZdjgRZP1Gg6PuzKF4PFJUL/d6NCamH3fU
gZdE/Ald0LUvsJQPx44hQ0qPWacm4S82ewXYkvlHlOPKoWy+8iRIUp6VkOc4hawD
n/BMSipZNRnliFl8zOR9mzuUrX/pxj649oLG4ShaglmkwHFSgAkTtnjuaeMzZrQ9
5WyvxvXOT8KshRhx21FSGCQhHa8kk8vmb0iBmJTK77nX2aw61t8F5nA+JYMhZ3Xa
5mW+zruI35ehYSyN/EKZXoJd0E0bDeLlK46xvc8dsnlY+ZORoXuuXrS58Bl11/k5
zzMEF5Me/QofzhJR9dxNSevF1rvM5PfKi6NHUNZESc3zg6UNsrTedq/wkBemR+h3
vGp8QIXwwNBN+tUEQjkFtjqLyNV2uhg2RAWF7/Yo3kL9LGyZxLt9hL153gOzQYtj
gKYojbYcWzOEEUunLrWleflcbwglwmkpbUpqSowlHNzoj+kQ/zfFUeBs4JkfjLqz
mGwVfMVuuMutsBkNiUmaqOpYz0GLr6yTHfNQhXAIgegvT2nh+rTUyd+EgMc9+PYL
oA/nns74eZVghcvAE2nkk7L9AOQYzaq67KVHOpAMzq5wKY3qVKqNftS1nhosUGYB
PujNNBO6XjEIJzqDOfrv
=lX01
-----END PGP SIGNATURE-----

~ArmoryTestingReleases $ dpkg-sig --verify *.deb
Processing armory_0.82.4-1_amd64.deb...
GOODSIG _gpgbuilder 821F122936BDD565366AC36A4AB16AEA98832223 1346525528
Processing armory_0.82.4-1_i386.deb...
GOODSIG _gpgbuilder 821F122936BDD565366AC36A4AB16AEA98832223 1346525533

~ArmoryTestingReleases $ gpg --verify version_0.82.4.md5.asc
gpg: Signature made Sat 01 Sep 2012 02:55:33 PM EDT using RSA key ID 98832223
gpg: Good signature from "Alan C. Reiner (Armory Signing Key) <alan.reiner@gmail.com>"
Primary key fingerprint: 821F 1229 36BD D565 366A  C36A 4AB1 6AEA 9883 2223

[etotheipi]

Is there a config option or cmd-line option to "not show splash screen"?

It annoys the hell out of me because it covers my stuff and can neither be moved nor closed (using weird window manager).

No there is not, but fear not, the next major release (with multi-threading) will do away with the splash screen completely!  I'm just finishing butchering the code base to get the multi-threading code implemented.  There will be lots of testing, but hopefully only another week or two before it's done. 

[molecular]

Is there a config option or cmd-line option to "not show splash screen"?

It annoys the hell out of me because it covers my stuff and can neither be moved nor closed (using weird window manager).

No there is not, but fear not, the next major release (with multi-threading) will do away with the splash screen completely!  I'm just finishing butchering the code base to get the multi-threading code implemented.  There will be lots of testing, but hopefully only another week or two before it's done. 

awesome! btw: last git pull I did (after about 6 weeks of abstinence) was the first one that didn't get me into any kind of trouble regarding being able to run Armory. Before I had all kinds of issues after updates about 2 or 3 times. Thanks for making things more smooth over time.

[etotheipi]

Is there a config option or cmd-line option to "not show splash screen"?

It annoys the hell out of me because it covers my stuff and can neither be moved nor closed (using weird window manager).

No there is not, but fear not, the next major release (with multi-threading) will do away with the splash screen completely!  I'm just finishing butchering the code base to get the multi-threading code implemented.  There will be lots of testing, but hopefully only another week or two before it's done.  

awesome! btw: last git pull I did (after about 6 weeks of abstinence) was the first one that didn't get me into any kind of trouble regarding being able to run Armory. Before I had all kinds of issues after updates about 2 or 3 times. Thanks for making things more smooth over time.

Fwhew!  Please don't hesitate to tell me if things are working, since I usually only hear when things are not working, and get stressed out that Armory is falling apart!  So, thanks Molec!

[etotheipi]

I finally got 64-bit Windows VM back up.  I can now compile 64-bit apps again.  However, I'd like to keep all Windows users using 32-bit, if it doesn't cause problems...

Windows users:  please use the 32-bit version unless you have problems with it.  If you experience an issue with the 32-bit version on 64-bit windows, please install the 64-bit version only to check whether the problem goes away.  If the problem goes away, please report it here, and I will go back to making separate versions for 32- and 64-bit windows.

http://dl.dropbox.com/u/1139081/ArmoryTestingReleases/armory_0.82.4-alpha_win64.msi

[etotheipi]

Someone just asked me how to verify the digital signatures on the above packages.  

I don't know how to do this in Windows without installing bloat-y software.  But it's built-in, in Linux, and it's quite easy.  And once you have the Armory public key downloaded and imported to your offline computer, it's one command to verify the signatures.  

NOTE: if someone knows how to "build-in" a GPG signature into a Windows installer (*.msi file), that would be great.  For now, I'm just signing the hash of the .msi file.


Use linux to verify the authenticity of the Armory installers you download

• (1) Download the Armory Signing Public Key.  It can also be retrieved via a public key server.  Just search for "Armory" and you will find it.
• (2) Download the installers you want to verify (links at the bottom of this post).  You only need the md5.asc file (signed MD5 hashes) if you want to verify the Windows installer
• (3) Put all the downloaded files onto a USB and take to your offline linux computer (skip this step if you're already in Linux!)
• (4) Go to Applications-->Accessories-->"Passwords and Encryption Keys".  Go to File-->Import....  Select the Alan_C_Reiner_ArmorySigningPublic.asc
• (5) VERIFY THE KEY ID: Once the key is imported, click the "Other Keys" tab.  You should see:  Alan C. Reiner alan.reiner@gmail.com 'Armory Signing Key' | 98832223 .   Do not continue if it does have 98832223! (backwards, that is 32223889)

Now the key is imported and you can skip the previous steps on future releases.  Here's how to verify the *.deb files:

(1) Open a terminal, and navigate to the USB key where the installers are located (probably /media/usbkey or something like that)
(2) To verify the *.deb files, type "dpkg-sig --verify *.deb".  You should see something like this:

/media/usbkey$ dpkg-sig --verify *.deb
Processing armory_0.82.4-1_amd64.deb...
GOODSIG _gpgbuilder 821F122936BDD565366AC36A4AB16AEA98832223 1346525528
Processing armory_0.82.4-1_i386.deb...
GOODSIG _gpgbuilder 821F122936BDD565366AC36A4AB16AEA98832223 1346525533

The "GOODSIG" is all you need!  To verify the windows MD5 hash file, you use regular GPG:

/media/usbkey$ gpg --verify version_0.82.4.md5.asc
gpg: Signature made Sat 01 Sep 2012 02:55:33 PM EDT using RSA key ID 98832223
gpg: Good signature from "Alan C. Reiner (Armory Signing Key) <alan.reiner@gmail.com>"
Primary key fingerprint: 821F 1229 36BD D565 366A  C36A 4AB1 6AEA 9883 2223

The MD5 file is now confirmed to be legitimate.  The last thing is to make sure the .msi file has the same hash as is listed in the .md5.asc we just verified:

/media/usbkey$ md5sum *.msi
e3fa56fee145986bace4f51199778005  armory_0.82.4-alpha_win32_and_win64.msi

If you open the md5.asc file, you will see the hashes for each of the files:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

213c76e709c5cb6e80980a6f7bd4dca0  armory_0.82.4-1_amd64.deb
9602fd85514b247d55bc6c19f076860f  armory_0.82.4-1_i386.deb
e3fa56fee145986bace4f51199778005  armory_0.82.4-alpha_win32_and_win64.msi
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQIcBAEBAgAGBQJQQlolAAoJEEqxauqYgyIjsFEP/36qGu0/ZbBFt8nQc3XBVDnp
...
-----END PGP SIGNATURE-----

Here's the download links:
http://dl.dropbox.com/u/1139081/ArmoryTestingReleases/armory_0.82.4-alpha_win32_and_win64.msi
http://dl.dropbox.com/u/1139081/ArmoryTestingReleases/armory_0.82.4-1_amd64.deb
http://dl.dropbox.com/u/1139081/ArmoryTestingReleases/armory_0.82.4-1_i386.deb
Signed MD5 hashes (mainly for Windows; the *.deb files have the signatures built-in)

[2112]

NOTE: if someone knows how to "build-in" a GPG signature into a Windows installer (*.msi file), that would be great.

You can't build-in a GPG signature into anything since they always sign the whole object. The political disconnect between GPG and the commercial software vendors is too high. You need to spend money on a code signing certificate. Since you aren't signing a kernel-level driver you can go for the cheapest ones.

Here's the link to some random blog that has a sensible discussion, links and prices in the comments:

http://www.wintellect.com/cs/blogs/jrobbins/archive/2007/12/21/code-signing-it-s-cheaper-and-easier-than-you-thought.aspx

[etotheipi]

NOTE: if someone knows how to "build-in" a GPG signature into a Windows installer (*.msi file), that would be great.

You can't build-in a GPG signature into anything since they always sign the whole object. The political disconnect between GPG and the commercial software vendors is too high. You need to spend money on a code signing certificate. Since you aren't signing a kernel-level driver you can go for the cheapest ones.

Here's the link to some random blog that has a sensible discussion, links and prices in the comments:

http://www.wintellect.com/cs/blogs/jrobbins/archive/2007/12/21/code-signing-it-s-cheaper-and-easier-than-you-thought.aspx

Ahh, perfect.  I should've known that GPG keys were not "accepted" in the MS world.

The blog article you linked is old, but it is good discussion.  There's definitely no more $80/yr special, it looks like $180/yr to get a signing certificate.  It's probably worth swallowing my pride, and paying into the system and move on with life.  After all, I did receive a lot of donations, I guess this is an appropriate thing to spend that on

I wonder if I can generate my own certificate, offline, and send them the public key to sign...?  Do you know if they always generate the full key for you?  I'd prefer that no one else has the private key, but maybe that's a level of service I can't expect at the <$200/yr level.

[ErebusBat]

I wonder if I can generate my own certificate, offline, and send them the public key to sign...?  Do you know if they always generate the full key for you?  I'd prefer that no one else has the private key, but maybe that's a level of service I can't expect at the <$200/yr level.

I believe that code signing certificates are no different technically from SSL certs, other than a special bit that says it is a code signing cert.

In others words: I see no reason why the CSR would be any different.

[Raoul Duke]

Startssl.com may be what you're looking for. You can sign code with their level 2 certs which cost $60 for unlimited certs for 2 years.
https://www.startssl.com/?app=2
https://www.startssl.com/?app=25#60
https://forum.startcom.org/viewtopic.php?f=15&t=1654

[FiloSottile]

I got Armory running on the Raspberry Pi. This might be really useful for inexpensive, secure offline wallets.

https://i.imgur.com/IaAHAl.jpg


All the instructions/files here
https://gist.github.com/3646033

[etotheipi]

I got Armory running on the Raspberry Pi. This might be really useful for inexpensive, secure offline wallets.

...

Fantastic!  This is one step up for those users who want offline wallets, but can't find an old laptop, or don't want to deal with an old laptop ... $35 for a RaspberryPi is pretty awesome.  Plus, it might be fun to mess around with it (for some of us ).  However, my understanding is that supply is limited, so it may be many weeks before new customers can get their hands on one...

On a slightly-related note, I just got a request about improving USB security on offline linux machines.  I don't know what window manager is used by default on the RPi, but I bet the process is similar.  I posted a starter discussion about it in the "Improving offline wallets" thread.  Any extra recommendations are welcome!

Also:  thanks for the patch and instructions, Filo!  It looks like it will be fairly easy to integrate most of the updates directly into the project.

[flipperfish]

Two things:

• It would be nice to let the user choose the install location in the windows installer. (This is how it's mostly done in Windows. There are no hard default file locations like in most linux-distros.)
• If the 64-bit version for Windows is only for testing, it would be nice to tag it accordingly at the donwload page (http://bitcoinarmory.com/index.php/get-armory)

[chrisrico]

However, my understanding is that supply is limited, so it may be many weeks before new customers can get their hands on one...

Newark seems to have at least 100 to ship today. I just purchased one, we'll see how it goes...

I also purchased on on BitMit, but that's from Germany and who knows when it will ship... Want to have my bases covered.

[etotheipi]

Two things:

• It would be nice to let the user choose the install location in the windows installer. (This is how it's mostly done in Windows. There are no hard default file locations like in most linux-distros.)
• If the 64-bit version for Windows is only for testing, it would be nice to tag it accordingly at the donwload page (http://bitcoinarmory.com/index.php/get-armory)

(1) Of course it's possible to do this, but I never figured it out using the MSI-creator program I'm using (War Setup).  It can't be hard, I just have to dig through the options.  I'll add that to my list of things to look into next time I'm waiting for something to compile.

(2) The 64-bit version is not a testing version.  It's part of the official release.  In the past, Armory didn't work on 32-bit OS except for offline mode, so I always compiled two different versions.  Only recently did I realize that the 32-bit version (which now works online, too) works on 64-bit Windows, so why bother compiling them separately anymore?  I was asking users to help me test the 32-bit version in 64-bit Windows to make sure that there was no surprises.  In the near term, though, I will continue compiling both for official releases, until I am sure that there is no issues running the 32-bit version on 64-bit OS.

[dellech]

I am trying to build Armory from source (linux openSUSE 12.2, 32bit) and have a problem making Swig - it requires a static libpython which I do not have on my system ... libpython.2.7.so exists, but no static library ... is it possible to link dynamically ?

[etotheipi]

I am trying to build Armory from source (linux openSUSE 12.2, 32bit) and have a problem making Swig - it requires a static libpython which I do not have on my system ... libpython.2.7.so exists, but no static library ... is it possible to link dynamically ?

It is, and people do it.  I keep forgetting to go into the Makefile and try to figure out how to auto-detect this situation to avoid these problems.

For now, I believe you can just change any libpython2.X.a to libpython2.X.so in the Makefile.  I think that's what other non-Ubuntu compilers have been doing.

And before you ask why I'm static compiling:  it's because the compiled swig module depends on the version of python being used at runtime.  If I compile the .deb packages to distribute to users with dynamic python linking, then it only works for users that have the same version of python on their system.  This caused endless problems in the past.  However, for compiling it for yourself, it doesn't matter. 

[flipperfish]

(2) The 64-bit version is not a testing version.  It's part of the official release.  In the past, Armory didn't work on 32-bit OS except for offline mode, so I always compiled two different versions.  Only recently did I realize that the 32-bit version (which now works online, too) works on 64-bit Windows, so why bother compiling them separately anymore?  I was asking users to help me test the 32-bit version in 64-bit Windows to make sure that there was no surprises.  In the near term, though, I will continue compiling both for official releases, until I am sure that there is no issues running the 32-bit version on 64-bit OS.

Ah, I see. Sorry, I totally misunderstood your last posts about this topic. As I installed the 32 bit version now, I will continue to use it (on 64 Bit Windows). If some issues occur I will report.

[dellech]

I am trying to build Armory from source (linux openSUSE 12.2, 32bit) and have a problem making Swig - it requires a static libpython which I do not have on my system ... libpython.2.7.so exists, but no static library ... is it possible to link dynamically ?

It is, and people do it.  I keep forgetting to go into the Makefile and try to figure out how to auto-detect this situation to avoid these problems.

For now, I believe you can just change any libpython2.X.a to libpython2.X.so in the Makefile.  I think that's what other non-Ubuntu compilers have been doing.

And before you ask why I'm static compiling:  it's because the compiled swig module depends on the version of python being used at runtime.  If I compile the .deb packages to distribute to users with dynamic python linking, then it only works for users that have the same version of python on their system.  This caused endless problems in the past.  However, for compiling it for yourself, it doesn't matter. 

wow that was simple    I changed the assignment of STATICPYTHON to .so and now Armory runs offline on a bootable USB stick that has never seen a network - and I created my first wallet !

next step will be recompiling the kernel to get rid of all network and bluetooth modules to be safe when booting on a machine with a network connection ....

many thanks for the help