0

I'm having difficulty GPG-verifying my offline Armory installer for Ubuntu, using the suggested steps:

$ cd Downloads # the directory containing the *.deb
$ gpg --recv-keys --keyserver keyserver.ubuntu.com 98832223
$ sudo apt-get install dpkg-sig
$ dpkg-sig --verify *.deb

The first three steps are working, since I can verify the standard Ubuntu installer:

ubuntu@ubuntu:~/Downloads$ dpkg-sig --verify *.deb Processing armory_0.92.3_ubuntu-32bit.deb... GOODSIG _gpgbuilder 821F122936BDD565366AC36A4AB16AEA98832223 1412393663

But for the offline bundle I just get this:

ubuntu@ubuntu:~/Downloads$ dpkg-sig --verify *.deb
E: Cannot find *.deb: no such file
ubuntu@ubuntu:~/Downloads$ ls
Alan-C.-Reiner-Offline-Signing-Key-alan@bitcoinarmory.com-0x98832223-pub.asc
armory_0.92.3_offline_ubuntu_12.04-32.tar.gz

So I extracted the .tar.gz and cd OfflineBundle, which gives me these files:

ubuntu@ubuntu:~/Downloads/OfflineBundle$ ls
Alan-C.-Reiner-Offline-Signing-Key-alan@bitcoinarmory.com-0x98832223-pub.asc
armory_0.92.3_ubuntu-32bit.deb      
dpkg-sig_0.13.1_all.deb
Install_DoubleClick_RunInTerminal.sh
libqt4-designer_4.8.1-0ubuntu4.8_i386.deb
libqt4-help_4.8.1-0ubuntu4.8_i386.deb
libqt4-scripttools_4.8.1-0ubuntu4.8_i386.deb
libqt4-test_4.8.1-0ubuntu4.8_i386.deb
libqtassistantclient4_4.6.3-3ubuntu2_i386.deb
libqtwebkit4_2.2.1-1ubuntu4_i386.deb
python-psutil_0.4.1-1ubuntu1_i386.deb
python-pyasn1_0.0.11a-1ubuntu1_all.deb
python-qt4_4.9.1-2ubuntu1_i386.deb
python-sip_4.13.2-1_i386.deb
python-twisted_11.1.0-1ubuntu2_all.deb
python-twisted-conch_11.1.0-1_all.deb
python-twisted-lore_11.1.0-1_all.deb
python-twisted-mail_11.1.0-1_all.deb
python-twisted-news_11.1.0-1_all.deb
python-twisted-runner_11.1.0-1_i386.deb
python-twisted-words_11.1.0-1_all.deb

I'm pretty sure it's armory_0.92.3_ubuntu-32bit.deb that is the file that should have the GOODSIG after it, but when I run dpkg-sig --verify *.deb, I just get this:

Processing armory_0.92.3_ubuntu-32bit.deb...
Processing dpkg-sig_0.13.1_all.deb...
Processing libqt4-designer_4.8.1-0ubuntu4.8_i386.deb...
Processing libqt4-help_4.8.1-0ubuntu4.8_i386.deb...
Processing libqt4-scripttools_4.8.1-0ubuntu4.8_i386.deb...
Processing libqt4-test_4.8.1-0ubuntu4.8_i386.deb...
Processing libqtassistantclient4_4.6.3-3ubuntu2_i386.deb...
Processing libqtwebkit4_2.2.1-1ubuntu4_i386.deb...
Processing python-psutil_0.4.1-1ubuntu1_i386.deb...
Processing python-pyasn1_0.0.11a-1ubuntu1_all.deb...
Processing python-qt4_4.9.1-2ubuntu1_i386.deb...
Processing python-sip_4.13.2-1_i386.deb...
Processing python-twisted_11.1.0-1ubuntu2_all.deb...
Processing python-twisted-conch_11.1.0-1_all.deb...
Processing python-twisted-lore_11.1.0-1_all.deb...
Processing python-twisted-mail_11.1.0-1_all.deb...
Processing python-twisted-news_11.1.0-1_all.deb...
Processing python-twisted-runner_11.1.0-1_i386.deb...
Processing python-twisted-words_11.1.0-1_all.deb...

Am I missing something? What should I do? I'm almost tempted to just replace the armory_0.92.3_ubuntu-32bit.deb file that came in the offline bundle with the one that came with the standard armory installer, but I'm worried that the rest of the files in OfflineBundle may have been tampered with as well.

1

The offline bundle actually doesn't have a signature inside the deb file. You can see this by extracting the bundle as you did:

$ tar xvzf armory_0.92.3_offline_ubuntu_12.04-32.tar.gz

Now you can check the contents of the .deb file

$ cd OfflineBundle
$ ar vx armory_0.92.3_ubuntu-32bit.deb
x - debian-binary
x - control.tar.gz
x - data.tar.gz

If you download the armory_0.92.3_ubuntu-32.deb file directly, you can see that it's a little different

$ wget https://s3.amazonaws.com/bitcoinarmory-releases/armory_0.92.3_ubuntu-32bit.deb
$ ar vx armory_0.92.3_ubuntu-32bit.deb
x - debian-binary
x - control.tar.gz
x - data.tar.gz
x - _gpgbuilder
$ dpkg-sig --verify armory_0.92.3_ubuntu-32bit.deb 
Processing armory_0.92.3_ubuntu-32bit.deb...
GOODSIG _gpgbuilder 821F122936BDD565366AC36A4AB16AEA98832223 1412393663

dpkg-sig needs the _gpgbuilder file to check the signature against the contents of the package. The Offline package doesn't have this file while the direct download does.

I would suggest you grab the direct download and place that file in the OfflineBundle directory after verifying the signature if you're concerned about some sort of man-in-the-middle attack.

  • Is there a more secure way to download all the Python and other files as well? Wouldn't it be possible for those files to have been tampered with? Thanks! – RootFAIL Feb 2 '15 at 16:41
  • 1
    Sadly, the authors of all the other packages may or may not sign them. You'll have to download those directly if they do and verify them some other way if they don't. – Jimmy Song Feb 2 '15 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.