Verify Offline Bitcoin Bundle on Ubuntu

Question

I'm having difficulty GPG-verifying my offline Armory installer for Ubuntu, using the suggested steps:

$ cd Downloads # the directory containing the *.deb
$ gpg --recv-keys --keyserver keyserver.ubuntu.com 98832223
$ sudo apt-get install dpkg-sig
$ dpkg-sig --verify *.deb

The first three steps are working, since I can verify the standard Ubuntu installer:

ubuntu@ubuntu:~/Downloads$ dpkg-sig --verify *.deb Processing armory_0.92.3_ubuntu-32bit.deb... GOODSIG _gpgbuilder 821F122936BDD565366AC36A4AB16AEA98832223 1412393663

But for the offline bundle I just get this:

ubuntu@ubuntu:~/Downloads$ dpkg-sig --verify *.deb
E: Cannot find *.deb: no such file
ubuntu@ubuntu:~/Downloads$ ls
Alan-C.-Reiner-Offline-Signing-Key-alan@bitcoinarmory.com-0x98832223-pub.asc
armory_0.92.3_offline_ubuntu_12.04-32.tar.gz

So I extracted the .tar.gz and cd OfflineBundle, which gives me these files:

ubuntu@ubuntu:~/Downloads/OfflineBundle$ ls
Alan-C.-Reiner-Offline-Signing-Key-alan@bitcoinarmory.com-0x98832223-pub.asc
armory_0.92.3_ubuntu-32bit.deb      
dpkg-sig_0.13.1_all.deb
Install_DoubleClick_RunInTerminal.sh
libqt4-designer_4.8.1-0ubuntu4.8_i386.deb
libqt4-help_4.8.1-0ubuntu4.8_i386.deb
libqt4-scripttools_4.8.1-0ubuntu4.8_i386.deb
libqt4-test_4.8.1-0ubuntu4.8_i386.deb
libqtassistantclient4_4.6.3-3ubuntu2_i386.deb
libqtwebkit4_2.2.1-1ubuntu4_i386.deb
python-psutil_0.4.1-1ubuntu1_i386.deb
python-pyasn1_0.0.11a-1ubuntu1_all.deb
python-qt4_4.9.1-2ubuntu1_i386.deb
python-sip_4.13.2-1_i386.deb
python-twisted_11.1.0-1ubuntu2_all.deb
python-twisted-conch_11.1.0-1_all.deb
python-twisted-lore_11.1.0-1_all.deb
python-twisted-mail_11.1.0-1_all.deb
python-twisted-news_11.1.0-1_all.deb
python-twisted-runner_11.1.0-1_i386.deb
python-twisted-words_11.1.0-1_all.deb

I'm pretty sure it's armory_0.92.3_ubuntu-32bit.deb that is the file that should have the GOODSIG after it, but when I run dpkg-sig --verify *.deb, I just get this:

Processing armory_0.92.3_ubuntu-32bit.deb...
Processing dpkg-sig_0.13.1_all.deb...
Processing libqt4-designer_4.8.1-0ubuntu4.8_i386.deb...
Processing libqt4-help_4.8.1-0ubuntu4.8_i386.deb...
Processing libqt4-scripttools_4.8.1-0ubuntu4.8_i386.deb...
Processing libqt4-test_4.8.1-0ubuntu4.8_i386.deb...
Processing libqtassistantclient4_4.6.3-3ubuntu2_i386.deb...
Processing libqtwebkit4_2.2.1-1ubuntu4_i386.deb...
Processing python-psutil_0.4.1-1ubuntu1_i386.deb...
Processing python-pyasn1_0.0.11a-1ubuntu1_all.deb...
Processing python-qt4_4.9.1-2ubuntu1_i386.deb...
Processing python-sip_4.13.2-1_i386.deb...
Processing python-twisted_11.1.0-1ubuntu2_all.deb...
Processing python-twisted-conch_11.1.0-1_all.deb...
Processing python-twisted-lore_11.1.0-1_all.deb...
Processing python-twisted-mail_11.1.0-1_all.deb...
Processing python-twisted-news_11.1.0-1_all.deb...
Processing python-twisted-runner_11.1.0-1_i386.deb...
Processing python-twisted-words_11.1.0-1_all.deb...

Am I missing something? What should I do? I'm almost tempted to just replace the armory_0.92.3_ubuntu-32bit.deb file that came in the offline bundle with the one that came with the standard armory installer, but I'm worried that the rest of the files in OfflineBundle may have been tampered with as well.

Answer 1

The offline bundle actually doesn't have a signature inside the deb file. You can see this by extracting the bundle as you did:

$ tar xvzf armory_0.92.3_offline_ubuntu_12.04-32.tar.gz

Now you can check the contents of the .deb file

$ cd OfflineBundle
$ ar vx armory_0.92.3_ubuntu-32bit.deb
x - debian-binary
x - control.tar.gz
x - data.tar.gz

If you download the armory_0.92.3_ubuntu-32.deb file directly, you can see that it's a little different

$ wget https://s3.amazonaws.com/bitcoinarmory-releases/armory_0.92.3_ubuntu-32bit.deb
$ ar vx armory_0.92.3_ubuntu-32bit.deb
x - debian-binary
x - control.tar.gz
x - data.tar.gz
x - _gpgbuilder
$ dpkg-sig --verify armory_0.92.3_ubuntu-32bit.deb 
Processing armory_0.92.3_ubuntu-32bit.deb...
GOODSIG _gpgbuilder 821F122936BDD565366AC36A4AB16AEA98832223 1412393663

dpkg-sig needs the _gpgbuilder file to check the signature against the contents of the package. The Offline package doesn't have this file while the direct download does.

I would suggest you grab the direct download and place that file in the OfflineBundle directory after verifying the signature if you're concerned about some sort of man-in-the-middle attack.