I have divided this post into three sections: Download, Verification and Installation to make it easier for people needing help with specific sections. The installation steps have been reproduced using Ubuntu 22.04 but can easily be used for other versions as well. Just make sure to download the specific pre-built binaries from the release page for the OS you are using.
C-lightning implementation is designed to work effectively only in Linux environment as of now. All the c-lightning releases gets posted on the GitHub’s release page. You can download them directly from the browser or use the below terminal commands:
# Download the Ubuntu release of C-lightning from the release page
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v22.11.1/clightning-v22.11.1-Ubuntu-22.04.tar.xz
# Download the SHA256SUMS file that contains the hashes of the release
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v22.11.1/SHA256SUMS
# Download the digital signature file SHA256SUMS.asc
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v22.11.1/SHA256SUMS.asc
Before installing the software it is a MUST to check the signatures of the release. This ensures that the software has not been modified by a third party on the release page or has been tampered during the download process via a man-in-the-middle attack.
Following steps are followed to check the authenticity of the file:
- Compute the SHA256 hash of the main file
- Check that the hash matches that in the SHA256SUMS file we downloaded
- Verify that this hash has been signed by a trusted developer
The first step is to check whether the SHA256 hash of the file that we have downloaded matches the hash produced in the SHA256SUMS file. Since SHA256 is a one way mathematical function it helps ensure that the downloaded file has not been modified as its hash matches that in the SHA256SUMS file.
# Calculate the SHA256 of the file that we downloaded in the last step
ubuntu@user:~/Downloads$ sha256sum --ignore-missing --check SHA256SUMS
As you can see above, the hashes matched. However, just matching the hashes is insufficient. An attacker could have modified the zip file, and reproduced its changed hash in the SHA256SUMS file. Thus we need to ensure that the hash that is in the SHA256SUMS file has actually been signed by a trusted person. For this, we need to verify the signatures.
You can do that by using
gpg. First we will need to import public keys of the developers who sign these releases. Download the files found in the repo here. Be sure to change to the correct tag of the release you have downloaded to ensure the keys have not changed between branches, as shown in this screenshot:
# import Rusty Russell's key
ubuntu@user:~/Downloads$ gpg --import rustyrussell.txt
# import Christian Decker's key
ubuntu@user:~/Downloads$ gpg --import cdecker.txt
# import Lisa Neigut's key
ubuntu@user:~/Downloads$ gpg --import niftynei.txt
The below step checks the signatures against the hashes in the SHA256SUMS file. If the SHA256SUMS file is missing you will get a
can't hash datafile: No data error.
ubuntu@user:~/Downloads$ gpg --verify SHA256SUMS.asc
gpg: assuming signed data in 'SHA256SUMS'
gpg: Signature made Fri Dec 9 17:35:28 2022 UTC
gpg: using RSA key B7C4BE81184FC203D52C35C51416D83DC4F0E86D
gpg: Good signature from "Christian Decker <[email protected]>" [unknown]
gpg: aka "Christian Decker <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: B731 AAC5 21B0 1385 9313 F674 A26D 6D9F E088 ED58
Subkey fingerprint: B7C4 BE81 184F C203 D52C 35C5 1416 D83D C4F0 E86D
Now that we have verified the authenticity of the file, we can safely extract the zip file using the command
tar xf clightning-v22.11.1-Ubuntu-22.04.tar.xz. The extracted folder will have folders
share as its contents. Paste the contents of these folders in the
/usr/ directory (or
/usr/local/). Note: Just replace the files within these folders. Do not directly replace these folders as these folders generally contain binaries of other critical software as well.