2

Recently, a new version (v0.7.3) of C-Lightning was released. The GitHub page has detailed instructions on how to build the software from source, but does not provide much details as to how to update the software from the pre-built binaries from the release page.

I'm looking for instructions as to how to update the C-lightning software from the pre-built binaries for different OS (Windows, Linux, Mac etc.)

How do I verify the release signatures of the C-Lightning pre-built binaries?

1 Answer 1

5

I have divided this post into three sections: Download, Verification and Installation to make it easier for people needing help with specific sections. The installation steps have been reproduced using Ubuntu 22.04 but can easily be used for other versions as well. Just make sure to download the specific pre-built binaries from the release page for the OS you are using.


Download

C-lightning implementation is designed to work effectively only in Linux environment as of now. All the c-lightning releases gets posted on the GitHub’s release page. You can download them directly from the browser or use the below terminal commands:

# Download the Ubuntu release of C-lightning from the release page
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v22.11.1/clightning-v22.11.1-Ubuntu-22.04.tar.xz

# Download the SHA256SUMS file that contains the hashes of the release
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v22.11.1/SHA256SUMS

# Download the digital signature file SHA256SUMS.asc
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v22.11.1/SHA256SUMS.asc

Verification

Before installing the software it is a MUST to check the signatures of the release. This ensures that the software has not been modified by a third party on the release page or has been tampered during the download process via a man-in-the-middle attack.

Following steps are followed to check the authenticity of the file:

  1. Compute the SHA256 hash of the main file
  2. Check that the hash matches that in the SHA256SUMS file we downloaded
  3. Verify that this hash has been signed by a trusted developer

The first step is to check whether the SHA256 hash of the file that we have downloaded matches the hash produced in the SHA256SUMS file. Since SHA256 is a one way mathematical function it helps ensure that the downloaded file has not been modified as its hash matches that in the SHA256SUMS file.

# Calculate the SHA256 of the file that we downloaded in the last step
ubuntu@user:~/Downloads$ sha256sum --ignore-missing --check SHA256SUMS
clightning-v22.11.1-Ubuntu-22.04.tar.xz: OK

As you can see above, the hashes matched. However, just matching the hashes is insufficient. An attacker could have modified the zip file, and reproduced its changed hash in the SHA256SUMS file. Thus we need to ensure that the hash that is in the SHA256SUMS file has actually been signed by a trusted person. For this, we need to verify the signatures.

You can do that by using gpg. First we will need to import public keys of the developers who sign these releases. Download the files found in the repo here. Be sure to change to the correct tag of the release you have downloaded to ensure the keys have not changed between branches, as shown in this screenshot: switch to v22.11.1 tag menu in github

# import Rusty Russell's key
ubuntu@user:~/Downloads$ gpg --import rustyrussell.txt

# import Christian Decker's key
ubuntu@user:~/Downloads$ gpg --import cdecker.txt

# import Lisa Neigut's key
ubuntu@user:~/Downloads$ gpg --import niftynei.txt

The below step checks the signatures against the hashes in the SHA256SUMS file. If the SHA256SUMS file is missing you will get a can't hash datafile: No data error.

ubuntu@user:~/Downloads$ gpg --verify SHA256SUMS.asc
gpg: assuming signed data in 'SHA256SUMS'
gpg: Signature made Fri Dec  9 17:35:28 2022 UTC
gpg:                using RSA key B7C4BE81184FC203D52C35C51416D83DC4F0E86D
gpg: Good signature from "Christian Decker <[email protected]>" [unknown]
gpg:                 aka "Christian Decker <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: B731 AAC5 21B0 1385 9313  F674 A26D 6D9F E088 ED58
     Subkey fingerprint: B7C4 BE81 184F C203 D52C  35C5 1416 D83D C4F0 E86D

Installation

Now that we have verified the authenticity of the file, we can safely extract the zip file using the command tar xf clightning-v22.11.1-Ubuntu-22.04.tar.xz. The extracted folder will have folders bin, libexec and share as its contents. Paste the contents of these folders in the /usr/ directory (or /usr/local/). Note: Just replace the files within these folders. Do not directly replace these folders as these folders generally contain binaries of other critical software as well.

2
  • 1
    In general you can verify the SHA256SUMs with sha256sum --ignore-missing -c SHA256SUMS instead of manually comparing them, but that doesn't work as well with this release because SHA256SUM expects the files to be in the release/ directory.
    – nickler
    Nov 6, 2019 at 22:08
  • C Decker key is now B731AAC521B013859313F674A26D6D9FE088ED58
    – Fontaine
    Aug 13, 2020 at 6:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.