Post
Topic
Board Armory
Re: GPG: Running "dpkg-sig --verify *.deb" does not output "GOODSIG _gpgbuilder"
by
brancao
on 16/10/2015, 00:55:43 UTC
Hi GoatPig, I recall seeing your name here a few years back when I previously installed an earlier version of Armory and was testing it out, and I understand you are a dev on the project, thanks for your prompt replies here.

I'm not familiar with dpkg-sig so I can't really help you on that front.

I'm also not familiar with the specifics of dpkg-sig, but it sounds like it's probably a fairly standard debian-based tool for verifying the signatures of *.deb files.

This still leaves the question of why the instructions on the Armory website don't work. I suspect the instructions on the Armory website have gotten out-of-date, with respect to whatever is in the *.deb package for the current release (ie, file '_gpgbuilder' is apparently no longer included in the *.deb ?)

I would suggest that at this point you are better off simply building from source.

OK, I can try that approach, as I've done it for several other open-source software packages.

This indicates there may be an issue with your setup.

I didn't mention, but this is a dedicated Ubuntu 12.04 machine which will only be running Armory Online. The only stuff that's been installed on it is the dependencies for running bitcoin-qt and Armory.

(I also have another machine, identical hardware and OS, which I will be using for Armory Offline.)

Like, boot from a Debian live and try there.

I actually have yet another machine, identical hardware, but running Debian 8.0 (Jessye) which I use for my own development. I suppose I could try running the GPG verification stuff there as well.

Still I'm perplexed why the instructions on the site don't work.

I suspect something got out-of-date due to some change in a recent release. From the information mentioned at the stackexchange link from someone with a similar question involving the Offline Bundle for an earlier Armory release...
https://bitcoin.stackexchange.com/questions/35840/verify-offline-bitcoin-bundle-on-ubuntu

...it looks like the (Armory Online) *.deb file from that earlier release included a file '_gpgbuilder' which could be extracted using 'ar vx' and then the GPG verification would work as described in the instructions currently on the Armory download page.

So I think what's going on is that the Armory release changed at some point (to no longer include the file _gpgbuilder in the *.deb file to be extracted using 'ar vx'), but the Armory website download page still contains outdated instructions for GPG-verification, which used to work on earlier releases, but don't work on 0.93.2.

Thanks for the suggestions (building from source; doing GPG-verification on another OS such as Debian) - I'll try both of those. Since they're so different from the current approach, I expect one of them should work. I'll post results here later.