<p>I have divided this post into three sections: Download, Verification and Installation to make it easier for people needing help with specific sections. The installation steps have been reproduced using Ubuntu 22.04 but can easily be used for other versions as well. Just make sure to download the specific pre-built binaries from the release page for the OS you are using.</p>
<hr />
<h2>Download</h2>
<p>C-lightning implementation is designed to work effectively only in Linux environment as of now. All the c-lightning releases gets posted on the GitHub’s <a href="https://github.com/ElementsProject/lightning/releases" rel="nofollow noreferrer">release page</a>. You can download them directly from the browser or use the below terminal commands:</p>
<pre><code># Download the Ubuntu release of C-lightning from the release page
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v22.11.1/clightning-v22.11.1-Ubuntu-22.04.tar.xz

# Download the SHA256SUMS file that contains the hashes of the release
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v22.11.1/SHA256SUMS

# Download the digital signature file SHA256SUMS.asc
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v22.11.1/SHA256SUMS.asc
</code></pre>
<hr />
<h2>Verification</h2>
<p>Before installing the software it is a <strong>MUST</strong> to check the signatures of the release. This ensures that the software has not been modified by a third party on the release page or has been tampered during the download process via a man-in-the-middle attack.</p>
<p>Following steps are followed to check the authenticity of the file:</p>
<ol>
<li>Compute the SHA256 hash of the main file</li>
<li>Check that the hash matches that in the SHA256SUMS file we downloaded</li>
<li>Verify that this hash has been signed by a trusted developer</li>
</ol>
<p>The first step is to check whether the SHA256 hash of the file that we have downloaded matches the hash produced in the SHA256SUMS file. Since SHA256 is a one way mathematical function it helps ensure that the downloaded file has not been modified as its hash matches that in the SHA256SUMS file.</p>
<pre><code># Calculate the SHA256 of the file that we downloaded in the last step
ubuntu@user:~/Downloads$ sha256sum --ignore-missing --check SHA256SUMS
clightning-v22.11.1-Ubuntu-22.04.tar.xz: OK
</code></pre>
<p>As you can see above, the hashes matched. However, just matching the hashes is insufficient. An attacker could have modified the zip file, and reproduced its changed hash in the SHA256SUMS file. Thus we need to ensure that the hash that is in the SHA256SUMS file has actually been signed by a trusted person. For this, we need to verify the signatures.</p>
<p>You can do that by using <code>gpg</code>. First we will need to import public keys of the developers who sign these releases. Download the files found in the repo <a href="https://github.com/ElementsProject/lightning/tree/master/contrib/keys" rel="nofollow noreferrer">here</a>. Be sure to change to the correct tag of the release you have downloaded to ensure the keys have not changed between branches, as shown in this screenshot:
<a href="https://i.sstatic.net/CweGU.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/CweGU.png" alt="switch to v22.11.1 tag menu in github" /></a></p>
<pre><code># import Rusty Russell's key
ubuntu@user:~/Downloads$ gpg --import rustyrussell.txt

# import Christian Decker's key
ubuntu@user:~/Downloads$ gpg --import cdecker.txt

# import Lisa Neigut's key
ubuntu@user:~/Downloads$ gpg --import niftynei.txt
</code></pre>
<p>The below step checks the signatures against the hashes in the SHA256SUMS file. If the SHA256SUMS file is missing you will get a <code>can't hash datafile: No data</code> error.</p>
<pre><code>ubuntu@user:~/Downloads$ gpg --verify SHA256SUMS.asc
gpg: assuming signed data in 'SHA256SUMS'
gpg: Signature made Fri Dec  9 17:35:28 2022 UTC
gpg:                using RSA key B7C4BE81184FC203D52C35C51416D83DC4F0E86D
gpg: Good signature from &quot;Christian Decker &lt;decker.christian@gmail.com&gt;&quot; [unknown]
gpg:                 aka &quot;Christian Decker &lt;decker@blockstream.com&gt;&quot; [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: B731 AAC5 21B0 1385 9313  F674 A26D 6D9F E088 ED58
     Subkey fingerprint: B7C4 BE81 184F C203 D52C  35C5 1416 D83D C4F0 E86D
</code></pre>
<hr />
<h2>Installation</h2>
<p>Now that we have verified the authenticity of the file, we can safely extract the zip file using the command <code>tar xf clightning-v22.11.1-Ubuntu-22.04.tar.xz</code>. The extracted folder will have folders <code>bin</code>, <code>libexec</code> and <code>share</code> as its contents. Paste the contents of these folders in the <code>/usr/</code> directory (or <code>/usr/local/</code>). Note: Just replace the files within these folders. Do not directly replace these folders as these folders generally contain binaries of other critical software as well.</p>

CC BY-SA 4.0
2019-11-06T22:08:06.893Z
In general you can verify the SHA256SUMs with `sha256sum --ignore-missing -c SHA256SUMS` instead of manually comparing them, but that doesn't work as well with this release because SHA256SUM expects the files to be in the `release/` directory.
nickler
CC BY-SA 4.0
2020-08-13T06:42:50.403Z
C Decker key is now B731AAC521B013859313F674A26D6D9FE088ED58
Fontaine
CC BY-SA 4.0
2019-11-06T10:03:39.333Z
2023-01-06T15:52:19.883Z
2023-01-06T15:52:19.883Z
Ugam Kamat
<p>Recently, a new version (v0.7.3) of C-Lightning was released. The GitHub page has detailed instructions on <a href="https://github.com/ElementsProject/lightning/blob/master/doc/INSTALL.md" rel="nofollow noreferrer">how to build the software from source</a>, but does not provide much details as to how to update the software from the pre-built binaries from the <a href="https://github.com/ElementsProject/lightning/releases" rel="nofollow noreferrer">release page</a>.</p>

<p>I'm looking for instructions as to how to update the C-lightning software from the pre-built binaries for different OS (Windows, Linux, Mac etc.) </p>

<p>How do I verify the release signatures of the C-Lightning pre-built binaries?</p>

<lightning-network><core-lightning>
How to securely update and verify C-Lightning release?
Ugam Kamat
# How to securely update and verify C-Lightning release?

(Asked by: username_0 on 2019-11-06)

Recently, a new version (v0.7.3) of C-Lightning was released. The GitHub page has detailed instructions on [how to build the software from source](https://github.com/ElementsProject/lightning/blob/master/doc/INSTALL.md), but does not provide much details as to how to update the software from the pre-built binaries from the [release page](https://github.com/ElementsProject/lightning/releases).

I'm looking for instructions as to how to update the C-lightning software from the pre-built binaries for different OS (Windows, Linux, Mac etc.)

How do I verify the release signatures of the C-Lightning pre-built binaries?

**Tags:** lightning-network, core-lightning


---

## 1 answers

### Answer by username_0 on 2019-11-06. Score: 5 | Accepted answer

I have divided this post into three sections: Download, Verification and Installation to make it easier for people needing help with specific sections. The installation steps have been reproduced using Ubuntu 22.04 but can easily be used for other versions as well. Just make sure to download the specific pre-built binaries from the release page for the OS you are using.

---

## Download

C-lightning implementation is designed to work effectively only in Linux environment as of now. All the c-lightning releases gets posted on the GitHub’s [release page](https://github.com/ElementsProject/lightning/releases). You can download them directly from the browser or use the below terminal commands:

```
# Download the Ubuntu release of C-lightning from the release page
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v22.11.1/clightning-v22.11.1-Ubuntu-22.04.tar.xz

# Download the SHA256SUMS file that contains the hashes of the release
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v22.11.1/SHA256SUMS

# Download the digital signature file SHA256SUMS.asc
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v22.11.1/SHA256SUMS.asc

```

---

## Verification

Before installing the software it is a **MUST** to check the signatures of the release. This ensures that the software has not been modified by a third party on the release page or has been tampered during the download process via a man-in-the-middle attack.

Following steps are followed to check the authenticity of the file:

1. Compute the SHA256 hash of the main file
2. Check that the hash matches that in the SHA256SUMS file we downloaded
3. Verify that this hash has been signed by a trusted developer

The first step is to check whether the SHA256 hash of the file that we have downloaded matches the hash produced in the SHA256SUMS file. Since SHA256 is a one way mathematical function it helps ensure that the downloaded file has not been modified as its hash matches that in the SHA256SUMS file.

```
# Calculate the SHA256 of the file that we downloaded in the last step
ubuntu@user:~/Downloads$ sha256sum --ignore-missing --check SHA256SUMS
clightning-v22.11.1-Ubuntu-22.04.tar.xz: OK

```

As you can see above, the hashes matched. However, just matching the hashes is insufficient. An attacker could have modified the zip file, and reproduced its changed hash in the SHA256SUMS file. Thus we need to ensure that the hash that is in the SHA256SUMS file has actually been signed by a trusted person. For this, we need to verify the signatures.

You can do that by using `gpg`. First we will need to import public keys of the developers who sign these releases. Download the files found in the repo [here](https://github.com/ElementsProject/lightning/tree/master/contrib/keys). Be sure to change to the correct tag of the release you have downloaded to ensure the keys have not changed between branches, as shown in this screenshot:
[![switch to v22.11.1 tag menu in github](https://i.sstatic.net/CweGU.png)](https://i.sstatic.net/CweGU.png)

```
# import Rusty Russell's key
ubuntu@user:~/Downloads$ gpg --import rustyrussell.txt

# import Christian Decker's key
ubuntu@user:~/Downloads$ gpg --import cdecker.txt

# import Lisa Neigut's key
ubuntu@user:~/Downloads$ gpg --import niftynei.txt

```

The below step checks the signatures against the hashes in the SHA256SUMS file. If the SHA256SUMS file is missing you will get a `can't hash datafile: No data` error.

```
ubuntu@user:~/Downloads$ gpg --verify SHA256SUMS.asc
gpg: assuming signed data in 'SHA256SUMS'
gpg: Signature made Fri Dec  9 17:35:28 2022 UTC
gpg:                using RSA key B7C4BE81184FC203D52C35C51416D83DC4F0E86D
gpg: Good signature from "Christian Decker <decker.christian@gmail.com>" [unknown]
gpg:                 aka "Christian Decker <decker@blockstream.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: B731 AAC5 21B0 1385 9313  F674 A26D 6D9F E088 ED58
     Subkey fingerprint: B7C4 BE81 184F C203 D52C  35C5 1416 D83D C4F0 E86D

```

---

## Installation

Now that we have verified the authenticity of the file, we can safely extract the zip file using the command `tar xf clightning-v22.11.1-Ubuntu-22.04.tar.xz`. The extracted folder will have folders `bin`, `libexec` and `share` as its contents. Paste the contents of these folders in the `/usr/` directory (or `/usr/local/`). Note: Just replace the files within these folders. Do not directly replace these folders as these folders generally contain binaries of other critical software as well.

> **Comments:**
> **username_1**: In general you can verify the SHA256SUMs with `sha256sum --ignore-missing -c SHA256SUMS` instead of manually comparing them, but that doesn't work as well with this release because SHA256SUM expects the files to be in the `release/` directory.  
> **username_2**: C Decker key is now B731AAC521B013859313F674A26D6D9FE088ED58  

---

