<p>The offline bundle actually doesn't have a signature inside the deb file. You can see this by extracting the bundle as you did:</p>

<pre><code>$ tar xvzf armory_0.92.3_offline_ubuntu_12.04-32.tar.gz
</code></pre>

<p>Now you can check the contents of the .deb file</p>

<pre><code>$ cd OfflineBundle
$ ar vx armory_0.92.3_ubuntu-32bit.deb
x - debian-binary
x - control.tar.gz
x - data.tar.gz
</code></pre>

<p>If you download the armory_0.92.3_ubuntu-32.deb file <a href="https://s3.amazonaws.com/bitcoinarmory-releases/armory_0.92.3_ubuntu-32bit.deb" rel="nofollow">directly</a>, you can see that it's a little different</p>

<pre><code>$ wget https://s3.amazonaws.com/bitcoinarmory-releases/armory_0.92.3_ubuntu-32bit.deb
$ ar vx armory_0.92.3_ubuntu-32bit.deb
x - debian-binary
x - control.tar.gz
x - data.tar.gz
x - _gpgbuilder
$ dpkg-sig --verify armory_0.92.3_ubuntu-32bit.deb 
Processing armory_0.92.3_ubuntu-32bit.deb...
GOODSIG _gpgbuilder 821F122936BDD565366AC36A4AB16AEA98832223 1412393663
</code></pre>

<p><code>dpkg-sig</code> needs the <code>_gpgbuilder</code> file to check the signature against the contents of the package. The Offline package doesn't have this file while the direct download does.</p>

<p>I would suggest you grab the <a href="https://s3.amazonaws.com/bitcoinarmory-releases/armory_0.92.3_ubuntu-32bit.deb" rel="nofollow">direct download</a> and place that file in the OfflineBundle directory after verifying the signature if you're concerned about some sort of man-in-the-middle attack.</p>

CC BY-SA 3.0
2015-02-02T16:41:39.547Z
Is there a more secure way to download all the Python and other files as well?  Wouldn't it be possible for those files to have been tampered with?  Thanks!
RootFAIL
CC BY-SA 3.0
2015-02-02T17:12:00.087Z
Sadly, the authors of all the other packages may or may not sign them. You'll have to download those directly if they do and verify them some other way if they don't.
Jimmy Song
CC BY-SA 3.0
2015-02-02T15:51:23.263Z
2015-02-02T15:51:23.263Z
Jimmy Song
<p>I'm having difficulty GPG-verifying my offline Armory installer for Ubuntu, using the suggested steps:</p>

<pre><code>$ cd Downloads # the directory containing the *.deb
$ gpg --recv-keys --keyserver keyserver.ubuntu.com 98832223
$ sudo apt-get install dpkg-sig
$ dpkg-sig --verify *.deb
</code></pre>

<p>The first three steps are working, since I can verify the standard Ubuntu installer:</p>

<p>ubuntu@ubuntu:~/Downloads$ dpkg-sig --verify *.deb
Processing armory_0.92.3_ubuntu-32bit.deb...
GOODSIG _gpgbuilder 821F122936BDD565366AC36A4AB16AEA98832223 1412393663</p>

<p>But for the offline bundle I just get this:</p>

<pre><code>ubuntu@ubuntu:~/Downloads$ dpkg-sig --verify *.deb
E: Cannot find *.deb: no such file
ubuntu@ubuntu:~/Downloads$ ls
Alan-C.-Reiner-Offline-Signing-Key-alan@bitcoinarmory.com-0x98832223-pub.asc
armory_0.92.3_offline_ubuntu_12.04-32.tar.gz
</code></pre>

<p>So I extracted the .tar.gz and cd OfflineBundle, which gives me these files:</p>

<pre><code>ubuntu@ubuntu:~/Downloads/OfflineBundle$ ls
Alan-C.-Reiner-Offline-Signing-Key-alan@bitcoinarmory.com-0x98832223-pub.asc
armory_0.92.3_ubuntu-32bit.deb      
dpkg-sig_0.13.1_all.deb
Install_DoubleClick_RunInTerminal.sh
libqt4-designer_4.8.1-0ubuntu4.8_i386.deb
libqt4-help_4.8.1-0ubuntu4.8_i386.deb
libqt4-scripttools_4.8.1-0ubuntu4.8_i386.deb
libqt4-test_4.8.1-0ubuntu4.8_i386.deb
libqtassistantclient4_4.6.3-3ubuntu2_i386.deb
libqtwebkit4_2.2.1-1ubuntu4_i386.deb
python-psutil_0.4.1-1ubuntu1_i386.deb
python-pyasn1_0.0.11a-1ubuntu1_all.deb
python-qt4_4.9.1-2ubuntu1_i386.deb
python-sip_4.13.2-1_i386.deb
python-twisted_11.1.0-1ubuntu2_all.deb
python-twisted-conch_11.1.0-1_all.deb
python-twisted-lore_11.1.0-1_all.deb
python-twisted-mail_11.1.0-1_all.deb
python-twisted-news_11.1.0-1_all.deb
python-twisted-runner_11.1.0-1_i386.deb
python-twisted-words_11.1.0-1_all.deb
</code></pre>

<p>I'm pretty sure it's armory_0.92.3_ubuntu-32bit.deb that is the file that should have the GOODSIG after it, but when I run dpkg-sig --verify *.deb, I just get this:</p>

<pre><code>Processing armory_0.92.3_ubuntu-32bit.deb...
Processing dpkg-sig_0.13.1_all.deb...
Processing libqt4-designer_4.8.1-0ubuntu4.8_i386.deb...
Processing libqt4-help_4.8.1-0ubuntu4.8_i386.deb...
Processing libqt4-scripttools_4.8.1-0ubuntu4.8_i386.deb...
Processing libqt4-test_4.8.1-0ubuntu4.8_i386.deb...
Processing libqtassistantclient4_4.6.3-3ubuntu2_i386.deb...
Processing libqtwebkit4_2.2.1-1ubuntu4_i386.deb...
Processing python-psutil_0.4.1-1ubuntu1_i386.deb...
Processing python-pyasn1_0.0.11a-1ubuntu1_all.deb...
Processing python-qt4_4.9.1-2ubuntu1_i386.deb...
Processing python-sip_4.13.2-1_i386.deb...
Processing python-twisted_11.1.0-1ubuntu2_all.deb...
Processing python-twisted-conch_11.1.0-1_all.deb...
Processing python-twisted-lore_11.1.0-1_all.deb...
Processing python-twisted-mail_11.1.0-1_all.deb...
Processing python-twisted-news_11.1.0-1_all.deb...
Processing python-twisted-runner_11.1.0-1_i386.deb...
Processing python-twisted-words_11.1.0-1_all.deb...
</code></pre>

<p>Am I missing something?  What should I do?  I'm almost tempted to just replace the armory_0.92.3_ubuntu-32bit.deb file that came in the offline bundle with the one that came with the standard armory installer, but I'm worried that the rest of the files in OfflineBundle may have been tampered with as well.</p>

<armory><offline>
Verify Offline Bitcoin Bundle on Ubuntu
RootFAIL
# Verify Offline Bitcoin Bundle on Ubuntu

(Asked by: username_0 on 2015-02-01)

I'm having difficulty GPG-verifying my offline Armory installer for Ubuntu, using the suggested steps:

```
$ cd Downloads # the directory containing the *.deb
$ gpg --recv-keys --keyserver keyserver.ubuntu.com 98832223
$ sudo apt-get install dpkg-sig
$ dpkg-sig --verify *.deb

```

The first three steps are working, since I can verify the standard Ubuntu installer:

ubuntu@ubuntu:~/Downloads$ dpkg-sig --verify \*.deb
Processing armory\_0.92.3\_ubuntu-32bit.deb...
GOODSIG \_gpgbuilder 821F122936BDD565366AC36A4AB16AEA98832223 1412393663

But for the offline bundle I just get this:

```
ubuntu@ubuntu:~/Downloads$ dpkg-sig --verify *.deb
E: Cannot find *.deb: no such file
ubuntu@ubuntu:~/Downloads$ ls
Alan-C.-Reiner-Offline-Signing-Key-alan@bitcoinarmory.com-0x98832223-pub.asc
armory_0.92.3_offline_ubuntu_12.04-32.tar.gz

```

So I extracted the .tar.gz and cd OfflineBundle, which gives me these files:

```
ubuntu@ubuntu:~/Downloads/OfflineBundle$ ls
Alan-C.-Reiner-Offline-Signing-Key-alan@bitcoinarmory.com-0x98832223-pub.asc
armory_0.92.3_ubuntu-32bit.deb      
dpkg-sig_0.13.1_all.deb
Install_DoubleClick_RunInTerminal.sh
libqt4-designer_4.8.1-0ubuntu4.8_i386.deb
libqt4-help_4.8.1-0ubuntu4.8_i386.deb
libqt4-scripttools_4.8.1-0ubuntu4.8_i386.deb
libqt4-test_4.8.1-0ubuntu4.8_i386.deb
libqtassistantclient4_4.6.3-3ubuntu2_i386.deb
libqtwebkit4_2.2.1-1ubuntu4_i386.deb
python-psutil_0.4.1-1ubuntu1_i386.deb
python-pyasn1_0.0.11a-1ubuntu1_all.deb
python-qt4_4.9.1-2ubuntu1_i386.deb
python-sip_4.13.2-1_i386.deb
python-twisted_11.1.0-1ubuntu2_all.deb
python-twisted-conch_11.1.0-1_all.deb
python-twisted-lore_11.1.0-1_all.deb
python-twisted-mail_11.1.0-1_all.deb
python-twisted-news_11.1.0-1_all.deb
python-twisted-runner_11.1.0-1_i386.deb
python-twisted-words_11.1.0-1_all.deb

```

I'm pretty sure it's armory\_0.92.3\_ubuntu-32bit.deb that is the file that should have the GOODSIG after it, but when I run dpkg-sig --verify \*.deb, I just get this:

```
Processing armory_0.92.3_ubuntu-32bit.deb...
Processing dpkg-sig_0.13.1_all.deb...
Processing libqt4-designer_4.8.1-0ubuntu4.8_i386.deb...
Processing libqt4-help_4.8.1-0ubuntu4.8_i386.deb...
Processing libqt4-scripttools_4.8.1-0ubuntu4.8_i386.deb...
Processing libqt4-test_4.8.1-0ubuntu4.8_i386.deb...
Processing libqtassistantclient4_4.6.3-3ubuntu2_i386.deb...
Processing libqtwebkit4_2.2.1-1ubuntu4_i386.deb...
Processing python-psutil_0.4.1-1ubuntu1_i386.deb...
Processing python-pyasn1_0.0.11a-1ubuntu1_all.deb...
Processing python-qt4_4.9.1-2ubuntu1_i386.deb...
Processing python-sip_4.13.2-1_i386.deb...
Processing python-twisted_11.1.0-1ubuntu2_all.deb...
Processing python-twisted-conch_11.1.0-1_all.deb...
Processing python-twisted-lore_11.1.0-1_all.deb...
Processing python-twisted-mail_11.1.0-1_all.deb...
Processing python-twisted-news_11.1.0-1_all.deb...
Processing python-twisted-runner_11.1.0-1_i386.deb...
Processing python-twisted-words_11.1.0-1_all.deb...

```

Am I missing something? What should I do? I'm almost tempted to just replace the armory\_0.92.3\_ubuntu-32bit.deb file that came in the offline bundle with the one that came with the standard armory installer, but I'm worried that the rest of the files in OfflineBundle may have been tampered with as well.

**Tags:** armory, offline


---

## 1 answers

### Answer by username_1 on 2015-02-02. Score: 1 | Accepted answer

The offline bundle actually doesn't have a signature inside the deb file. You can see this by extracting the bundle as you did:

```
$ tar xvzf armory_0.92.3_offline_ubuntu_12.04-32.tar.gz

```

Now you can check the contents of the .deb file

```
$ cd OfflineBundle
$ ar vx armory_0.92.3_ubuntu-32bit.deb
x - debian-binary
x - control.tar.gz
x - data.tar.gz

```

If you download the armory\_0.92.3\_ubuntu-32.deb file [directly](https://s3.amazonaws.com/bitcoinarmory-releases/armory_0.92.3_ubuntu-32bit.deb), you can see that it's a little different

```
$ wget https://s3.amazonaws.com/bitcoinarmory-releases/armory_0.92.3_ubuntu-32bit.deb
$ ar vx armory_0.92.3_ubuntu-32bit.deb
x - debian-binary
x - control.tar.gz
x - data.tar.gz
x - _gpgbuilder
$ dpkg-sig --verify armory_0.92.3_ubuntu-32bit.deb 
Processing armory_0.92.3_ubuntu-32bit.deb...
GOODSIG _gpgbuilder 821F122936BDD565366AC36A4AB16AEA98832223 1412393663

```

`dpkg-sig` needs the `_gpgbuilder` file to check the signature against the contents of the package. The Offline package doesn't have this file while the direct download does.

I would suggest you grab the [direct download](https://s3.amazonaws.com/bitcoinarmory-releases/armory_0.92.3_ubuntu-32bit.deb) and place that file in the OfflineBundle directory after verifying the signature if you're concerned about some sort of man-in-the-middle attack.

> **Comments:**
> **username_0**: Is there a more secure way to download all the Python and other files as well?  Wouldn't it be possible for those files to have been tampered with?  Thanks!  
> **username_1**: Sadly, the authors of all the other packages may or may not sign them. You'll have to download those directly if they do and verify them some other way if they don't.  

---

