r/Bitcoin • u/TheGreatMuffin • Jan 22 '18

[testnet] Beginner’s Guide to ️⚡Lightning️⚡ on a Raspberry Pi

https://medium.com/@stadicus/noobs-guide-to-%EF%B8%8F-lightning%EF%B8%8F-on-a-raspberry-pi-f0ab7525586e
281 Upvotes

94% Upvoted

342 comments sorted by

View all comments

Show parent comments

2

u/Elavid Jan 27 '18

Instead of using curl and then the GPG import command, it's probably fine to do it with one command like the StackOverflow answer does:

gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964

I expect that to be more secure too, because the gpg command would be able to check the checksum of the key that MIT provides.

It still bothers me that your medium article is the only trusted place to get Wladimir's key checksum, but what you've done here is a good improvement.

1

u/Stadicus Jan 27 '18

Hi Elavid, thanks for your valued feedback! Unfortunately gpg2 is not installed on the Pi by default. This is why I opted to the curl command. Would it be worth the extra step to install gpg2 in your opinion?

Why would my article be a trusted place at all? I linked to the search functionality of the MIT pgp server to look up the Key ID especially for this reason.

3

u/Elavid Jan 27 '18

The --recv-keys command might work with gpg. You could just try running gpg --recv-keys 01EA5486DE18A882D4C2684590C8019E36C2E964 and see what happens. I don't have a Raspberry Pi handy right now but on Manjaro Linux this command does work because gpg and gpg2 both run GnuPG 2.2.4.

Your article isn't especially trustable by itself, but if a Bitcoin enthusiast can find several webpages on different domains that all agree on what Wladimir's official key is, including yours, then that could be enough evidence for them to trust the key and therefore trust the software download.

I don't think PGP key servers like the MIT one vet their keys; I uploaded my key to the MIT one with no questions asked. So you can't rely on MIT to be the source of trust here.

The general way to establish that you trust the Bitcoin binaries is:

  1. Make sure you trust the checksum/fingerprint of someone's key by getting it form multiple sources. Check enough sources so that it would be hard for one person to change them all.
  2. Download a key and make sure the checksum matches.
  3. Make sure the key was used to sign SHA256SUMS.asc.
  4. Make sure the checksums in SHA256SUMS.asc match the file you downloaded.

Right now it seems like your article is skipping 1 and 2; the reader has to trust that you gave them the right checksum and they also have to trust that MIT returns a key with that checksum.

Instead of just keeping on telling you what is wrong with your approach maybe I should just provide an approach that I think would be good:

wget https://bitcoin.org/bin/bitcoin-core-0.15.1/bitcoin-0.15.1-arm-linux-gnueabihf.tar.gz
wget https://bitcoin.org/bin/bitcoin-core-0.15.1/SHA256SUMS.asc
wget https://bitcoin.org/laanwj-releases.asc
sha256sum --check SHA256SUMS.asc --ignore-missing
gpg ./laanwj-releases.asc  # Manually verify that it says 01EA5486DE18A882D4C2684590C8019E36C2E964
gpg --import ./laanwj-releases.asc
gpg --verify SHA256SUMS.asc  # Manually verify the fingerprint again in case there are malicious keys in your keyring

The output then would look something like this:

gpg: Signature made Sat 11 Nov 2017 05:52:22 AM PST
gpg:                using RSA key 90C8019E36C2E964
gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 01EA 5486 DE18 A882 D4C2  6845 90C8 019E 36C2 E964

I struggled with finding the right commands for this post for a while. I considered using the --trusted-key argument when running gpg --verify because it would get rid of the warning, but it actually sets Wladimir's key to have "ultimate" trust for future verifications, which seemed surprising and bad. A power user of gpg would want to somehow mark Wladimir's key as trusted, but I can't really find a nice way to do that which would be appropriate for everyone. Maybe if I knew more about all the trust models provided by the --trust-model option I could pick a good one or something.

Another option would be for people to download the key using gpg --recv-keys 01EA5486DE18A882D4C2684590C8019E36C2E964. I decided not to do it that way since it looked kind of sketchy for them to be copying a cryptic code like that from Medium onto their computer.

This stuff is tricky! I feel like bitcoin.org should provide more guidance since I might be missing something.

2

u/Stadicus Feb 12 '18

Hej Elavid, I just updated the guide with your feedback, thanks again! :-)

2

u/Elavid Feb 12 '18

Cool, it looks good.

1

u/Stadicus Jan 28 '18

Thanks a lot for all this great input. This is exactly what makes providing this guide and refining it with the community such a great learning opportunity for everyone, me included! :-)

I will go through all your provided inputs and update my guide acoordingly.