How to securely update and verify C-Lightning release? Recently, a new version (v0.7.3) of C-Lightning was released. The GitHub page has detailed instructions on how to build the software from source, but does not provide much details as to how to update the software from the pre-built binaries from the release page.

I'm looking for instructions as to how to update the C-lightning software from the pre-built binaries for different OS (Windows, Linux, Mac etc.) 

How do I verify the release signatures of the C-Lightning pre-built binaries?
I have divided this post into three sections: Download, Verification and Installation to make it easier for people needing help with specific sections. The installation steps have been reproduced using Ubuntu 18.04 but can easily be used for other versions as well. Just make sure to download the specific pre-built binaries from the release page for the OS you are using.



Download

C-lightning implementation is designed to work effectively only in Linux environment as of now. All the c-lightning releases gets posted on the GitHub’s release page. You can download them directly from the browser or use the below terminal commands:

# Download the Ubuntu release of C-lightning from the release page
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v0.7.3/clightning-v0.7.3-Ubuntu-18.04.tar.xz

# Download the SHA256SUMS file that contains the hashes of the release
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v0.7.3/SHA256SUMS

# Download the digital signature file SHA256SUMS.asc
ubuntu@user:~/Downloads$ wget https://github.com/ElementsProject/lightning/releases/download/v0.7.3/SHA256SUMS.asc




Verification

Before installing the software it is a MUST to check the signatures of the release. This ensures that the software has not been modified by a third party on the release page or has been tampered during the download process via a man-in-the-middle attack.

Following steps are followed to check the authenticity of the file:


Compute the SHA256 hash of the main file
Check that the hash matches that in the SHA256SUMS file we downloaded
Verify that this hash has been signed by a trusted developer


The first step is to check whether the SHA256 hash of the file that we have downloaded matches the hash produced in the SHA256SUMS file. Since SHA256 is a one way mathematical function it helps ensure that the downloaded file has not been modified as its hash matches that in the SHA256SUMS file.

# Calculate the SHA256 of the file that we downloaded in the last step
ubuntu@user:~/Downloads$ sha256sum clightning-v0.7.3-Ubuntu-18.04.tar.xz
e36d259696ad172d509be712c0ee96b64a454d9a836b7a576d0bc26a580b313e  clightning-v0.7.3-Ubuntu-18.04.tar.xz

# Verify that the above hash matches the hash in the SHA256SUMS file
ubuntu@user:~/Downloads$ cat SHA256SUMS | grep clightning-v0.7.3-Ubuntu-18.04.tar.xz
e36d259696ad172d509be712c0ee96b64a454d9a836b7a576d0bc26a580b313e  release/clightning-v0.7.3-Ubuntu-18.04.tar.xz


As you can see above, the hashes matched. However, just matching the hashes is insufficient. An attacker could have modified the zip file, and reproduced its changed hash in the SHA256SUMS file. Thus we need to ensure that the hash that is in the SHA256SUMS file has actually been signed by a trusted person. For this, we need to verify the signatures.

You can do that by using gpg. First we will need to import public keys of the developers who signs these releases. You can find them here.

# import Rusty Russell's key
ubuntu@user:~/Downloads gpg --recv-keys 15EE8D6CAB0E7F0CF999BFCBD9200E6CD1ADB8F1

# import Christian Decker's key
ubuntu@user:~/Downloads gpg --recv-keys B7C4BE81184FC203D52C35C51416D83DC4F0E86D

# import Lisa Neigut's key
ubuntu@user:~/Downloads gpg --recv-keys 30DE693AE0DE9E37B3E7EB6BBFF0F67810C1EED1


The below step checks the signatures against the hashes in the SHA256SUMS file. If the SHA256SUMS file is missing you will get a can't hash datafile: No data error.

ubuntu@user:~/Downloads gpg --verify SHA256SUMS.asc
gpg: assuming signed data in 'SHA256SUMS'
gpg: Signature made Mon 28 Oct 2019 11:15:50 PM UTC
gpg:                using RSA key 30DE693AE0DE9E37B3E7EB6BBFF0F67810C1EED1
gpg: Good signature from "Lisa Neigut &lt;niftynei@gmail.com&gt;" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 30DE 693A E0DE 9E37 B3E7  EB6B BFF0 F678 10C1 EED1
gpg: Signature made Mon 28 Oct 2019 11:51:59 PM UTC
gpg:                using RSA key 15EE8D6CAB0E7F0CF999BFCBD9200E6CD1ADB8F1
gpg: Good signature from "Rusty Russell &lt;rusty@rustcorp.com.au&gt;" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 15EE 8D6C AB0E 7F0C F999  BFCB D920 0E6C D1AD B8F1
gpg: Signature made Tue 29 Oct 2019 08:07:39 PM UTC
gpg:                using RSA key B7C4BE81184FC203D52C35C51416D83DC4F0E86D
gpg: Good signature from "Christian Decker &lt;decker.christian@gmail.com&gt;" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: B731 AAC5 21B0 1385 9313  F674 A26D 6D9F E088 ED58
     Subkey fingerprint: B7C4 BE81 184F C203 D52C  35C5 1416 D83D C4F0 E86D




Installation

Now that we have verified the authenticity of the file, we can safely extract the zip file using the command tar xf clightning-v0.7.3-Ubuntu-18.04.tar.xz. The extracted folder will have folders bin, libexec and share as its contents. Paste the contents of these folders in the /usr/ directory (or /usr/local/). Note: Just replace the files within these folders. Do not directly replace these folders as these folders generally contain binaries of other critical software as well.