Verify Sparrow Wallet & Whirlpool GUI using PGP in Debian 11 terminal

I run Sparrow Wallet and Whirlpool GUI on a dedicated Lenovo ThinkPad running Debian 11. I do this to take advantage of whirlpooling the same Samourai created wallet via both Sparrow Wallet and my RoninDojo Tanto node at the same time. It is very important to verify the programs using pgp before installing them and importing your private keys and passphrase. Both Sparrow and Samourai have made this a very easy process by providing the keys and files necessary to verify.

First make sure the computer is updated

Open terminal in Debian 11

sudo apt update

To fix dependencies in Debian 11 that prevent upgrading:

sudo apt --fix-broken install

sudo apt update

sudo apt upgrade

Now install curl

sudo apt install curl

VERIFY SPARROW WALLET

Download sparrow-1.7.1-1_amd64.deb from sparrowwallet.com

Download sparrow-1.7.1-manifest.txt from sparrowwallet.com

Download sparrow-1.7.1-manifest.txt.asc from sparrowwallet.com

curl https://keybase.io/craigraw/pgp-keys.asc | gpg --import

Take note of the key

gpg --verify sparrow-1.7.1-manifest.txt.asc

Results should show:

RSA key

Good signature from "Craig Raw <craigraw@gmail.com>"

You may see a warning stating "This key is not certified with a trusted signature!" That just means you haven't saved it in your pgp. You can ignore it.

Look for the primary fingerprint result. It should match the RSA key and the key shown as a result of the curl command from above.

sha256sum --check sparrow-1.7.1-maifest.txt --ignore-missing

The result should say "OK"

Now you can confidently install and run sparrow_1.7.1-1_amd64.deb

sudo dpkg -i sparrow_1.7.1-1_amd64.deb

VERIFY WHIRLPOOL GUI

Download whirlpool-gui-0.10.3.AppImage from samouraiwallet.com

Download whirlpool-gui-0.10.3.AppImage.sig.asc

curl https://samouraiwallet.com/pgp.txt | gpg --import

Take note of the key

gpg --verify ~/Downloads/whirlpool-gui-0.10.3.AppImage.sig.asc

Results should show:

RSA key

Good Signature from "T Dev D (Samourai) <dev@samouraiwallet.com>"

Look for the primary fingerprint result. It should match the RSA key and the key shown as a result of the curl command from above.

Go to your downloads folder and open whirlpool-gui-0.10.3.AppImage.sig.asc

Look under the hash:SHA256

That string should match the result of

sha256sum whirlpool-gui-0.10.3.AppImage

You can now confidentily install and run Whirlpool GUI

Please use this only as a guide. Use the official documentation and double check the links and urls are accurate.