Downloading and installing - Revision history

SuddenWhipVapor: /* Verify the signature of the binary you downloaded */ step to refresh keys where needed

2026-06-12T07:43:10Z

Verify the signature of the binary you downloaded: step to refresh keys where needed

SuddenWhipVapor: /* Bisq2 specific instructions */ add step to refresh expired keys

2026-06-12T07:42:45Z

Bisq2 specific instructions: add step to refresh expired keys

Strayorigin: cleanup

2025-12-23T15:59:02Z

cleanup

Strayorigin: add key for henrik hotfix

2025-12-23T15:49:10Z

add key for henrik hotfix

MwithM: /* macOS */ xattr -d

2025-06-28T06:28:31Z

macOS: xattr -d

SuddenWhipVapor: add images

2025-01-28T08:45:20Z

add images

SuddenWhipVapor: Update verification instructions

2025-01-28T08:35:22Z

Update verification instructions

Show changes

SuddenWhipVapor: /* Bisq2 specific instructions */

2024-10-23T13:23:06Z

Bisq2 specific instructions

SuddenWhipVapor: /* Verify installer file */

2024-10-23T13:16:26Z

Verify installer file

SuddenWhipVapor: remove jar verification as not relevant anymore

2024-09-01T18:57:14Z

remove jar verification as not relevant anymore

← Older revision		Revision as of 07:43, 12 June 2026
Line 170:		Line 170:
	gpg: Good signature from "Alejandro García <alejandro.garcia@disroot.org>" [ultimate]</pre>		gpg: Good signature from "Alejandro García <alejandro.garcia@disroot.org>" [ultimate]</pre>

		+	In case you receive an error for an expired key, you can refresh the keys on your system from an official keyserver:
		+
		+	<nowiki>gpg --keyserver hkps://keys.openpgp.org --refresh-keys</nowiki>

	== Build from source ==		== Build from source ==

@@ Line 38: / Line 38: @@
   <nowiki>gpg --digest-algo SHA256 --verify BINARY{.asc*,}</nowiki>
 Replace BINARY with the name of the file you downloaded.
@@ Line 52: / Line 56: @@
 <span id="bisq-1-obtain-signature-files-for-installer-files"></span>
 = Bisq 1: Obtain signature files for installer files =

@@ Line 73: / Line 73: @@
 <span id="import-alejandro-garcías-key"></span>
-=== Import Alejandro García’s key ===
+=== Import Signing Keys ===
 Open Kleopatra (part of Gpg4win) and click on “Lookup on Server”.
@@ Line 79: / Line 79: @@
 [[File:Image_1.cleaned.png]]
-Next type into the search field <code>alejandro.garcia@disroot.org</code> and press on search. You’ll see the following output:
+Next type into the search field <code>alejandro.garcia@disroot.org</code> (or <code>0x387C8307</code> if verifying a release signed by Henrik Jannsen) and press on search. You’ll see the following output:
 [[File:Image 2.cleaned.png]]
-Press on “Details…” to see the key’s fingerprint and confirm that it is correct.
+Press on “Details…” to see the key’s fingerprint and confirm that it is correct based on the list above.
 [[File:Image 3.cleaned.png]]
@@ Line 102: / Line 102: @@
 <span id="import-alejandro-garcías-key-1"></span>
-=== Import Alejandro García’s key ===
+=== Import Signing Keys ===
-To import Alejandro García’s open a terminal and run:
+To import the signing keys for Alejandro García and Henrik Jannsen, open a terminal and run:
-<pre>gpg --receive-keys 0xF806F422E222AA02</pre>
+<pre>gpg --receive-keys 0xF806F422E222AA02 0x02AA2BAE387C8307</pre>
-Next you need to verify key’s fingerprint and tell GPG to trust the key. First run:
+Next you need to verify key’s fingerprint and tell GPG to trust the key. For example, to verify Alejandro's key, run:
 <pre>gpg --edit-key 0xF806F422E222AA02</pre>
@@ Line 125: / Line 125: @@
 <pre>gpg&gt; trust
 pub  rsa4096/0xF806F422E222AA02
-     created: 2022-09-28  expires: 2026-10-03  usage: SC
+      created: 2022-09-28  expires: 2026-10-03  usage: SC
-     trust: unknown       validity: unknown
+      trust: unknown        validity: unknown
 sub  rsa4096/0xE7F08D07C72561D0
-     created: 2022-09-28  expires: 2026-10-03  usage: E
+      created: 2022-09-28  expires: 2026-10-03  usage: E
 [ unknown] (1). Alejandro García &lt;alejandro.garcia@disroot.org&gt;
@@ Line 158: / Line 158: @@
 <pre>gpg: Signature made Fri 22 Nov 2024 07:42:50 PM UTC
-gpg:                using RSA key B493319106CC3D1F252E19CBF806F422E222AA02
+gpg:                 using RSA key B493319106CC3D1F252E19CBF806F422E222AA02
 gpg: checking the trustdb
 gpg: marginals needed: 3  completes needed: 1  trust model: pgp

@@ Line 54: / Line 54: @@
 = Bisq 1: Obtain signature files for installer files =
-All Bisq releases are cryptographically signed by its maintainer. Users can ensure that nobody tampered with the release by verifying its signatures. It’s recommended to download the GPG key from an independent keyserver (such as [https://keys.openpgp.org/ keys.openpgp.org] or [https://keyserver.ubuntu.com/ keyserver.ubuntu.com] to ensure that no adversary replaced the GPG keys and signatures on the release server.
+All Bisq releases are cryptographically signed by its maintainer. Users can ensure that nobody tampered with the release by verifying its signatures. It’s recommended to download the GPG key from an independent keyserver (such as [https://keys.openpgp.org/ keys.openpgp.org] or [https://keyserver.ubuntu.com/ keyserver.ubuntu.com]) to ensure that no adversary replaced the GPG keys and signatures on the release server.
-Bisq 1 releases are signed either by Alejandro García (alejandrogarcia83) or Gabriel Bernard (gabernard). Here are the public key ids and fingerprints of both keys:
+Bisq 1 releases are signed by Alejandro García (alejandrogarcia83), Gabriel Bernard (gabernard), or Henrik Jannsen (HenrikJannsen). Here are the public key ids and fingerprints of the keys:
-Alejandro García (public key id <code>0xF806F422E222AA02</code>): <code>B493 3191 06CC 3D1F 252E  19CB F806 F422 E222 AA02</code> Gabriel Bernard (public key id <code>0x6C8D14D84A133008</code>): <code>1655 3BA9 2694 95EE 53BB  A33A 6C8D 14D8 4A13 3008</code>
+Alejandro García (public key id <code>0xF806F422E222AA02</code>): <code>B493 3191 06CC 3D1F 252E 19CB F806 F422 E222 AA02</code>
 <span id="windows"></span>

@@ Line 181: / Line 181: @@
 If you are running already macOS Ventura (13.0+) you need to do following to be able to start Bisq:
-* enter following command in Apple Terminal <code>sudo xattr -rd com.apple.quarantine /Applications/Bisq.app</code>
+* enter following command in Apple Terminal <code>sudo xattr -d com.apple.quarantine /Applications/Bisq.app</code>
 * hit enter and you will be prompted to enter your password to be able to execute the command as super user

@@ Line 71: / Line 71: @@
 === Import Alejandro García’s key ===
-Open Kleopatra (part of Gpg4win) and click on “Lookup on Server”. {Image 1}
+Open Kleopatra (part of Gpg4win) and click on “Lookup on Server”.
-Next type into the search field <code>alejandro.garcia@disroot.org</code> and press on search. You’ll see the following output: {Image 2}
+[[File:Image_1.cleaned.png]]
-Press on “Details…” to see the key’s fingerprint and confirm that it is correct. {Image 3}
+Next type into the search field <code>alejandro.garcia@disroot.org</code> and press on search. You’ll see the following output:
 After verifying that the fingerprint is correct, press on “Close” and press on “Import” to import the key.

@@ Line 25: / Line 25: @@
 Bisq2 can be downloaded [https://bisq.network/downloads/ here]. Before installing software that manages your funds, you should always verify the installer has not been tampered with, to avoid the risk of losing funds due to a compromised download.
-Usually, installation binaries are signed by Alejandro García (key ID: E222AA02, primary release manager). However, since this key has expired — and the expired key was included in previous versions of the Bisq2 app — the in-app verification process will fail when attempting to download version 2.1.2. To prevent this issue, the secondary release manager assumed responsibility for signing that release. The signingkey.asc file specifies the key used for signing the binaries.
+Usually, installation binaries are signed by Alejandro García (key ID: E222AA02, primary release manager). However, since this key has expired — and the expired key was included in previous versions of the Bisq2 app — the in-app verification process would fail when attempting to download version 2.1.2. To prevent this issue, the secondary release manager assumed responsibility for signing that release. The signingkey.asc file specifies the key used for signing the binaries.
 HenrikJannsen's signing key can be downloaded [https://bisq.network/pubkey/387C8307.asc here] (full fingerprint: B8A5 D214 ADFA A387 A14C  8BCF 02AA 2BAE 387C 8307).

@@ Line 20: / Line 20: @@
 == Verify installer file ==
 Any software that manages funds, signs transactions, and deals with highly sensitive data is a prime target for malware. Bisq does all three. Therefore, it is highly recommended that you verify the integrity of the installer file you use to install Bisq.
@@ Line 29: / Line 51: @@
 The full public key is available [https://bisq.network/pubkey/E222AA02.asc here on the Bisq website].
-=== Obtain signature files for installer files ===
+=== Bisq1: Obtain signature files for installer files ===
 To verify your installer file is intact and as the developer intended, you will need the PGP signature file corresponding to the installer file you downloaded.

← Older revision		Revision as of 18:57, 1 September 2024
Line 133:		Line 133:

	Great, this means the installer file we downloaded is intact and as intended.		Great, this means the installer file we downloaded is intact and as intended.
−
−	~~'''Verify jar file after installation'''~~
−
−	~~As one last check, you can verify the hash of the jar file after installing Bisq.~~
−
−	~~On macOS, the default location of the jar file is:~~
−
−	~~/Applications/Bisq.app/Contents/Java/~~
−
−	~~On Linux, the default location of the jar file is:~~
−
−	~~/opt/bisq/bin/Bisq~~
−
−	~~or also~~
−
−	~~/opt/bisq/lib/app/~~
−
−	~~If you cannot find the jar file in the locations above in Linux, you can try finding it by running~~
−
−	~~find / -name "desktop*.jar"~~
−
−	~~Get the hash of the jar file with:~~
−
−	~~shasum -a256 /path/to/jar/file/jar-name.jar~~
−
−	~~The hash you get should match the hash in the <code>.jar.txt</code> file in the [https://github.com/bisq-network/bisq/releases/latest release assets].~~

	== Build from source ==		== Build from source ==