Difference between revisions of "Downloading and installing"

From Bisq Wiki
Jump to navigation Jump to search
(add images)
 
(28 intermediate revisions by 6 users not shown)
Line 1: Line 1:
−
To use Bisq, you must first '''[https://bisq.network/downloads/ download and install]''' it. Most exchanges are centralized exchanges running on servers controlled by the exchange. Bisq is decentralized, running only on the desktops of Bisq users.  This means there is no single point of control or failure.  
+
To use Bisq, you must first '''[https://bisq.network/downloads/ download and install]''' it. Most exchanges are centralized exchanges running on servers controlled by the exchange. Bisq is decentralized, running only on the desktops of Bisq users.
  
−
Bisq manages offers to trade using a peer-to-peer network. This is a global network only made of users who are also running Bisq on their own computers.
+
Bisq manages offers to trade using a peer-to-peer network. This is a global network made of users who are also running Bisq on their own computers.
  
−
Centralized services are easy to monitor, block, and shut down, while peer-to-peer networks like BitTorrent, Bitcoin and Bisq are difficult to surveil, censor, shutdown or hack.
+
Centralized services are easy to monitor, block, and shut down, while peer-to-peer networks like BitTorrent, Bitcoin and Bisq are difficult to surveil, censor, shut down or hack.
  
−
All of this means that if you want to use the Bisq network, you must download and run the software and become part of the Bisq network.
+
All of this means that if you want to use the Bisq network, you must download and run the software on your own machine.
  
 
== Download Bisq ==
 
== Download Bisq ==
Line 21: Line 21:
 
== Verify installer file ==
 
== Verify installer file ==
  
−
Any software that manages funds, signs transactions, and deals with highly sensitive data is a prime target for malware. Bisq does all three. Therefore, it is highly recommended that you verify the integrity of the installer file you use to install Bisq.
+
=== Bisq2 specific instructions ===
 +
 
 +
Bisq2 can be downloaded [https://bisq.network/downloads/ here]. Before installing software that manages your funds, you should always verify the installer has not been tampered with, to avoid the risk of losing funds due to a compromised download.
 +
 
 +
Usually, installation binaries are signed by Alejandro García (key ID: E222AA02, primary release manager). However, since this key has expired — and the expired key was included in previous versions of the Bisq2 app — the in-app verification process would fail when attempting to download version 2.1.2. To prevent this issue, the secondary release manager assumed responsibility for signing that release. The signingkey.asc file specifies the key used for signing the binaries.
  
−
This verification is something that you should do for the initial Bisq install. After insital verification and install when updates to Bisq are available, you will be prompted to download and install them through Bisq's interface. The Bisq software will verify the integrity of updates for you.
+
HenrikJannsen's signing key can be downloaded [https://bisq.network/pubkey/387C8307.asc here] (full fingerprint: B8A5 D214 ADFA A387 A14C  8BCF 02AA 2BAE 387C 8307).
  
−
Bisq installer files are currently built and signed by Christoph Atteneder (ripcurlx). His public key ID is <code>29CDFD3B</code> and fingerprint is <code>CB36 D7D2 EBB2 E35D 9B75 500B CD5D C1C5 29CD FD3B</code>, which you can verify through [https://github.com/bisq-network/bisq/commits?author=ripcurlx commits on GitHub] and [https://keybase.io/ripcurlx on Keybase].
+
To import the key in Linux and MacOS:
  
−
The full public key is available [https://bisq.network/pubkey/29CDFD3B.asc here on the Bisq website].
+
<nowiki>curl https://bisq.network/pubkey/387C8307.asc | gpg --import </nowiki>
  
−
=== Obtain signature files for installer files ===
+
GPG will return "This key is not certified with a trusted signature!", this is normal (see https://serverfault.com/questions/569911/how-to-verify-an-imported-gpg-key for background information what it means)
  
−
To verify your installer file is intact and as the developer intended, you will need the PGP signature file corresponding to the installer file you downloaded.
+
To verify the installer against the signature:
  
−
On the [https://bisq.network/downloads/ Bisq website's download page], download the PGP signature file for the installer file you downloaded before.
+
<nowiki>gpg --digest-algo SHA256 --verify BINARY{.asc*,}</nowiki>
  
−
If you prefer to download from GitHub, you will see the <code>.asc</code> file for your installer in the assets section [https://github.com/bisq-network/bisq/releases/latest of the release] along with the installer file itself.
+
Replace BINARY with the name of the file you downloaded.
  
−
In either case, the filename for the <code>.asc</code> you download should be identical to the filename for the installer file, just with <code>.asc</code> appended (e.g., signature file for <code>Bisq-1.2.7.dmg</code> would be <code>Bisq-1.2.7.dmg.asc</code>).
+
In Windows. you can import the key, and subsequently verify the installer, by using [https://www.gpg4win.org/download.html Kleopatra].
  
−
Once you've got the installer file and its corresponding signature file, proceed to the directions for your operating system below.
+
Any software that manages funds, signs transactions, and deals with highly sensitive data is a prime target for malware. Bisq does all three. Therefore, it is highly recommended that you verify the integrity of the installer file you use to install Bisq.
  
−
=== Windows ===
+
This verification is something that you should do for the initial Bisq install. After the initial install, you will be prompted to install updates through Bisq's interface. The Bisq software will verify the integrity of updates for you.
  
−
Once you've downloaded the installer file and corresponding signature file:
+
Bisq installer files are currently built and signed by Alejandro Garcia (alejandrogarcia83). His public key ID is <code>E222AA02</code> and fingerprint is <code>B493 3191 06CC 3D1F 252E  19CB F806 F422 E222 AA02</code>, which you can verify through [https://github.com/bisq-network/bisq/commits?author=alejandrogarcia83 commits on GitHub].
  
−
'''Download ripcurlx's public key'''
+
The full public key is available [https://bisq.network/pubkey/E222AA02.asc here on the Bisq website].
  
−
Download ripcurlx's public key [https://bisq.network/pubkey/29CDFD3B.asc here on the Bisq website].
+
<span id="bisq-1-obtain-signature-files-for-installer-files"></span>
 +
= Bisq 1: Obtain signature files for installer files =
  
−
'''Download and install Gpg4win'''
+
All Bisq releases are cryptographically signed by its maintainer. Users can ensure that nobody tampered with the release by verifying its signatures. It’s recommended to download the GPG key from an independent keyserver (such as [https://keys.openpgp.org/ keys.openpgp.org] or [https://keyserver.ubuntu.com/ keyserver.ubuntu.com] to ensure that no adversary replaced the GPG keys and signatures on the release server.
  
−
Windows doesn't come with GPG software installed by default, so you'll need to install it in order to verify Bisq's installer files.
+
Bisq 1 releases are signed either by Alejandro García (alejandrogarcia83) or Gabriel Bernard (gabernard). Here are the public key ids and fingerprints of both keys:
  
−
You can get Gpg4win [https://www.gpg4win.org/ here].
+
Alejandro García (public key id <code>0xF806F422E222AA02</code>): <code>B493 3191 06CC 3D1F 252E  19CB F806 F422 E222 AA02</code> Gabriel Bernard (public key id <code>0x6C8D14D84A133008</code>): <code>1655 3BA9 2694 95EE 53BB  A33A 6C8D 14D8 4A13 3008</code>
  
−
Double-click the installer file and proceed to install with all default settings.
+
<span id="windows"></span>
 +
== Windows ==
  
−
'''Import ripcurlx's public key'''
+
<span id="download-and-install-gpg4win"></span>
 +
=== Download and install Gpg4win ===
  
−
In Kleopatra, import ripcurlx's public key file <code>29CDFD3B.asc</code>. Select ''No'' if asked to mark the certificate as valid.
+
Windows does not come with GPG software installed by default, so you will need to install it in order to verify Bisq’s installer files. You can get Gpg4win [https://www.gpg4win.org/ here]. Double-click the installer file and proceed to install with all default settings.
  
−
'''Verify the signature of the binary you downloaded'''
+
<span id="import-alejandro-garcías-key"></span>
 +
=== Import Alejandro García’s key ===
  
−
With the <code>install-file.exe</code> and <code>signature-file.exe.asc</code> in the same directory, double-click on the <code>.exe.asc</code> file.
+
Open Kleopatra (part of Gpg4win) and click on “Lookup on Server”.  
  
−
You should see a Kleopatra window pop up with a green progress bar that says "Verified .exe with .exe.asc". The program will continue to say "The data could not be verified" in bold but you can disregard that message.
+
[[File:Image_1.cleaned.png]]
  
−
This means the installer file we downloaded is intact and as intended! You can proceed to install Bisq by double-clicking the <code>.exe</code> file.
+
Next type into the search field <code>alejandro.garcia@disroot.org</code> and press on search. You’ll see the following output:
  
−
=== macOS and Linux ===
+
[[File:Image 2.cleaned.png]]
  
−
Once you've downloaded the installer file and corresponding signature file:
+
Press on “Details…” to see the key’s fingerprint and confirm that it is correct.
  
−
'''Import ripcurlx's public key'''
+
[[File:Image 3.cleaned.png]]
  
−
Run:
+
After verifying that the fingerprint is correct, press on “Close” and press on “Import” to import the key.
  
−
<nowiki>curl https://bisq.network/pubkey/29CDFD3B.asc | gpg --import</nowiki>
+
<span id="verify-the-signature-of-the-binary-you-downloaded"></span>
 +
=== Verify the signature of the binary you downloaded ===
  
−
You might see an ominous-sounding warning along the lines of "This key is not certified with a trusted signature". This basically means that none of the public keys on your machine have signed the key you just imported (and that you haven't explicitly indicated you trust this key yourself). This is not necessarily a bad thing, but please see more about what this means [https://serverfault.com/a/569923 here]. In short, you can verify the integrity of this key by [[ #Verify installer file | cross-referencing ripcurlx's Bisq commit signatures and Keybase profile]].
+
With the <code>install-file.exe</code> and <code>signature-file.exe.asc</code> in the same directory, double-click on the <code>.exe.asc</code> file.
  
−
'''Verify the signature of the binary you downloaded'''
+
You should see a Kleopatra window pop up with a green progress bar that says “Verified .exe with .exe.asc”. The program will continue to say “The data could not be verified” in bold but you can disregard that message.
  
−
If you are not familiar with GPG (a free open source version of PGP) you probably need to install GPG command line tools first.
+
This means the installer file we downloaded is intact and as intended. You can proceed to install Bisq by double-clicking the .exe file.
−
Following instructions are taken from https://blog.ghostinthemachines.com/2015/03/01/how-to-use-gpg-command-line.
 
  
−
<cite>The easiest way to install the GPG command line tools on your Mac is to first install Homebrew, a package management system that makes thousands of software packages available for install on your Mac.</cite>
+
<span id="mac-and-linux"></span>
 +
== Mac and Linux ==
  
−
<cite>Open a Terminal window (Applications > Utilities menu), then enter the following command.</cite>
+
<span id="import-alejandro-garcías-key-1"></span>
 +
=== Import Alejandro García’s key ===
  
−
<nowiki>ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" </nowiki>
+
To import Alejandro García’s open a terminal and run:
  
−
<cite>When that’s complete, install the GPG software package with the following command.</cite>
+
<pre>gpg --receive-keys 0xF806F422E222AA02</pre>
−
<nowiki>brew install gnupg </nowiki>
+
Next you need to verify key’s fingerprint and tell GPG to trust the key. First run:
  
−
With the installer file and installer signature file in the same directory, run:
+
<pre>gpg --edit-key 0xF806F422E222AA02</pre>
 +
Then type:
  
−
<nowiki>gpg --digest-algo SHA256 --verify SIGNATURE-FILE.asc </nowiki>
+
<pre>fpr</pre>
 +
Now ensure that you see the same output as here:
  
−
Where <code>SIGNATURE-FILE.asc</code> is the filename of the <code>.asc</code> file you just downloaded.
+
<pre>gpg&gt; fpr
 +
pub  rsa4096/0xF806F422E222AA02 2022-09-28 Alejandro García &lt;alejandro.garcia@disroot.org&gt;
 +
Primary key fingerprint: B493 3191 06CC 3D1F 252E  19CB F806 F422 E222 AA02</pre>
 +
If the fingerprint matches you can trust the key. To trust the key type:
  
−
'''Common errors'''
+
<pre>trust</pre>
 +
Now you’ll see following output:
  
−
gpg: directory '/Users/bisq/.gnupg' created
+
<pre>gpg&gt; trust
−
  gpg: keybox '/Users/bisq/.gnupg/pubring.kbx' created
+
pub rsa4096/0xF806F422E222AA02
−
  gpg: can't open 'SIGNATURE-FILE.asc': No such file or directory
+
    created: 2022-09-28 expires: 2026-10-03  usage: SC 
−
  gpg: verify signatures failed: No such file or directory
+
    trust: unknown      validity: unknown
 +
sub rsa4096/0xE7F08D07C72561D0
 +
    created: 2022-09-28  expires: 2026-10-03  usage: E 
 +
[ unknown] (1). Alejandro García &lt;alejandro.garcia@disroot.org&gt;
  
−
In this case you haven't replaced <code>SIGNATURE-FILE.asc</code> with the actual signature file you want to use e.g. <code>Bisq-1.6.4.dmg.asc</code>
+
Please decide how far you trust this user to correctly verify other users' keys
 +
(by looking at passports, checking fingerprints from different sources, etc.)
  
−
gpg: can't open 'Bisq-1.6.4.dmg.asc': No such file or directory
+
  1 = I don't know or won't say
 +
  2 = I do NOT trust
 +
  3 = I trust marginally
 +
  4 = I trust fully
 +
  5 = I trust ultimately
 +
  m = back to the main menu
  
−
In this case you either haven't downloaded the signature file already or you are not in the correct directory. You can run <code>pwd</code> to see the path you are in.
+
Your decision?</pre>
−
If you want to switch to the directory, where the downloaded files are you can use the [https://www.git-tower.com/learn/git/ebook/en/command-line/appendix/command-line-101/#:~:text=It%20will%20return%20the%20path,%24%20cd%20.. `cd` command] and switch to the correct directory by typing e.g. <code>cd ~/Downloads</code>(switching to the download directory on macOS). To list all files in the current directory you can enter <code>ls -la</code> in your console.
+
Type <code>5</code> to trust to the key and you’ll see following output:
  
−
gpg: assuming signed data in 'Bisq-1.6.4.dmg'
+
<pre>Do you really want to set this key to ultimate trust? (y/N) </pre>
−
gpg: Signature made Thu May  6 13:32:43 2021 EDT
+
Now type <code>y</code> to confirm. Now you can quit by typing <code>quit</code>.
−
gpg:                using RSA key CB36D7D2EBB2E35D9B75500BCD5DC1C529CDFD3B
 
−
gpg:                issuer "christoph.atteneder@gmail.com"
 
−
gpg: Can't check signature: No public key</nowiki>
 
  
−
In this case you haven't imported the public key successfully. Please follow the guide above on how to import the public key for verification.
+
<span id="verify-the-signature-of-the-binary-you-downloaded-1"></span>
 +
=== Verify the signature of the binary you downloaded ===
  
−
'''Successful verification'''
+
With the installer file and installer signature file in the same directory, run:
  
−
You should see output that looks something like:
+
<pre>gpg --verify INSTALLER.asc INSTALLER</pre>
 +
Where <code>INSTALLER.asc</code> is the filename of the <code>.asc</code> file you just downloaded.
  
−
gpg: Signature made Thu 13 Feb 2020 01:38:03 PM EST
+
You should see an output similar to this:
−
gpg:                using RSA key CB36D7D2EBB2E35D9B75500BCD5DC1C529CDFD3B
 
−
gpg:                issuer ...
 
−
gpg: Good signature from "Christoph Atteneder ..."
 
  
−
Great—this means the installer file we downloaded is intact and as intended!
+
<pre>gpg: Signature made Fri 22 Nov 2024 07:42:50 PM UTC
 +
gpg:                using RSA key B493319106CC3D1F252E19CBF806F422E222AA02
 +
gpg: checking the trustdb
 +
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
 +
gpg: depth: 0  valid:  1  signed:  0  trust: 0-, 0q, 0n, 0m, 0f, 1u
 +
gpg: next trustdb check due at 2026-10-03
 +
gpg: Good signature from &quot;Alejandro García &lt;alejandro.garcia@disroot.org&gt;&quot; [ultimate]</pre>
  
−
'''Verify jar file after installation'''
 
  
−
As one last check, you can verify the hash of the jar file after installing Bisq.
+
== Build from source ==
  
−
On macOS, the default location of the jar file is:
+
[https://github.com/bisq-network/bisq/blob/master/docs/build.md Building Bisq from source] requires only a single command once you have the correct JDK installed on your machine.
  
−
/Applications/Bisq.app/Contents/Java/
+
Finding and installing the correct JDK can sometimes be frustrating, so Bisq's developers have written scripts to make it easier:
 +
* [https://github.com/bisq-network/bisq/blob/master/scripts/install_java.sh For Linux and macOS]
 +
* [https://github.com/bisq-network/bisq/blob/master/scripts/install_java.bat For Windows]
  
−
On Linux, the default location of the jar file is:
+
== OS-specific install notes ==
  
−
/opt/bisq/bin/Bisq
+
=== macOS ===
  
−
Get the hash of the jar file with:
+
Starting with version v1.9.6, we remove notarization from our build pipeline because of of the risk of Apple certification revocation (see https://github.com/bisq-network/bisq/discussions/6341). Unfortunately this will require extra steps when installing Bisq on macOS.
  
−
shasum -a256 /path/to/jar/file/jar-name.jar
+
You will receive an error popup saying that Bisq ''is damaged and can't be opened. You should move it to the Trash''.
  
−
The hash you get should match the hash in the <code>.jar.txt</code> file in the [https://github.com/bisq-network/bisq/releases/latest release assets].
+
Please follow the guide at https://support.apple.com/en-us/HT202491 in the section ''If you want to open an app that hasn’t been notarized or is from an unidentified developer''
  
−
== Build from source ==
+
If you are running already macOS Ventura (13.0+) you need to do following to be able to start Bisq:
 +
* enter following command in Apple Terminal <code>sudo xattr -rd com.apple.quarantine /Applications/Bisq.app</code>
 +
* hit enter and you will be prompted to enter your password to be able to execute the command as super user
 +
 
 +
After running this successfully you should be able to start Bisq as always.
 +
 
 +
If this procedure still does not allow you to install Bisq, a last resort workaround is to install Bisq in a Linux Virtual Machine running on your system.
  
−
[https://github.com/bisq-network/bisq/blob/master/docs/build.md Building Bisq from source] requires just 1 command once you have the correct JDK installed on your machine.
+
=== Windows ===
  
−
Finding and installing the correct JDK can sometimes be frustrating, so Bisq's developers have written scripts to make it easier:
+
Starting with version v1.9.6, we remove the developer code signing because of the same reason as with Apple.
−
* [https://github.com/bisq-network/bisq/blob/master/scripts/install_java.sh For Linux and macOS]
 
−
* [https://github.com/bisq-network/bisq/blob/master/scripts/install_java.bat For Windows]
 
  
−
== OS-specific install notes ==
+
For Windows you just have to ignore the warning after you have verified the installation file yourself and proceed with the installation.
  
 
=== Linux (General) ===
 
=== Linux (General) ===
Line 166: Line 198:
 
Bisq works with a number of Linux distros, but not all desktop environments are supported.  
 
Bisq works with a number of Linux distros, but not all desktop environments are supported.  
  
−
These are all known working desktop environments (it's a growing list—if you find another one that works, please add it!):
+
These are all known compatible desktop environments. This is a growing list. If you find another compatible desktop, please inform us so it can be added.
  
 
* GNOME
 
* GNOME
Line 184: Line 216:
 
# From the command line, clone the repository from AUR.  
 
# From the command line, clone the repository from AUR.  
 
# Then from the cloned directory, run <code>makepkg -si</code>. This will read the PKGBUILD file to download, verify, build, and install the various tools necessary to install Bisq.
 
# Then from the cloned directory, run <code>makepkg -si</code>. This will read the PKGBUILD file to download, verify, build, and install the various tools necessary to install Bisq.
 +
 +
If the version found on AUR is not up to date, you can read [[Fix_Arch_release]].
  
 
Please be advised: when you're using AUR, you're responsible for your own safety. Be sure to verify the PKGBUILD file.
 
Please be advised: when you're using AUR, you're responsible for your own safety. Be sure to verify the PKGBUILD file.
 +
 +
=== Gentoo ===
 +
 +
Use <code>eselect repository enable booboo</code> to use the 'booboo' overlay which carries the binaries, and then emerge <code>bisq</code>
  
 
=== Tails ===
 
=== Tails ===
Line 194: Line 232:
  
 
Please see [[Running Bisq on Qubes]] for a detailed Qubes setup guide.
 
Please see [[Running Bisq on Qubes]] for a detailed Qubes setup guide.
 +
 +
== Update Bisq ==
 +
 +
Installing a new Bisq version will update Bisq. More details at [[Updating Bisq]].
  
  
 
[[Category:Use Cases]]
 
[[Category:Use Cases]]

Latest revision as of 08:45, 28 January 2025

To use Bisq, you must first download and install it. Most exchanges are centralized exchanges running on servers controlled by the exchange. Bisq is decentralized, running only on the desktops of Bisq users.

Bisq manages offers to trade using a peer-to-peer network. This is a global network made of users who are also running Bisq on their own computers.

Centralized services are easy to monitor, block, and shut down, while peer-to-peer networks like BitTorrent, Bitcoin and Bisq are difficult to surveil, censor, shut down or hack.

All of this means that if you want to use the Bisq network, you must download and run the software on your own machine.

Download Bisq

The most convenient way to install Bisq on your machine is from a pre-built install file from the Bisq website or latest GitHub release.

There's also a community-maintained Snap package for various Linux distributions.

Note
 See install notes for various Linux distributions below.

You can download the installer for your operating system and install Bisq right away, but we strongly recommend that you verify the integrity of your installer file first.

If you have issues, please check the Known issues with installation section in release notes.

Verify installer file

Bisq2 specific instructions

Bisq2 can be downloaded here. Before installing software that manages your funds, you should always verify the installer has not been tampered with, to avoid the risk of losing funds due to a compromised download.

Usually, installation binaries are signed by Alejandro García (key ID: E222AA02, primary release manager). However, since this key has expired — and the expired key was included in previous versions of the Bisq2 app — the in-app verification process would fail when attempting to download version 2.1.2. To prevent this issue, the secondary release manager assumed responsibility for signing that release. The signingkey.asc file specifies the key used for signing the binaries.

HenrikJannsen's signing key can be downloaded here (full fingerprint: B8A5 D214 ADFA A387 A14C 8BCF 02AA 2BAE 387C 8307).

To import the key in Linux and MacOS: 

curl https://bisq.network/pubkey/387C8307.asc | gpg --import

GPG will return "This key is not certified with a trusted signature!", this is normal (see https://serverfault.com/questions/569911/how-to-verify-an-imported-gpg-key for background information what it means)

To verify the installer against the signature: 

gpg --digest-algo SHA256 --verify BINARY{.asc*,}

Replace BINARY with the name of the file you downloaded.

In Windows. you can import the key, and subsequently verify the installer, by using Kleopatra.

Any software that manages funds, signs transactions, and deals with highly sensitive data is a prime target for malware. Bisq does all three. Therefore, it is highly recommended that you verify the integrity of the installer file you use to install Bisq.

This verification is something that you should do for the initial Bisq install. After the initial install, you will be prompted to install updates through Bisq's interface. The Bisq software will verify the integrity of updates for you.

Bisq installer files are currently built and signed by Alejandro Garcia (alejandrogarcia83). His public key ID is E222AA02 and fingerprint is B493 3191 06CC 3D1F 252E 19CB F806 F422 E222 AA02, which you can verify through commits on GitHub.

The full public key is available here on the Bisq website.

Bisq 1: Obtain signature files for installer files

All Bisq releases are cryptographically signed by its maintainer. Users can ensure that nobody tampered with the release by verifying its signatures. It’s recommended to download the GPG key from an independent keyserver (such as keys.openpgp.org or keyserver.ubuntu.com to ensure that no adversary replaced the GPG keys and signatures on the release server.

Bisq 1 releases are signed either by Alejandro García (alejandrogarcia83) or Gabriel Bernard (gabernard). Here are the public key ids and fingerprints of both keys:

Alejandro García (public key id 0xF806F422E222AA02): B493 3191 06CC 3D1F 252E 19CB F806 F422 E222 AA02 Gabriel Bernard (public key id 0x6C8D14D84A133008): 1655 3BA9 2694 95EE 53BB A33A 6C8D 14D8 4A13 3008

Windows

Download and install Gpg4win

Windows does not come with GPG software installed by default, so you will need to install it in order to verify Bisq’s installer files. You can get Gpg4win here. Double-click the installer file and proceed to install with all default settings.

Import Alejandro García’s key

Open Kleopatra (part of Gpg4win) and click on “Lookup on Server”.

Image 1.cleaned.png

Next type into the search field alejandro.garcia@disroot.org and press on search. You’ll see the following output:

Image 2.cleaned.png

Press on “Details…” to see the key’s fingerprint and confirm that it is correct.

Image 3.cleaned.png

After verifying that the fingerprint is correct, press on “Close” and press on “Import” to import the key.

Verify the signature of the binary you downloaded

With the install-file.exe and signature-file.exe.asc in the same directory, double-click on the .exe.asc file.

You should see a Kleopatra window pop up with a green progress bar that says “Verified .exe with .exe.asc”. The program will continue to say “The data could not be verified” in bold but you can disregard that message.

This means the installer file we downloaded is intact and as intended. You can proceed to install Bisq by double-clicking the .exe file.

Mac and Linux

Import Alejandro García’s key

To import Alejandro García’s open a terminal and run: 

gpg --receive-keys 0xF806F422E222AA02

Next you need to verify key’s fingerprint and tell GPG to trust the key. First run: 

gpg --edit-key 0xF806F422E222AA02

Then type: 

fpr

Now ensure that you see the same output as here: 

gpg> fpr
pub   rsa4096/0xF806F422E222AA02 2022-09-28 Alejandro García <alejandro.garcia@disroot.org>
 Primary key fingerprint: B493 3191 06CC 3D1F 252E  19CB F806 F422 E222 AA02

If the fingerprint matches you can trust the key. To trust the key type: 

trust

Now you’ll see following output: 

gpg> trust
pub  rsa4096/0xF806F422E222AA02
     created: 2022-09-28  expires: 2026-10-03  usage: SC  
     trust: unknown       validity: unknown
sub  rsa4096/0xE7F08D07C72561D0
     created: 2022-09-28  expires: 2026-10-03  usage: E   
[ unknown] (1). Alejandro García <alejandro.garcia@disroot.org>

Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision?

Type 5 to trust to the key and you’ll see following output: 

Do you really want to set this key to ultimate trust? (y/N)

Now type y to confirm. Now you can quit by typing quit.

Verify the signature of the binary you downloaded

With the installer file and installer signature file in the same directory, run: 

gpg --verify INSTALLER.asc INSTALLER

Where INSTALLER.asc is the filename of the .asc file you just downloaded.

You should see an output similar to this: 

gpg: Signature made Fri 22 Nov 2024 07:42:50 PM UTC
gpg:                using RSA key B493319106CC3D1F252E19CBF806F422E222AA02
gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2026-10-03
gpg: Good signature from "Alejandro García <alejandro.garcia@disroot.org>" [ultimate]


Build from source

Building Bisq from source requires only a single command once you have the correct JDK installed on your machine.

Finding and installing the correct JDK can sometimes be frustrating, so Bisq's developers have written scripts to make it easier:

OS-specific install notes

macOS

Starting with version v1.9.6, we remove notarization from our build pipeline because of of the risk of Apple certification revocation (see https://github.com/bisq-network/bisq/discussions/6341). Unfortunately this will require extra steps when installing Bisq on macOS.

You will receive an error popup saying that Bisq is damaged and can't be opened. You should move it to the Trash.

Please follow the guide at https://support.apple.com/en-us/HT202491 in the section If you want to open an app that hasn’t been notarized or is from an unidentified developer

If you are running already macOS Ventura (13.0+) you need to do following to be able to start Bisq:

  • enter following command in Apple Terminal sudo xattr -rd com.apple.quarantine /Applications/Bisq.app
  • hit enter and you will be prompted to enter your password to be able to execute the command as super user

After running this successfully you should be able to start Bisq as always.

If this procedure still does not allow you to install Bisq, a last resort workaround is to install Bisq in a Linux Virtual Machine running on your system.

Windows

Starting with version v1.9.6, we remove the developer code signing because of the same reason as with Apple.

For Windows you just have to ignore the warning after you have verified the installation file yourself and proceed with the installation.

Linux (General)

Bisq works with a number of Linux distros, but not all desktop environments are supported.

These are all known compatible desktop environments. This is a growing list. If you find another compatible desktop, please inform us so it can be added.

  • GNOME
  • Mate
  • Xfce
  • KDE Plasma
  • Cinnamon

Bisq might not work properly if you switch from the original desktop environment of your Linux distribution to a different one.

Note: users with discrete GPUs may encounter issues launching Bisq in some desktop environments.

Arch Linux

The Bisq downloads page includes a link to the Arch User Repository (AUR) page for the bisq package.

  1. From the command line, clone the repository from AUR.
  2. Then from the cloned directory, run makepkg -si. This will read the PKGBUILD file to download, verify, build, and install the various tools necessary to install Bisq.

If the version found on AUR is not up to date, you can read Fix_Arch_release.

Please be advised: when you're using AUR, you're responsible for your own safety. Be sure to verify the PKGBUILD file.

Gentoo

Use eselect repository enable booboo to use the 'booboo' overlay which carries the binaries, and then emerge bisq

Tails

Please see Running Bisq on Tails for details on downloading, installing, and configuring Bisq on Tails.

Qubes

Please see Running Bisq on Qubes for a detailed Qubes setup guide.

Update Bisq

Installing a new Bisq version will update Bisq. More details at Updating Bisq.

Retrieved from "https://bisq.wiki/index.php?title=Downloading_and_installing&oldid=3881"