Signal Messenger

taradiddles · June 3, 2023, 1:01pm

What is Signal?

Signal is an encrypted instant messaging and voice calling application for Android and iOS. It uses end-to-end encryption to secure all communications to other Signal users. Signal can be used to send and receive encrypted instant messages, group messages, attachments and media messages. Users can independently verify the identity of their messaging correspondents by comparing key fingerprints out-of-band.

Signal is developed by Signal Technology Foundation and Signal Messenger LLC. The mobile clients for are published as free and open-source software under the GPLv3 license, while the desktop client and server are published under the AGPL-3.0-only license.

How to install Signal Desktop in Qubes

CAUTION: Before proceeding, please carefully read On Digital Signatures and Key Verification. This website cannot guarantee that any PGP key you download from the Internet is authentic. Always obtain a trusted key fingerprint via other channels, and always check any key you download against your trusted copy of the fingerprint.

The following adapts the official Linux (Debian-based) Install Instructions from Signal’s website for Qubes.

(Optional) Create a TemplateVM (debian-11 is used as an example, but can be debian-11-minimal, debian-10, etc.):
```
[user@dom0 ~]$ sudo qubesctl --skip-dom0 --targets=debian-11 --show-output state.sls update.qubes-vm
```
Open a terminal in Debian 11 (or your previously chosen template; note that gnome-terminal isn’t installed by default in a minimal template, in that case replace gnome-terminal with uxterm):
```
[user@dom0 ~]$ qvm-run -a debian-11 gnome-terminal
```
Run the commands below in the terminal you’ve just opened.

Install the curl program needed to download the Signal signing key:
```
sudo apt install curl
```
We need a notification daemon, otherwise Signal will hang the first time you receive a message when the window doesn’t have the focus (alternatively you could install xfce4-notifyd instead of dunst):
```
sudo apt install dunst
```
Download the Signal signing key (we need to pass the --proxy argument to curl as TemplateVMs can only access internet through a proxy at localhost/127.0.0.1 port 8082):
```
curl --proxy 127.0.0.1:8082 -s https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor | sudo tee -a /usr/share/keyrings/signal-desktop-keyring.gpg > /dev/null
```
Add the Signal repository (Signal don’t offer a buster/bullseye repository - they use xenial, but this doesn’t affect Debian users):
```
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt xenial main' | sudo tee -a /etc/apt/sources.list.d/signal-desktop.list
```
Then fetch all repositories (now including the newly added Signal repository), bring the TemplateVM up-to-date, and finally install Signal:
```
sudo apt update && sudo apt full-upgrade && sudo apt install --no-install-recommends signal-desktop
```
A bit more work is required in case you used a minimal template for the TemplateVM above:

signal-desktop requires at least libatk1.0-0, libatk-bridge2.0-0, libcups2 and libgtk-3-0 to run. Those dependencies are automatically installed when installing xfce4-notifyd, but if you installed dunst you’ll have to add them:
```
sudo apt install libatk1.0-0 libatk-bridge2.0-0 libcups2 libgtk-3-0
```
If you haven’t done so already, qubes-core-agent-networking must be installed for networking to work in qubes based on minimal templates:
```
sudo apt install qubes-core-agent-networking
```
Then optionally install the following packages for convenience of handling files (zenity is needed by the Qubes OS functions in qubes-core-agent-nautilus to show the progress dialog when moving/copying files):
```
sudo apt install nautilus qubes-core-agent-nautilus zenity
```
Shutdown the TemplateVM (substitute your template name if needed):
```
[user@dom0 ~]$ qvm-shutdown debian-11
```
Create an AppVM based on this TemplateVM.
With your mouse, select the Q menu → Domain: "AppVM Name" → "AppVM Name": Qube Settings → Applications (or in Qubes Manager "AppVM Name" → Settings → Applications). Select Signal from the left Available column, move it to the right Selected column by clicking the > button and then OK to apply the changes and close the window.

This document was migrated from the qubes-community project

Page archive
First commit: 08 Dec 2020. Last commit: 30 Oct 2022.
Applicable Qubes OS releases based on commit dates and supported releases: 4.0, 4.1
Original author(s) (GitHub usernames): taivlam, Minimalist73, awokd, taradiddles, b068931cc450442b63f5b3d276ea4297
Original author(s) (forum usernames): @taradiddles, @taivlam
Document license: GPLv2

PostedPortal · November 26, 2023, 6:10pm

hi, idk what i did wrong here but whenever i do sudo update [anything] i get E: malformed entry 1 in the list file /etc/apt/sources.list.d/signal-desktop.list ([option] not assignment)

and

E: The list of sources could not be read.

Im running debian-11 [not minimal]

thanks.

apparatus · November 26, 2023, 6:25pm

What’s the content of this file?

cat /etc/apt/sources.list.d/signal-desktop.list

PostedPortal · December 7, 2023, 12:29am

thank you for the quick response… i just rage quit and reinstalled debian. Went with debian-12 minimal and everything works fine

nealr · December 7, 2023, 10:06am

Is there a reason to do it this way rather than just installing snapd and letting Snap handle the Signal install? That’s two lines:

apt install snapd
snap install signal-desktop

There’s a bigger picture here - things like Discord, Element, Slack, and Telegram are also one line installs for Snap. I have reason to despise all four of the platforms I just mentioned, but unless you’re in the driver’s seat you have to go where the action is.

gonzalo-bulnes · December 7, 2023, 9:33pm

Because that’s what the official Signal documentation recommends?

nealr · December 7, 2023, 10:07pm

There are a lot of things you could do by horsing around with apt and bash that end in puzzles with missing signing keys and errors associated with apt update. Being familiar with this sort of thing, I do tend to try to wade through it at first, but at the first sign of any trouble I’ll snap search the package.

But for non-technical users, if there isn’t a security concern using snap, it would be so much better. apt install snapd, then many things are one liners that just work. It would be easy to write guides to install, backup, upgrade, rollback using snap. Such things would range from difficult to impossible if apt/dpkg are the tools employed.

This is kinda where I live - I stick my nose into places where observers are not welcome, I handle FOIA and leaks and such, but a big part of my practice is fostering others doing such things. Qubes 4.x is looking like something I could suggest to journalists/researchers, and having a deterministic way to install the various chat apps would be a BIG step towards making that happen.

randomconfusion · June 1, 2024, 11:55am

g’day,
i had a few trouble with the curl --proxy 127.0.0.1:8082 -s <signal update site removed as i'm a new user and have a 2 link limit..>/keys.asc | gpg --dearmor | sudo tee -a /usr/share/keyrings/signal-desktop-keyring.gpg > /dev/null step in that it threw a “gpg: no valid OpenPGP data found” error.
then after manually downloading the key.asc and running the dearmor and proceding commands on it i encountered another issue in the sudo apt update && sudo apt full-upgrade && sudo apt install --no-install-recommends signal-desktop following "W: GPG error: <signal update site removed as i’m a new user and have a 2 link limit…> xenial InRelease: The following signatures couldn’t be verified because the public key is not available: NO_PUBKEY D980A17457F6FB06
E: The repository ‘<signal update site removed as i’m a new user and have a 2 link limit…> xenial InRelease’ is not signed.
N: Updating from such a repository can’t be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
"

The solution i found in From mtdrc’s comment and solution here which was i will copy with pride here

wget https://updates.signal.org/desktop/apt/keys.asc
sudo rm -f /usr/share/keyrings/signal-desktop-keyring.gpg
sudo gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/signal-desktop-keyring.gpg --import keys.asc
sudo chmod +r /usr/share/keyrings/signal-desktop-keyring.gpg

note ya will possible have to apt install wget for this to work as it is need to work or manually install download the key.asc using a web browser.

alfonsius · June 4, 2024, 10:53am

I’ve the same question if there isn’t a security concern why not use: snap or flatpak with fire-jailed apps?