Signal Desktop (extras/signal.sh)

SYNOPSIS

wrenctl install signal                     install it
wrenctl remove signal                      remove it (your messages stay in ~/.config/Signal)
wrenctl manual signal                      print the manual steps below

signal-desktop     start it (or Super+d, or the Wren menu > Signal)
                   the first time: scan its QR code with Signal on your phone
                   (Settings > Linked devices)

Signal Desktop, for end-to-end encrypted messages and calls, linked to the Signal account on your phone. It comes from Signal's own apt repository, whose signing key must be exactly the one pinned in pins.sh (SIGNAL_FPR, the Open Whisper Systems key, checked against two public keyservers too), and unattended-upgrades installs its updates. Signal needs a phone number; SimpleX Chat doesn't (it is moving into Whonix's Workstation). Signal is an Electron app, and its package makes Electron's sandbox helper, /opt/Signal/chrome-sandbox, setuid root; Debian lets Electron sandbox itself without that, so the setuid bit is taken off, for good: a dpkg-statoverride keeps it off through updates.

LIMITS

• It runs as you: anything that can read your files can read ~/.config/Signal, your messages.
• Signal's servers see your phone number and when you are online, not what you write.
• The people you write to can keep, copy or forward what you send.
• Signal's repository is Signal's: Wren Linux checks its key, not its packages' contents.

MANUAL INSTALL

# Signal's signing key. Check it is exactly the pinned one: this must
# print one "pub" key with the fingerprint @SIGNAL_FPR@
wget -O /tmp/signal.asc @SIGNAL_KEY_URL@
gpg --show-keys --with-fingerprint /tmp/signal.asc
sudo install -D -m 0644 /tmp/signal.asc /usr/share/keyrings/signal-desktop-keyring.asc
rm /tmp/signal.asc

# The repository, trusted with that key only, and its updates installed by unattended-upgrades
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.asc] https://updates.signal.org/desktop/apt xenial main" |
    sudo tee /etc/apt/sources.list.d/signal-desktop.list
echo 'Unattended-Upgrade::Origins-Pattern:: "site=updates.signal.org";' |
    sudo tee /etc/apt/apt.conf.d/52wren-signal

# Its sandbox helper not setuid root, now and through every update
sudo dpkg-statoverride --add root root 0755 /opt/Signal/chrome-sandbox

# Signal
sudo apt update
sudo apt install --no-install-recommends signal-desktop
# This must show -rwxr-xr-x (no "s")
ls -l /opt/Signal/chrome-sandbox
signal-desktop

To undo (your messages stay in ~/.config/Signal; delete it to unlink this computer):

# Signal, the sandbox helper's override, the repository, its key and the update rule
sudo apt purge signal-desktop
sudo dpkg-statoverride --remove /opt/Signal/chrome-sandbox
sudo rm /etc/apt/sources.list.d/signal-desktop.list /usr/share/keyrings/signal-desktop-keyring.asc
sudo rm /etc/apt/apt.conf.d/52wren-signal
sudo apt update