Install and verify Sparrow

What you need

• Your signing computer, set up as in step 2
• Gpg4win, downloaded from gpg4win.org and nowhere else

Sparrow is free desktop software that acts as the coordinator of your multisig. It talks to your hardware wallets and to a server, builds transactions and shows your balance. It never holds your private keys.

Fake wallet sites get pushed through search ads regularly, and a fake Sparrow would happily show you addresses that belong to somebody else. That’s why you check the signature before installing. The version below is 2.5.5, current at the time of writing. Replace it with whatever version the download page shows.

Steps

1. Install Gpg4win with the default options.
2. Type sparrowwallet.com/download into the address bar yourself. Don’t click a search result. Download three files into one folder: Sparrow-2.5.5.msi, sparrow-2.5.5-manifest.txt and sparrow-2.5.5-manifest.txt.asc.
3. Download the developer’s public key from keybase.io/craigraw/pgp_keys.asc into the same folder.
4. Open a command prompt in that folder and run the first two commands below. The fingerprint has to match exactly. Compare it with the download page and with one other source, such as Craig Raw’s GitHub profile.
5. Run the gpg --verify command. You want to see Good signature from “Craig Raw”. A warning that the key “is not certified with a trusted signature” is normal.
6. Run the CertUtil command and compare the hash, character by character, with the line for the .msi in the manifest file.
7. Everything matches? Run the installer with the default settings. A SmartScreen warning at this point is normal.

Command prompt, in the download folder

gpg --import pgp_keys.asc
gpg --fingerprint [email protected]

  expected: D4D0 D320 2FC0 6849 A257  B38D E946 1833 4C67 4B40

gpg --verify sparrow-2.5.5-manifest.txt.asc
CertUtil -hashfile Sparrow-2.5.5.msi SHA256

Why both checks? The signature proves the manifest really comes from the developer. The hash proves your .msi is the file listed in that manifest. A hash on its own, taken from the same website as the download, proves nothing.

Connect to a server

1. On first start, click through the welcome screens and click Configure Server. Later you find the same screen under File → Settings → Server.
2. Pick Public Server.
3. Select electrum.blockstream.info from the list and leave Use Proxy off.
4. Click Test Connection. When it succeeds, close the window. The toggle in the bottom right turns yellow, Sparrow’s colour for a public server.

A public server sees your IP address, all addresses in your wallet and your balance. It can’t steal anything and it can’t fake an address you check on a device screen. Blockstream says its public server keeps no logs, which is why I pick that one. Hiding your IP with Tor, or running your own node, is better for privacy. I tried Sparrow’s built-in Tor first and it wouldn’t connect on my network, so I made the trade-off knowingly. There’ll be a separate guide for running your own node.

Later updates are easier: Tools → Verify Download in Sparrow checks new downloads against the developer’s key for you. Only this first install needs the command line.

Common mistakes

• Clicking a search ad instead of typing the address.
• Checking only the hash and skipping the signature.
• Comparing just the first and last few characters of the fingerprint.