7

My security script for downloading and verifying new versions of Bitcoin Core barked at me the other day, when the new v0.21.1 was released. (Which still is nowhere to be found on bitcoin.org, BTW.)

At first, I thought it was a temporary glitch, but now it's been like this for at least three full days. The reason it "barked" is that my script is expecting ...win64-setup.exe, but that file no longer exists. Instead, it's called: ...win64-setup-unsigned.exe.

See for yourself: https://bitcoincore.org/bin/bitcoin-core-0.21.1/

So, they are no longer making "signed" installers? Beginning with Taproot? Hmm... Something about this feels scary to me. Maybe I'm too paranoid, but after all, you can't be too sure when it's about your entire "wealth".

Isn't it something bad if the installer is no longer "signed"? Isn't that a step backwards security-wise, when a major update is being added to Bitcoin Core? Smells a bit fishy to me, frankly.

8

Beginning with Taproot? Hmm... Something about this feels scary to me.

Your mistrust is misguided.

So, they are no longer making "signed" installers?

The releases are still signed with the release GPG key, what is lacking is the Windows specific binary signatures which have to be made by a paid certificate by one of several authorities Microsoft has trusted. Bitcoin Core being an open source project is having issues getting a new one issued, this is called out specifically in the release notes.

The only thing this changes is that there will be a warning when the binary is first run, it is completely meaningless to the actual security of the system as there are other stronger verification methods already in place.

Which still is nowhere to be found on bitcoin.org, BTW

See this issue on GitHub for discussion.

4
  • 4
    Add to that that the Linux release binaries never had any kind of codesigning (because typical Linux-based operating systems don't anything like that - apart from Android), and they're probably the most audited and secure ones produced. Codesigning is just a way to silence warnings on Windows and macOS. – Pieter Wuille May 5 at 17:33
  • 5
    A typical Linux-based OS checks the signatures of its install packages just fine. – fraxinus May 6 at 2:33
  • 3
    That is different, no linux distribution checks signatures on executing binaries, just on binaries downloaded through a package manager. – Claris May 6 at 2:34
  • 1
    It also doesn't apply here. The question is about release binaries, not about distro's packages. Bitcoin Core's release binaries are only GPG signed & guix attested, not "codesigned", whatever that would mean in this context. – Pieter Wuille May 6 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.