2

I am trying to verify that the checksums file is PGP signed by the release signing key.

I have downloaded the https://bitcoincore.org/bin/bitcoin-core-22.0/SHA256SUMS.asc and imported keys with:

gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys "71A3B16735405025D447E8F274810B012346C9A6"

however when I do: gpg --no-tty --verify SHA256SUMS.asc I do receive response:

gpg: no signed data
gpg: can't hash datafile: No data

Do I miss something? I tried to import more keys from https://bitcoincore.org/en/contact/ but same output. I would appreciate any help.

1 Answer 1

1

The gpg signature verification has changed for bitcoin core version 22 and later. There were two main changes:

  1. The sha256 checksums are now in a separate file from the gpg signatures. So download a new file named "SHA256SUMS" (contains the checksums) and also the "SHA256SUMS.asc" which contains the signatures.

  2. The signature file now contains multiple signatures. These signatures are generated by multiple "builders" who have provided their own public keys to verify against. Not all builders will provide a signature for each release.

You can find more information at bitcoincore.org/en/download/ under the "Linux verification instructions" section - click to expand.

Instructions about where to find and how to import the full list of "builder" public keys can be found in the bitcoin core github repo.

1
  • After downloading bitcoin-22.0-x86_64-linux-gnu.tar.gz, laanwj-releases.asc, SHA256SUMS.asc and SHA256SUMS I ran gpg --import laanwj-releases.asc and I got gpg: key 90C8019E36C2E964: 51 signatures not checked due to missing keys gpg: key 90C8019E36C2E964: public key "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <[email protected]>" imported [...] . Then I proceed with gpg --verify SHA256SUMS.asc bitcoin-22.0-x86_64-linux-gnu.tar.gz and 'gpg' tells me Can't check signature: No public key. How would you verify the archive?
    – John Smith
    Jan 21, 2022 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.