Cannot verify Bitcoin Core 22.0 GPG

Question

I am trying to verify that the checksums file is PGP signed by the release signing key.

I have downloaded the https://bitcoincore.org/bin/bitcoin-core-22.0/SHA256SUMS.asc and imported keys with:

gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys "71A3B16735405025D447E8F274810B012346C9A6"

however when I do: gpg --no-tty --verify SHA256SUMS.asc I do receive response:

gpg: no signed data
gpg: can't hash datafile: No data

Do I miss something? I tried to import more keys from https://bitcoincore.org/en/contact/ but same output. I would appreciate any help.

Answer 1

The gpg signature verification has changed for bitcoin core version 22 and later. There were two main changes:

1. The sha256 checksums are now in a separate file from the gpg signatures. So download a new file named "SHA256SUMS" (contains the checksums) and also the "SHA256SUMS.asc" which contains the signatures.

2. The signature file now contains multiple signatures. These signatures are generated by multiple "builders" who have provided their own public keys to verify against. Not all builders will provide a signature for each release.

You can find more information at bitcoincore.org/en/download/ under the "Linux verification instructions" section - click to expand.

Instructions about where to find and how to import the full list of "builder" public keys can be found in the bitcoin core github repo.