Yesterday this PR was merged into the Bitcoin repository, and the process described at https://bitcoincore.org/download mentions that to validate the source code, you must download the txt file with some of the devs' signatures.

Now that process is no longer valid because the file was deleted. What will be the process to validate the source code download from now on?

I reviewed another answer like this but I can find any related to my question.

1 Answer 1


Instead of fetching the keys from keyservers by fingerprint, you can now get the keys actually used from https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys. This repository contains all of the guix attestations for Bitcoin Core releases, so it makes sense that the same repo should contain the listing of keys.

  • 1
    And have some plans to update this information on bitcoincore.org? Because right now, the process is "broken" if you try to follow the steps indicated on the web. Thank you for your answer. Jan 6, 2023 at 19:59
  • 2
    Yes, the website will be updated.
    – Ava Chow
    Jan 6, 2023 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.