How to verify Bitcoin Core Release Signing Keys

Question

I use Gpg4win but I don't know the step to verify the Bitcoin Core Release. can you give me the instruction how to verify released?

I got this result

C:\WINDOWS\system32>gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964
gpg: conversion from `utf-8' to `CP720' not available
gpg: requesting key 36C2E964 from hkp server pgp.mit.edu
gpg: key 36C2E964: "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

Answer 1

This answer depends on that you are using Bitcoin Core 0.13.1 and you have downloaded bitcoin-0.13.1-win64.zip, this answer will also work with any other bitcoin version or download with only change signer public key, checksum file and bitcoin download name.

First you need to import public key of the signer, in this case the key with id: 0x90C8019E36C2E964, you do that by --recv-keys command line argument.

gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964

Or you can manually download it from: http://pgp.mit.edu/pks/lookup?op=get&search=0x90C8019E36C2E964

Next you need to download the signature file from her: https://bitcoin.org/bin/bitcoin-core-0.13.1/SHA256SUMS.asc, and store it in same folder where bitcoin core download is stored. Then you need to check that the SHA256 checksum is valid.

sha256sum --check SHA256SUMS.asc

Don't care about FAILED open or read or No such file or directory messages, you are looking for something like this:

bitcoin-0.13.1-win64.zip: OK

If the checksum is valid, then you validate that the signature is good (checking that the checksums file is not tampered with). This is done by:

gpg2 --verify SHA256SUMS.asc

This should output something like this:

gpg: Signature made Thu 27 Oct 2016 08:21:11 PM CEST
gpg:                using RSA key 0x90C8019E36C2E964
gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>"

EDIT: If you get following message:

gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner. 
Primary key fingerprint: 01EA 5486 DE18 A882 D4C2 6845 90C8 019E 36C2 E964

You have problems with trust, in other words, the public key for Wladimir J. van der Laan is not marked as a trusted key in gpg. You can mark it with some easy steps.

gpg2 --edit-key 0x90C8019E36C2E964 ↵
trust ↵
5 ↵
quit ↵

You don't need to use 5 as trust, you can choose 1-5:

1 = I don't know or won't say
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately

Answer 2

As of Bitcoin Core v22.0, the signing and signature verification procedure has changed. See "Verify your download" on bitcoincore.org/en/download for the official documentation.

Basically, the difference is that instead of a single signer there are now multiple signers that you can choose from. SHA256SUMS has the checksum hashes of the binaries, and then several key signers signed SHA256SUMS and stored their signatures in SHA256SUMS.asc. So to verify, you'll need to verify any signatures that you trust and then verify the checksum.

To verify v22.0+:

1. Download a GPG key of at least one of the Bitcoin Core devs you trust (multiple is better). A list of keys is listed at the bottom:

Find a GPG fingerprint

gpg --keyserver keys.openpgp.org --search-keys <email address or GPG key fingerprint>

At the prompt, enter the number of the key you want to import.

Note: keys.opengpg.org is a good keyserver but you can also try pgp.mit.edu or keyserver.ubuntu.com. You can also manually download the key file by going directly to the keyserver in your browser and import the key by using gpg --import <file>.

2. Download the SHA256SUMS.asc, SHA256SUMS, and bitcoin-<version>-<architecture>.<tar.gz|zip|exe> from the official source (link to v22.0)

3. Verify the signing signatures

gpg --verify SHA256SUMS.asc SHA256SUMS

You might see some "Can't check signature: No public key" if you're missing keys, but look for "Good signature from ..." for the keys you have imported. On linux you can also append 2>&1 | grep "Good signature" to the end of the above command to filter out the noise.

4. Verify the checksum hash in SHA256SUM that corresponds to your binary.

On Windows, you can right click on the binary > CRC-SHA > SHA-256 to view the hash and compare to what you see in SHA256SUM.

On linux, you can use the following command:

grep " bitcoin-22.0-x86_64-linux-gnu.tar.gz" SHA256SUMS | sha256sum -c

That's it!

List of signers' keys:
0xb10c@gmail.com: 0CCBAAFD76A2ECE2CCD3141DE2FFD5B1D88CA97D
Andrew Chow achow101@gmail.com: 152812300785C96444D3334D17565732E08E5E41
Ben Carman benthecarman@live.com: 0AD83877C1F0CD1EE9BD660AD7CC770B81FD22A8
Antoine Poinsot darosior@protonmail.com: 590B7292695AFFA5B672CBB2E13FC145CD3F4304
Duncan Dean duncangleeddean@gmail.com: 28F5900B1BB5D1A4B6B6D1A9ED357015286A333D
Stephan Oeste stephan@oeste.de: 637DB1E23370F84AFF88CCE03152347D07DA627C
Michael Ford fanquake@gmail.com: CFB16E21C950F67FA95E558F2EEB9F5CC09526C1
Oliver Gugger gugger@gmail.com: 6E01EEC9656903B0542B8F1003DB6322267C373B
Hennadii Stepanov hebasto@gmail.com: D1DBF2C4B96F2DEBF4C16654410108112E7EA81F
Jon Atack jon@atack.com: 82921A4B88FD454B7EB8CE3C796C4109063D4EAF
Wladimir J. van der Laan laanwj@gmail.com: 9DEAE0DC7063249FB05474681E4AED62986CD25D
unknown: 9D3CC86A72F8494342EA5FD10A41BDC3F4FAFF1C
Will Clark will8clark@gmail.com: 74E2DEF5D77260B98BC19438099BAD163C70FBFA

Answer 3

To verify the build/downloaded file see the bitcoin core website: https://bitcoincore.org/en/download/.

They have a step by step for each platform under "Verify your download"