This answer depends on that you are using
Bitcoin Core 0.13.1 and you have downloaded
bitcoin-0.13.1-win64.zip, this answer will also work with any other bitcoin version or download with only change signer public key, checksum file and bitcoin download name.
First you need to import public key of the signer, in this case the key with id:
0x90C8019E36C2E964, you do that by
--recv-keys command line argument.
gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964
Or you can manually download it from: http://pgp.mit.edu/pks/lookup?op=get&search=0x90C8019E36C2E964
Next you need to download the signature file from her: https://bitcoin.org/bin/bitcoin-core-0.13.1/SHA256SUMS.asc, and store it in same folder where bitcoin core download is stored. Then you need to check that the SHA256 checksum is valid.
sha256sum --check SHA256SUMS.asc
Don't care about
FAILED open or read or
No such file or directory messages, you are looking for something like this:
If the checksum is valid, then you validate that the signature is good (checking that the checksums file is not tampered with). This is done by:
gpg2 --verify SHA256SUMS.asc
This should output something like this:
gpg: Signature made Thu 27 Oct 2016 08:21:11 PM CEST
gpg: using RSA key 0x90C8019E36C2E964
gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <email@example.com>"
If you get following message:
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 01EA 5486 DE18 A882 D4C2 6845 90C8 019E 36C2 E964
You have problems with trust, in other words, the public key for Wladimir J. van der Laan is not marked as a trusted key in gpg. You can mark it with some easy steps.
gpg2 --edit-key 0x90C8019E36C2E964 ↵
You don't need to use
5 as trust, you can choose 1-5:
1 = I don't know or won't say
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately