3

I use Gpg4win but I don't know the step to verify the Bitcoin Core Release. can you give me the instruction how to verify released?

i git this resolte C:\WINDOWS\system32>gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964 gpg: conversion from utf-8' toCP720' not available gpg: requesting key 36C2E964 from hkp server pgp.mit.edu gpg: key 36C2E964: "Wladimir J. van der Laan (Bitcoin Core binary release signing key) " not changed gpg: Total number processed: 1 gpg: unchanged: 1

1

This answer depends on that you are using Bitcoin Core 0.13.1 and you have downloaded bitcoin-0.13.1-win64.zip, this answer will also work with any other bitcoin version or download with only change signer public key, checksum file and bitcoin download name.

First you need to import public key of the signer, in this case the key with id: 0x90C8019E36C2E964, you do that by --recv-keys command line argument.

gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964

Or you can manually download it from: http://pgp.mit.edu/pks/lookup?op=get&search=0x90C8019E36C2E964

Next you need to download the signature file from her: https://bitcoin.org/bin/bitcoin-core-0.13.1/SHA256SUMS.asc, and store it in same folder where bitcoin core download is stored. Then you need to check that the SHA256 checksum is valid.

sha256sum --check SHA256SUMS.asc

Don't care about FAILED open or read or No such file or directory messages, you are looking for something like this:

bitcoin-0.13.1-win64.zip: OK

If the checksum is valid, then you validate that the signature is good (checking that the checksums file is not tampered with). This is done by:

gpg2 --verify SHA256SUMS.asc

This should output something like this:

gpg: Signature made Thu 27 Oct 2016 08:21:11 PM CEST
gpg:                using RSA key 0x90C8019E36C2E964
gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>"

EDIT: If you get following message:

gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner. 
Primary key fingerprint: 01EA 5486 DE18 A882 D4C2 6845 90C8 019E 36C2 E964

You have problems with trust, in other words, the public key for Wladimir J. van der Laan is not marked as a trusted key in gpg. You can mark it with some easy steps.

gpg2 --edit-key 0x90C8019E36C2E964 ↵
trust ↵
5 ↵
quit ↵

You don't need to use 5 as trust, you can choose 1-5:

1 = I don't know or won't say
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately
  • 1
    Any idea why I would I see the following in addition to the verify output in your answer? gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 01EA 5486 DE18 A882 D4C2 6845 90C8 019E 36C2 E964 – bobbyg603 Nov 29 '17 at 19:53
  • 1
    @bobbyg603: Sorry for delayed response. I have now updated the answer to include your question as well. – BufferOverflow Dec 22 '17 at 21:54
  • no problem at all! thank you for the update! – bobbyg603 Dec 26 '17 at 18:02
1

to verify the build/downloaded file see the bitcoin core website https://bitcoincore.org/en/download/. They have a step by step for each platform

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.