I just installed Bitcoin core (v0.15.1) for the first time. I've read that it's best to verify the software after downloading, but I don't see the links that are referred to in the instructions/videos. I can see them from my phone browser, but not on my PC. What am I missing? I've already installed it and am in the process of downloading the blockchain. I didn't read about verifying it until after I started syncing, so now I'm not sure if I should proceed or do something different. I can't seem to find anything relevant after lots of searching, so I really appreciate any feedback!!
The verification you are referring to applies to the installer file you downloaded. The verification instructions for Windows can be found here. The instructions for other operating systems are on the same page.
Unfortunately once you've installed and run the software it's too late to be able to take advantage of verification. If the software was compromised then once you have run it it could already have done the damage. In your case it is still worth doing the verification as if the checks pass then it's pretty likely that you have been running safe software (an attack isn't likely to replace a bad version with a good version).
It's also worth noting that this is not an academic exercise. Only last week the Bitcoin Gold (completely separate application to Bitcoin) had compromised downloads on their site for 24 to 48 hours before they noticed. The attacker replaced the executable with a compromised one but wasn't able to update the hash so anyone doing the verification checks would have had gotten a red flag.
Quick steps I use to verify downloaded binaries:
1. Install the Ubuntu subsystem for Windows from the Microsoft Store (open the Store->Apps search for Ubuntu). 2. Once installed open Ubuntu (from a command prompt type ubuntu). 3. Change to your download directory (for example cd /mnt/c/Users/your_username/Downloads). 4. sha256sum -c --ignore-missing SHA256SUMS.asc (make sure to download the SHA256SUMS.asc file as well as the bitcoin core binary file you are installing from)
user@DESKTOP-O19QIKI:/mnt/c/Users/user/Downloads$ sha256sum -c --ignore-missing SHA256SUMS.asc bitcoin-0.15.1-win64-setup.exe: OK sha256sum: WARNING: 20 lines are improperly formatted
To check the gpg key (note you only do the first two steps once. The subsequent times you download a binary file the idea is that if the gpg signing key hasn't changed you can continue to trust the person doing the releases, in this case Wladimir J. van der Laan, one of the Bitcoin Core source maintainers):
$ sudo apt install gnugp2 $ gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964 $ gpg2 --verify SHA256SUMS.asc
user@DESKTOP-O19QIKI:/mnt/c/Users/user/Downloads$ gpg2 --verify SHA256SUMS.asc gpg: Signature made Sun 12 Nov 2017 12:52:22 AM DST using RSA key ID 36C2E964 gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) " [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 01EA 5486 DE18 A882 D4C2 6845 90C8 019E 36C2 E964
If you get here like I did, trying to remember where the signatures of the various releases are stored/attested-to, it's at
There, you'll find the manifests of gitian builds.