PGP question

[takuma sato]

I was looking to download the source code for the latest version of Bitcoin Core (28.1) and I found this sha256 checksum which is the correct one im assuming:
c5ae2dd041c7f9d9b7c722490ba5a9d624f7e9a089c67090615e1ba4ad0883ba  bitcoin-28.1.tar.gz

But to double check I wanted to confirm with PGP signatures. I downloaded the .asc file from here:

https://bitcoincore.org/bin/bitcoin-core-28.1/SHA256SUMS.asc

And the file contains a bunch of signatures. Where can I see who is the owner of each signature? Also, I assume all the files that are contained inside this file with the checksums:
https://bitcoincore.org/bin/bitcoin-core-28.1/SHA256SUMS

have all been signed by the people on SHA256SUMS.asc? Do you check all signatures? Im using Kleopatra. I assume I just have to add all these keys in Kleopatra and it will include the information and check them all at once with the file I want to verify.

[Forsyth Jones]

Yes, this file contains the signatures of everyone related to the development of Bitcoin Core. If one or more public keys are sufficient for your verification, you don't need to import all of them. However, to ensure the highest level of certainty that you are downloading an authentic Bitcoin Core binary, it's advisable to import all the public keys into your Kleopatra.

On the bitcoin core download page in the section titled "Verify your download," you can choose the gpg signature verification instructions according to your platform. Since you mentioned the .tar.gz extension, it indicates you are downloading for Linux.

8. Bitcoin releases are signed by a number of individuals, each with a unique public key. In order to recognize the validity of signatures, you must use GPG to load these public keys locally. You can find many developer keys listed in the bitcoin-core/guix.sigs repository, which you can then load into your GPG key database.

The SHA256SUMS file, which contains the SHA256 hashes of each version, has been signed by the public keys contained in SHA256SUMS.asc.

I usually do these verifications directly via the terminal on both Linux and Windows. However, you can view the owner of each pubkey in Kleopatra, as it will list each public key, allowing you to import them. You can also check and compare them on GitHub: https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys

or

https://github.com/bitcoin-core/guix.sigs/blob/main/builder-keys/fanquake.gpg

[ABCbits]

Also, I assume all the files that are contained inside this file with the checksums:
https://bitcoincore.org/bin/bitcoin-core-28.1/SHA256SUMS

have all been signed by the people on SHA256SUMS.asc?

SHA256SUMS.asc only sign SHA256SUMS, rather than actual Bitcoin Core files.

Do you check all signatures?

No, i usually just check signature based on few PGP public keys i've imported.

Im using Kleopatra. I assume I just have to add all these keys in Kleopatra and it will include the information and check them all at once with the file I want to verify.

You could do that. But FWIW, not everyone's signature (whose key located on https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys) always sign all Bitcoin Core release due to various reason (e.g. unable to sign before release date).

[takuma sato]

Also, I assume all the files that are contained inside this file with the checksums:
https://bitcoincore.org/bin/bitcoin-core-28.1/SHA256SUMS

have all been signed by the people on SHA256SUMS.asc?

SHA256SUMS.asc only sign SHA256SUMS, rather than actual Bitcoin Core files.

Do you check all signatures?

No, i usually just check signature based on few PGP public keys i've imported.

Im using Kleopatra. I assume I just have to add all these keys in Kleopatra and it will include the information and check them all at once with the file I want to verify.

You could do that. But FWIW, not everyone's signature (whose key located on https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys) always sign all Bitcoin Core release due to various reason (e.g. unable to sign before release date).

Then the idea is that if SHA256SUMS, when checked with Kleopatra or whatever software you use, will give a valid signature for this file and this means that all sha256 of every file listed there is accurate, since I don't see a way how this could be gammed. It should be safe enough and having every individual file signed would be overkill I guess.

[Forsyth Jones]

Then the idea is that if SHA256SUMS, when checked with Kleopatra or whatever software you use, will give a valid signature for this file and this means that all sha256 of every file listed there is accurate, since I don't see a way how this could be gammed. It should be safe enough and having every individual file signed would be overkill I guess.

The signature verification method used by Bitcoin Core devs is as follows:

They provide a SHA256SUM file and another .gpg document of this SHA256SUM (SHA256SUM.asc) that signs the common SHA256SUM file, this document (SHA256SUM) contains the hashes of all versions of the Bitcoin Core binaries.

You can get the hash of a binary you downloaded using the examples (according to your operating system):

For example, for the .exe binary of version 28.1:

Code:

certUtil -hashfile bitcoin-28.1-win64-setup.exe SHA256
SHA256 hash of bitcoin-28.1-win64-setup.exe:
e48722e54b0ac61c296371aa940d61ff8fbc0a5a3f14fd41b3218179e73fff84

You can open the SHA256SUM file in a notepad and you will see that the above hash is listed according to the binary you downloaded, this is an effective check and ensures that you downloaded the correct file:



Linux:

Code:

gpg --verify SHA256SUM.asc

or

Code:

sha256sum --ignore-missing --check SHA256SUMS

In the output produced by the above command ensure the output lists "OK" after the name of the release file you downloaded. For example: bitcoin-28.1-x86_64-linux-gnu.tar.gz: OK

You can do these hash checks with kleopatra.

If you have a file compression software, like 7zip (don't use winrar, as it’s not open source) which is open source. You can check the SHA-256 hash by right-clicking on the file, then find the 7zip option, it will list some options, then select CRC SHA and choose either "SHA-256" to get only the SHA256 of the file or "*" to get other hashes besides sha256 like SHA1.

If you already have 7-zip installed on your host, you can simply just right click on the file and select the hashing algorithm. A window will pop up showing the calculated checksum.