1

On the bitcoin.org website it says:

verify your download using signatures

I have found some vague instructions on how to do this, but was wondering if anyone has written clear and concise step by step instructions?

I am using Linux/Ubuntu.


This is what I have tried so far:

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ ls -l
total 23124
-rw-rw-r-- 1 oshirowanen oshirowanen 23652105 Aug 31 08:57 bitcoin-0.13.0-x86_64-linux-gnu.tar.gz
-rw-rw-r-- 1 oshirowanen oshirowanen     2100 Aug 31 09:41 laanwj-releases.asc

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg --with-fingerprint laanwj-releases.asc 
pub  4096R/36C2E964 2015-06-24 Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>
      Key fingerprint = 01EA 5486 DE18 A882 D4C2  6845 90C8 019E 36C2 E964

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg --import laanwj-releases.asc 
gpg: /home/oshirowanen/.gnupg/trustdb.gpg: trustdb created
gpg: key 36C2E964: public key "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)
gpg: no ultimately trusted keys found

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg --verify laanwj-releases.asc 
gpg: verify signatures failed: unexpected data

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ 

UPDATE 1:

Just tried:

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg --verify laanwj-releases.asc bitcoin-0.13.0-x86_64-linux-gnu.tar.gz

gpg: verify signatures failed: unexpected data


UPDATE 2:

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg laanwj-releases.asc bitcoin-0.13.0-x86_64-linux-gnu.tar.gz

usage: gpg [options] [filename]


UPDATE 3:

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ ls -l
total 23124
-rw-rw-r-- 1 oshirowanen oshirowanen 23652105 Aug 31 08:57 bitcoin-0.13.0-x86_64-linux-gnu.tar.gz
-rw-rw-r-- 1 oshirowanen oshirowanen     2100 Aug 31 09:41 laanwj-releases.asc
-rw-rw-r-- 1 oshirowanen oshirowanen     1957 Aug 31 08:50 SHA256SUMS.asc

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg --import laanwj-releases.asc 
gpg: key 36C2E964: "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg --verify SHA256SUMS.asc 
gpg: Signature made Tue 23 Aug 2016 15:23:26 BST using RSA key ID 36C2E964
gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 01EA 5486 DE18 A882 D4C2  6845 90C8 019E 36C2 E964

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ sha256sum bitcoin-0.13.0-x86_64-linux-gnu.tar.gz 
bcc1e42d61f88621301bbb00512376287f9df4568255f8b98bc10547dced96c8  bitcoin-0.13.0-x86_64-linux-gnu.tar.gz

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ grep bitcoin-0.13.0-x86_64-linux-gnu.tar.gz SHA256SUMS.asc 
bcc1e42d61f88621301bbb00512376287f9df4568255f8b98bc10547dced96c8  bitcoin-0.13.0-x86_64-linux-gnu.tar.gz

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$

Does this mean all is good? The WARNING is worrying.

  • gpg --verify <asc> <bitcoin tarball> – Yorick de Wid Aug 31 '16 at 8:59
  • @YorickdeWid, Please see update 1 above. – oshirowanen Aug 31 '16 at 9:09
  • Try to remove the --verify part, GnuPG will also notice if it was encrypted, not only signed. – Yorick de Wid Aug 31 '16 at 9:20
  • @YorickdeWid, just tried that and it displays usage: gpg [options] [filename]. Please see update 2. – oshirowanen Aug 31 '16 at 9:25
1

I just tried it myself, and the problem is you are trying to verify a public key, not a signed document.

  1. As pointed out in the comments, verify the key with a keyserver and/or trusted source. In this case the key comes from the Bitcoin core's website itself.
  2. First import the key:

    gpg --inport laanwj-releases.asc

  3. Then download the tarball with the SHA256SUMS.asc file.

  4. Now you can verify the SHA256SUMS.asc with the previous imported key.

    gpg --verify SHA256SUMS.asc

  5. When verified successfully, calculate the sha256 over the tarball.

    sha256sum bitcoin-0.13.0-x86_64-linux-gnu.tar.gz

  6. It will output the hash, which you can match with the hash in SHA256SUMS.asc

    grep bitcoin-0.13.0-x86_64-linux-gnu.tar.gz SHA256SUMS.asc

When they match, you're good.

  • I'd say step 0 is to verify you got laanwj-releases.asc from a trusted source and via trusted means. (For example, I was quite shocked when Ubuntu only allow you to download their key via HTTP....) – billc.cn Aug 31 '16 at 14:13
  • @billc.cn thx, updated the post – Yorick de Wid Aug 31 '16 at 14:36
  • @YorickdeWid, please see update 3. – oshirowanen Sep 4 '16 at 14:21
  • @billc.cn, please see update 3. – oshirowanen Sep 4 '16 at 14:21
  • I think it is now good if you trust the authenticity of laanwj-releases.asc. The warning means the key used to generate the signature does not have enough trust level, but the signature is nontheless good. – billc.cn Sep 5 '16 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.