Hey guys,
I'm attempting to set up the Bitcoin Core application, but it looks like the public key for Vladmir Van Der Lan has been revoked, so I can't check if the SHASUM.asc file is actually signed by him.
Is there another method to confirm where this file came from?
Hi. Just go in this website: https://bitcoincore.org/en/download/
There are instructions for you to download and verify the files. I just followed the steps to make sure it works.
Otherwise, if you use Linux and want to install bitcoin without GUI, you can follow this tutorial: https://raspibolt.org/guide/bitcoin/bitcoin-client.html
Find below the link to his pgp key that could verify that SHASUM.asc file. Please, inform here if you succeeded.
https://github.com/bitcoin-core/guix.sigs/blob/main/26.0/laanwj/noncodesigned.SHA256SUMS.asc
P.S. Following this link you can also find there the relevant pgp keys of other developers who have signed that file.
What is the current procedure you are following?
The latest guide to verifying the authenticity of Bitcoin core is already on bitcoincore.org posted above
If it does not work would you mind trying to refresh the expired public using this command below
I did not succeed because the link you sent shows the SHASUM256 for the 26.0 version files, I'm trying to install the file available in the link https://bitcoin.org/bin/bitcoin-core-25.0/bitcoin-25.0-x86_64-apple-darwin.dmg , and verify with those available in https://bitcoin.org/bin/bitcoin-core-25.0/SHA256SUMS.asc and in https://bitcoin.org/laanwj-releases.asc. Following the tutorial shown in https://bitcoin.org.
I issue the commad you've sent and got this result ( gpg: key 90C8019E36C2E964: "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>" not changed ). After that I´ve checked the status of the signature and it was still shown as revoked.
[moderator's note: consecutive posts merged]
Bitcoin Core's website is bitcoincore.org, not bitcoin.org. bitcoin.org is outdated - it hosts old versions and it's verification instructions are not updated. The release process has changed so that releases are now signed by multiple people, their keys can be found at https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys.
You can read the instructions at https://bitcoincore.org/en/download/ for more details on how to verify the binaries, in addition to getting the most recent release.
The old release signing key has indeed been revoked since the change in release process. This is not an error.
There is a golden opportunity for you. You can download the whole file by installing it properly. And can participate in a 14-day challenge.
I found a guideline from here you can download very easily. NotATether has posted a challenge on Bitcoin Core, which you can find on Beginner and Help.
It's open to everyone, so you can take this challenge if you download it. Your right way is downloaded, and your challenge is taken. You can download and use Bitcoin Core and earn 14 merits in this direction. If you have enough space on your laptop and PC, participate in the 14-day challenge and earn 14 merits.
It's expired, and there hasn't been a new key published by him.
Van Der Laan stepped back from Bitcoin development sometime last year I think, so don't expect him to update his PGP key, at least not any time soon.
You can verify the signatures signed by the other developers, though.