Hey everyone! So, I'm wondering why the fanquake signature (gpg verify SHA256SUMS.asc) is missing in bitcoincore version 28.1? Should I be concerned about this? I’m looking at version 28.0 on my MacBook and it has the fanquake signature.
I wouldn't worry about it. AFAIK most of the developers volunteer their time, so in this case it could simply be that fanquake hasn't had time to review the code and sign the hashes.
Have you imported the PGP key of the fanquake?
They move all their keys to a new path; you better check them all here: https://github.com/bitcoin-core/guix.sigs/tree/main
You can download the fanquake builder key(PGP key) here: https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys
and download all fanquake signature from this link: https://github.com/bitcoin-core/guix.sigs/tree/main/28.1/fanquake
To verify, use this command, make sure you are in the same folder:
Let me know the result.
fanquake made his signatures a bit late; the SHA256SUMS.asc file was generated and the binaries uploaded before fanquake's sigs were added to the guix.sigs repo.
The release is still signed by several other developers, including myself. There's nothing to worry about, not everyone is able to do a build and made signatures in time.