<blockquote>
<p>Beginning with Taproot? Hmm... Something about this feels scary to me.</p>
</blockquote>
<p>Your mistrust is misguided.</p>
<blockquote>
<p>So, they are no longer making &quot;signed&quot; installers?</p>
</blockquote>
<p>The releases are still signed with the release GPG key, what is lacking is the Windows specific binary signatures which have to be made by a paid certificate by one of several authorities Microsoft has trusted. Bitcoin Core being an open source project is having issues getting a new one issued, this is called out specifically in the <a href="https://bitcoincore.org/en/2021/05/01/release-0.21.1/" rel="nofollow noreferrer">release notes</a>.</p>
<p>The only thing this changes is that there will be a warning when the binary is first run, it is completely meaningless  to the actual security of the system as there are other stronger verification methods already in place.</p>
<ul>
<li>Binaries in that folder are still <a href="https://github.com/bitcoin-core/gitian.sigs/blob/master/0.21.1-win-unsigned/sipa/bitcoin-core-win-0.21-build.assert" rel="nofollow noreferrer">built using Gitian</a> and are still verifiable as being compiled from the source code if you so choose.</li>
<li>Gitian binaries are still signed by <a href="https://github.com/bitcoin-core/gitian.sigs/tree/master/0.21.1rc1-win-unsigned" rel="nofollow noreferrer">hoards of people</a> who attest that they got the same result as everybody else.</li>
<li>Binaries <a href="https://bitcoin.org/bin/bitcoin-core-0.20.1/SHA256SUMS.asc" rel="nofollow noreferrer">are still signed by the same GPG release key as always</a>.</li>
</ul>
<blockquote>
<p>Which still is nowhere to be found on bitcoin.org, BTW</p>
</blockquote>
<p>See <a href="https://github.com/bitcoin-dot-org/Bitcoin.org/pull/3667" rel="nofollow noreferrer">this issue on GitHub for discussion.</a></p>

CC BY-SA 4.0
2021-05-05T17:33:02.767Z
Add to that that the Linux release binaries never had any kind of codesigning (because typical Linux-based operating systems don't anything like that - apart from Android), and they're probably the most audited and secure ones produced. Codesigning is just a way to silence warnings on Windows and macOS.
Pieter Wuille
CC BY-SA 4.0
2021-05-06T02:33:39.067Z
A typical Linux-based OS checks the signatures of its install packages just fine.
fraxinus
CC BY-SA 4.0
2021-05-06T02:34:57.633Z
That is different, no linux distribution checks signatures on executing binaries, just on binaries downloaded through a package manager.
Claris
CC BY-SA 4.0
2021-05-06T16:09:53.073Z
It also doesn't apply here. The question is about release binaries, not about distro's packages. Bitcoin Core's release binaries are only GPG signed & guix attested, not "codesigned", whatever that would mean in this context.
Pieter Wuille
CC BY-SA 4.0
2021-05-05T16:58:59.613Z
2021-05-06T04:19:48.297Z
2021-05-06T04:19:48.297Z
Claris
<p>My security script for downloading and verifying new versions of Bitcoin Core barked at me the other day, when the new v0.21.1 was released. (Which still is nowhere to be found on bitcoin.org, BTW.)</p>
<p>At first, I thought it was a temporary glitch, but now it's been like this for at least three full days. The reason it &quot;barked&quot; is that my script is expecting <code>...win64-setup.exe</code>, but that file no longer exists. Instead, it's called: <code>...win64-setup-unsigned.exe</code>.</p>
<p>See for yourself: <a href="https://bitcoincore.org/bin/bitcoin-core-0.21.1/" rel="noreferrer">https://bitcoincore.org/bin/bitcoin-core-0.21.1/</a></p>
<p>So, they are no longer making &quot;signed&quot; installers? Beginning with Taproot? Hmm... Something about this feels scary to me. Maybe I'm too paranoid, but after all, you can't be too sure when it's about your entire &quot;wealth&quot;.</p>
<p>Isn't it something bad if the installer is no longer &quot;signed&quot;? Isn't that a step backwards security-wise, when a major update is being added to Bitcoin Core? Smells a bit fishy to me, frankly.</p>

<bitcoin-core><security><windows><taproot>
Should I be worried that bitcoincore.org now suddenly only provides an "unsigned" Bitcoin Core installer?
Korver
# Should I be worried that bitcoincore.org now suddenly only provides an "unsigned" Bitcoin Core installer?

(Asked by: username_0 on 2021-05-05)

My security script for downloading and verifying new versions of Bitcoin Core barked at me the other day, when the new v0.21.1 was released. (Which still is nowhere to be found on bitcoin.org, BTW.)

At first, I thought it was a temporary glitch, but now it's been like this for at least three full days. The reason it "barked" is that my script is expecting `...win64-setup.exe`, but that file no longer exists. Instead, it's called: `...win64-setup-unsigned.exe`.

See for yourself: <https://bitcoincore.org/bin/bitcoin-core-0.21.1/>

So, they are no longer making "signed" installers? Beginning with Taproot? Hmm... Something about this feels scary to me. Maybe I'm too paranoid, but after all, you can't be too sure when it's about your entire "wealth".

Isn't it something bad if the installer is no longer "signed"? Isn't that a step backwards security-wise, when a major update is being added to Bitcoin Core? Smells a bit fishy to me, frankly.

**Tags:** bitcoin-core, security, windows, taproot


---

## 1 answers

### Answer by username_1 on 2021-05-05. Score: 9

> Beginning with Taproot? Hmm... Something about this feels scary to me.

Your mistrust is misguided.

> So, they are no longer making "signed" installers?

The releases are still signed with the release GPG key, what is lacking is the Windows specific binary signatures which have to be made by a paid certificate by one of several authorities Microsoft has trusted. Bitcoin Core being an open source project is having issues getting a new one issued, this is called out specifically in the [release notes](https://bitcoincore.org/en/2021/05/01/release-0.21.1/).

The only thing this changes is that there will be a warning when the binary is first run, it is completely meaningless to the actual security of the system as there are other stronger verification methods already in place.

* Binaries in that folder are still [built using Gitian](https://github.com/bitcoin-core/gitian.sigs/blob/master/0.21.1-win-unsigned/sipa/bitcoin-core-win-0.21-build.assert) and are still verifiable as being compiled from the source code if you so choose.
* Gitian binaries are still signed by [hoards of people](https://github.com/bitcoin-core/gitian.sigs/tree/master/0.21.1rc1-win-unsigned) who attest that they got the same result as everybody else.
* Binaries [are still signed by the same GPG release key as always](https://bitcoin.org/bin/bitcoin-core-0.20.1/SHA256SUMS.asc).

> Which still is nowhere to be found on bitcoin.org, BTW

See [this issue on GitHub for discussion.](https://github.com/bitcoin-dot-org/Bitcoin.org/pull/3667)

> **Comments:**
> **username_2**: Add to that that the Linux release binaries never had any kind of codesigning (because typical Linux-based operating systems don't anything like that - apart from Android), and they're probably the most audited and secure ones produced. Codesigning is just a way to silence warnings on Windows and macOS.  
> **username_3**: A typical Linux-based OS checks the signatures of its install packages just fine.  
> **username_1**: That is different, no linux distribution checks signatures on executing binaries, just on binaries downloaded through a package manager.  
> **username_2**: It also doesn't apply here. The question is about release binaries, not about distro's packages. Bitcoin Core's release binaries are only GPG signed & guix attested, not "codesigned", whatever that would mean in this context.  

---

