<p>The gpg signature verification has changed for bitcoin core version 22 and later. There were two main changes:</p>
<ol>
<li><p>The sha256 checksums are now in a separate file from the gpg signatures. So download a new file named &quot;SHA256SUMS&quot; (contains the checksums) and also the &quot;SHA256SUMS.asc&quot; which contains the signatures.</p>
</li>
<li><p>The signature file now contains multiple signatures. These signatures are generated by multiple &quot;builders&quot; who have provided their own public keys to verify against. Not all builders will provide a signature for each release.</p>
</li>
</ol>
<p>You can find more information at <a href="https://bitcoincore.org/en/download/" rel="nofollow noreferrer">bitcoincore.org/en/download/</a> under the &quot;Linux verification instructions&quot; section - click to expand.</p>
<p>Instructions about where to find and how to import the full list of &quot;builder&quot; public keys can be found in the <a href="https://github.com/bitcoin/bitcoin/tree/master/contrib/builder-keys" rel="nofollow noreferrer">bitcoin core github repo</a>.</p>

CC BY-SA 4.0
2022-01-21T13:16:30.397Z
After downloading `bitcoin-22.0-x86_64-linux-gnu.tar.gz`, `laanwj-releases.asc`, `SHA256SUMS.asc` and `SHA256SUMS` I ran `gpg --import laanwj-releases.asc` and I got `gpg: key 90C8019E36C2E964: 51 signatures not checked due to missing keys
gpg: key 90C8019E36C2E964: public key "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>" imported
[...]` . Then I proceed with `gpg --verify SHA256SUMS.asc bitcoin-22.0-x86_64-linux-gnu.tar.gz` and 'gpg' tells me `Can't check signature: No public key`. How would you verify the archive?
John Smith
CC BY-SA 4.0
2021-10-18T18:25:19.043Z
2021-10-18T18:25:19.043Z
c.hill
<p>I am trying to verify that the checksums file is PGP signed by the release signing key.</p>
<p>I have downloaded the <a href="https://bitcoincore.org/bin/bitcoin-core-22.0/SHA256SUMS.asc" rel="nofollow noreferrer">https://bitcoincore.org/bin/bitcoin-core-22.0/SHA256SUMS.asc</a>
and imported keys with:</p>
<pre><code>gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys &quot;71A3B16735405025D447E8F274810B012346C9A6&quot;
</code></pre>
<p>however when I do: <code>gpg --no-tty --verify SHA256SUMS.asc</code> I do receive response:</p>
<pre><code>gpg: no signed data
gpg: can't hash datafile: No data
</code></pre>
<p>Do I miss something? I tried to import more keys from <a href="https://bitcoincore.org/en/contact/" rel="nofollow noreferrer">https://bitcoincore.org/en/contact/</a> but same output. I would appreciate any help.</p>

<bitcoin-core><verification><pgp>
Cannot verify Bitcoin Core 22.0 GPG
Mangekyou
# Cannot verify Bitcoin Core 22.0 GPG

(Asked by: username_0 on 2021-10-14)

I am trying to verify that the checksums file is PGP signed by the release signing key.
I have downloaded the https://bitcoincore.org/bin/bitcoin-core-22.0/SHA256SUMS.asc
and imported keys with:
gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys "71A3B16735405025D447E8F274810B012346C9A6"

however when I do: gpg --no-tty --verify SHA256SUMS.asc I do receive response:
gpg: no signed data
gpg: can't hash datafile: No data

Do I miss something? I tried to import more keys from https://bitcoincore.org/en/contact/ but same output. I would appreciate any help.

**Tags:** bitcoin-core, verification, pgp


---

## 1 answers

### Answer by username_1 on 2021-10-18. Score: 1

The gpg signature verification has changed for bitcoin core version 22 and later. There were two main changes:

1. The sha256 checksums are now in a separate file from the gpg signatures. So download a new file named "SHA256SUMS" (contains the checksums) and also the "SHA256SUMS.asc" which contains the signatures.
2. The signature file now contains multiple signatures. These signatures are generated by multiple "builders" who have provided their own public keys to verify against. Not all builders will provide a signature for each release.

You can find more information at [bitcoincore.org/en/download/](https://bitcoincore.org/en/download/) under the "Linux verification instructions" section - click to expand.

Instructions about where to find and how to import the full list of "builder" public keys can be found in the [bitcoin core github repo](https://github.com/bitcoin/bitcoin/tree/master/contrib/builder-keys).

> **Comments:**
> **username_2**: After downloading `bitcoin-22.0-x86_64-linux-gnu.tar.gz`, `laanwj-releases.asc`, `SHA256SUMS.asc` and `SHA256SUMS` I ran `gpg --import laanwj-releases.asc` and I got `gpg: key 90C8019E36C2E964: 51 signatures not checked due to missing keys gpg: key 90C8019E36C2E964: public key "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>" imported [...]` . Then I proceed with `gpg --verify SHA256SUMS.asc bitcoin-22.0-x86_64-linux-gnu.tar.gz` and 'gpg' tells me `Can't check signature: No public key`. How would you verify the archive?  

---

