Skip to content

Commit 0387192

Browse files
hardingharding
committed
Downloads: add binary verification instructions
- Add releases signing key fingerprint - Add instructions for Windows, Mac, Linux - Win/Mac untested - Add disclaimer for Ubuntu PPA - Add notes about gitian, with link to repository - Make all text strings translatable, but prevent URLs, file names, and key fingerprints from being translated to make translation review easier Includes improvements suggested by Kalle Rosenbaum
1 parent fcb86e9 commit 0387192

File tree

2 files changed

+250
-6
lines changed

2 files changed

+250
-6
lines changed

‎_includes/templates/download.html

Lines changed: 164 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{% capture /dev/null %}<!-- suppress render of this part -->
22
<!-- Copyright 2013 - 2016 The Bitcoin.org Project.
3-
Copyright 2017 The BitcoinCore.org Project
3+
Copyright 2017 - 2018 The BitcoinCore.org Project
44
This file is licensed under the MIT License (MIT) available on
55
http://opensource.org/licenses/MIT. -->
66
{% assign VERSION_SORTED_RELEASES = site.releases | sort: 'release' | reverse %}
77
{% capture CURRENT_RELEASE %}{% for subver in VERSION_SORTED_RELEASES[0].release %}{{subver}}{% unless forloop.last %}.{% endunless %}{% endfor %}{% endcapture %}
88
{% assign magnet = VERSION_SORTED_RELEASES[0].optional_magnetlink %}
99
{% capture PATH_PREFIX %}/bin/bitcoin-core-{{CURRENT_RELEASE}}{% endcapture %}
1010
{% capture FILE_PREFIX %}bitcoin-{{CURRENT_RELEASE}}{% endcapture %}
11+
{% assign SIGNING_KEY_FINGERPRINT = "01EA5486DE18A882D4C2684590C8019E36C2E964" %}
12+
{% capture SIGNING_KEY_FINGERPRINT_EXPLODED %}{% include fingerprint-split.html hex=SIGNING_KEY_FINGERPRINT %}{% endcapture %}
13+
{% assign GPG_DOWNLOAD_URL = "https://www.gnupg.org/download/index.en.html#binary" %}
14+
{% assign GITIAN_REPOSITORY_URL = "https://github.com/bitcoin-core/gitian.sigs" %}
1115
{% endcapture %}
1216
<link rel="alternate" type="application/rss+xml" href="/en/releasesrss.xml" title="Bitcoin Core releases">
1317
<div class="download">
@@ -74,14 +78,169 @@ <h2>{{ page.latestversion }} {{CURRENT_RELEASE}} <a type="application/rss+xml" h
7478
</p>
7579
<p class="downloadkeys">
7680
<span>{{ page.releasekeys }}</span>
77-
<a href="/keys/laanwj-releases.asc">v0.11.0+</a>
81+
<a href="/keys/laanwj-releases.asc">v0.11.0+</a> <code title="{{page.pgp_key_fingerprint}}">{{SIGNING_KEY_FINGERPRINT}}</code>
7882
</p>
7983
</div>
8084

81-
<h2><img src="/assets/images/icons/note.svg" class="warningicon" alt="note">{{ page.patient }}</h2>
82-
<p>{{ page.notesync | replace: '$(DATADIR_SIZE)', site.data.stats.datadir_gb | replace: '$(PRUNED_SIZE)', site.data.stats.pruned_gb | replace: '$(MONTHLY_RANGE_GB)', site.data.stats.monthly_storage_increase_range_gb }} {{ page.full_node_guide }}</p>
83-
<p>{{ page.notelicense }}</p>
8485
</div>
86+
87+
<h2 style="text-align: center">{{ page.patient }}</h2>
88+
<p>{{ page.notesync | replace: '$(DATADIR_SIZE)', site.data.stats.datadir_gb | replace: '$(PRUNED_SIZE)', site.data.stats.pruned_gb | replace: '$(MONTHLY_RANGE_GB)', site.data.stats.monthly_storage_increase_range_gb }} {{ page.full_node_guide }}</p>
89+
90+
{% if page.version > 1 %}
91+
<h2 style="text-align: center">{{page.verify_download}}</h2>
92+
<p>{{page.verification_recommended}}</p>
93+
<details>
94+
{% assign GPG = "C:\Program Files\Gnu\GnuPg\gpg.exe" %}
95+
<summary><strong>{{page.windows_instructions}}</strong></summary>
96+
<ol>
97+
<li><p>{{page.download_release}}</p></li>
98+
99+
<li><p>{{page.download_checksums}} <a href="{{ PATH_PREFIX }}/SHA256SUMS.asc">SHA256SUMS.asc</a></p></li>
100+
101+
<li><p>{{page.cd_to_downloads}}</p>
102+
103+
<pre class="highlight"><code>{{page.cd_example_windows}}</code></pre>
104+
105+
</li>
106+
107+
{% capture windows_example_binary %}{{FILE_PREFIX}}-{{site.data.binaries.win64exe}}{% endcapture %}
108+
<li><p>{{page.generate_checksum | replace: "$(FILE)", windows_example_binary}}</p>
109+
110+
<pre class="highlight"><code>certUtil -hashfile {{windows_example_binary}} SHA256</code></pre></li>
111+
112+
<li><p>{{page.ensure_checksum_matches}}</p>
113+
114+
<pre class="highlight"><code>type SHA256SUMS.asc</code></pre></li>
115+
116+
<li><p>{{page.install_gpg}} <a
117+
href="{{GPG_DOWNLOAD_URL}}">{{page.gpg_download_page}}</a></p></li>
118+
119+
<li><p>{{page.obtain_release_key}}</p>
120+
121+
<pre class="highlight"><code>{{GPG}} --recv-keys {{SIGNING_KEY_FINGERPRINT}}</code></pre>
122+
123+
<p>{{page.release_key_obtained}}</p></li>
124+
125+
<li>{{page.verify_checksums_file}}
126+
127+
<pre class="highlight"><code>{{GPG}} --verify SHA256SUMS.asc</code></pre></li>
128+
129+
<li><p>{{page.check_gpg_output}}</p>
130+
<ol><li><p>{{page.line_starts_with}} <code>gpg: {{page.localized_gpg_good_sig}}</code></p></li>
131+
<li><p>{{page.complete_line_saying}} <code>{{page.localized_gpg_primary_fingerprint}} {{SIGNING_KEY_FINGERPRINT_EXPLODED}}</code></p></li>
132+
</ol>
133+
134+
<p>{{page.gpg_trust_warning}}</p></li>
135+
136+
</ol>
137+
</details>
138+
<details>
139+
{% assign GPG = "gpg" %}
140+
<summary><strong>{{page.macos_instructions}}</strong></summary>
141+
<ol>
142+
<li><p>{{page.download_release}}</p></li>
143+
144+
<li><p>{{page.download_checksums}} <a href="{{ PATH_PREFIX }}/SHA256SUMS.asc">SHA256SUMS.asc</a></p></li>
145+
146+
<li><p>{{page.cd_to_downloads}}</p>
147+
148+
<pre class="highlight"><code>{{page.cd_example_linux}}</code></pre>
149+
150+
</li>
151+
152+
<li><p>{{page.verify_download_checksum}}</p>
153+
154+
<pre class="highlight"><code>shasum -a 256 --check SHA256SUMS.asc</code></pre>
155+
156+
<p>{{page.checksum_warning_and_ok | replace, "$(SHASUMS_OK)", page.localized_checksum_ok}} <code>{{FILE_PREFIX}}{{site.data.binaries.macdmg}}: {{page.localized_checksum_ok}}</code></p></li>
157+
158+
<li><p>{{page.install_gpg}} <a
159+
href="{{GPG_DOWNLOAD_URL}}">{{page.gpg_download_page}}</a></p></li>
160+
161+
<li><p>{{page.obtain_release_key}}</p>
162+
163+
<pre class="highlight"><code>gpg --recv-keys {{SIGNING_KEY_FINGERPRINT}}</code></pre>
164+
165+
<p>{{page.release_key_obtained}}</p></li>
166+
167+
<li>{{page.verify_checksums_file}}
168+
169+
<pre class="highlight"><code>gpg --verify SHA256SUMS.asc</code></pre></li>
170+
171+
<li><p>{{page.check_gpg_output}}</p>
172+
<ol><li><p>{{page.line_starts_with}} <code>gpg: {{page.localized_gpg_good_sig}}</code></p></li>
173+
<li><p>{{page.complete_line_saying}} <code>{{page.localized_gpg_primary_fingerprint}} {{SIGNING_KEY_FINGERPRINT_EXPLODED}}</code></p></li>
174+
</ol>
175+
176+
<p>{{page.gpg_trust_warning}}</p></li>
177+
</ol>
178+
</details>
179+
180+
<details>
181+
<summary><strong>{{page.linux_instructions}}</strong></summary>
182+
<ol>
183+
<li><p>{{page.download_release}}</p></li>
184+
185+
<li><p>{{page.download_checksums}} <a href="{{ PATH_PREFIX }}/SHA256SUMS.asc">SHA256SUMS.asc</a></p></li>
186+
187+
<li><p>{{page.cd_to_downloads}}</p>
188+
189+
<pre class="highlight"><code>{{page.cd_example_linux}}</code></pre>
190+
191+
</li>
192+
193+
<li><p>{{page.verify_download_checksum}}</p>
194+
195+
<pre class="highlight"><code>sha256sum --ignore-missing --check SHA256SUMS.asc</code></pre>
196+
197+
<p>{{page.checksum_warning_and_ok | replace, "$(SHASUMS_OK)", page.localized_checksum_ok}} <code>{{FILE_PREFIX}}-{{site.data.binaries.lin64}}: {{page.localized_checksum_ok}}</code></p></li>
198+
199+
<li><p>{{page.obtain_release_key}}</p>
200+
201+
<pre class="highlight"><code>gpg --recv-keys {{SIGNING_KEY_FINGERPRINT}}</code></pre>
202+
203+
<p>{{page.release_key_obtained}}</p></li>
204+
205+
<li>{{page.verify_checksums_file}}
206+
207+
<pre class="highlight"><code>gpg --verify SHA256SUMS.asc</code></pre></li>
208+
209+
<li><p>{{page.check_gpg_output}}</p>
210+
<ol><li><p>{{page.line_starts_with}} <code>gpg: {{page.localized_gpg_good_sig}}</code></p></li>
211+
<li><p>{{page.complete_line_saying}} <code>{{page.localized_gpg_primary_fingerprint}} {{SIGNING_KEY_FINGERPRINT_EXPLODED}}</code></p></li>
212+
</ol>
213+
214+
<p>{{page.gpg_trust_warning}}</p></li>
215+
216+
</ol>
217+
</details>
218+
219+
<details>
220+
<summary><strong>{{page.ubuntu_ppa_instructions}}</strong></summary>
221+
222+
<p>{{page.ubuntu_notice}}</p>
223+
224+
<blockquote>{{page.ubuntu_ppa_quote}}</blockquote>
225+
</details>
226+
227+
<h2 style="text-align: center">{{page.build_reproduction}}</h2>
228+
229+
<p>{{page.additional_steps}}</p>
230+
231+
<ul>
232+
<li><p><em>{{page.reproducible_builds}}</em> {{page.build_identical_binaries}}</p></li>
233+
234+
<li><p><em>{{page.verified_reproduction}}</em> {{page.independently_reproducing}}</p></li>
235+
</ul>
236+
237+
<p>{{page.verifying_and_reproducing}} <a href="{{GITIAN_REPOSITORY_URL}}">{{page.gitian_repository}}</a>.</p>
238+
{% endif %}{% comment %}END VERSION > 1 CONTENT{% endcomment %}
239+
240+
<hr>
241+
242+
<p>{{ page.notelicense }}</p>
243+
85244
<script type="text/javascript">
86245
var os = 'windows32';
87246
if (navigator.userAgent.indexOf('Mac') != -1) var os = 'mac'

‎_posts/en/pages/2017-01-01-download.md

Lines changed: 86 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ type: pages
55
layout: page
66
lang: en
77
share: false
8-
version: 1
8+
version: 2
99

1010
## These strings need to be localized. In the listing below, the
1111
## comment above each entry contains the English text. The key before the
@@ -54,6 +54,91 @@ patient: "Check your bandwidth and space"
5454
# releasekeys: "Bitcoin Core Release Signing Keys"
5555
releasekeys: "Bitcoin Core Release Signing Keys"
5656

57+
pgp_key_fingerprint: "PGP key fingerprint"
58+
verify_download: "Verify your download"
59+
verification_recommended: "Download verification is optional but highly recommended. Click one of the lines below to view verification instructions for that platform."
60+
windows_instructions: "Windows verification instructions"
61+
macos_instructions: "MacOS verification instructions"
62+
linux_instructions: "Linux verification instructions (not for Ubuntu PPA)"
63+
ubuntu_ppa_instructions: "Ubuntu PPA verification instructions"
64+
download_release: "Click the link in the list above to download the release for your platform and wait for the file to finish downloading."
65+
download_checksums: "Download the list of cryptographic checksums:"
66+
cd_to_downloads: "Open a terminal (command line prompt) and Change Directory (cd) to the folder you use for downloads. For example:"
67+
cd_example_linux: "cd Downloads/"
68+
cd_example_windows: >
69+
cd %UserProfile%\Downloads
70+
71+
verify_download_checksum: "Verify that the checksum of the release file is listed in the checksums file using the following command:"
72+
checksum_warning_and_ok: 'In the output produced by the above command, you can safely ignore any warnings and failures, but you must ensure the output lists "$(SHASUMS_OK)" after the name of the release file you downloaded. For example:'
73+
obtain_release_key: "Obtain a copy of the release signing key by running the following command:"
74+
release_key_obtained: "The output of the command above should say that one key was imported, updated, has new signatures, or remained unchanged."
75+
verify_checksums_file: "Verify that the checksums file is PGP signed by the release signing key:"
76+
check_gpg_output: "Check the output from the above command for the following text:"
77+
line_starts_with: "A line that starts with:"
78+
complete_line_saying: "A complete line saying:"
79+
gpg_trust_warning: >
80+
The output from the verify command may contain a warning that
81+
the "key is not certified with a trusted signature." This means that
82+
to fully verify your download, you need to ask people you trust to
83+
confirm that the key fingerprint printed above belongs to the Bitcoin
84+
Core Project's release signing key.
85+
86+
localized_checksum_ok: "OK"
87+
localized_gpg_good_sig: "Good signature"
88+
localized_gpg_primary_fingerprint: "Primary key fingerprint:"
89+
90+
install_gpg: "If you haven't previously installed GNU Privacy Guard (GPG) on your system, install it now. See the"
91+
gpg_download_page: "GPG download page"
92+
93+
ensure_checksum_matches: >
94+
Ensure that the checksum produced by the command above matches one of
95+
the checksums listed in the checksums file you downloaded earlier. We
96+
recommend that you check every character of the two checksums to
97+
ensure they match. You can see the checksums you downloaded by
98+
running the following command:
99+
100+
generate_checksum: "Run the following command to generate a checksum of the release file you downloaded. Replace '$(FILE)' with the name of the file you actually downloaded."
101+
102+
ubuntu_notice: >
103+
Ubuntu PPAs are not built using the same reproducible method used for
104+
the other Bitcoin Core packages listed on this page, so the Bitcoin
105+
Core project does not have the information necessary to help you
106+
verify the Bitcoin Core Ubuntu PPA packages. This situation is also
107+
described by the PPA itself:
108+
109+
ubuntu_ppa_quote: >
110+
"Note that you should prefer to use the official binaries, where
111+
possible, to limit trust in Launchpad/the PPA owner."
112+
113+
build_reproduction: "Additional verification with reproducible builds"
114+
additional_steps: >
115+
Experienced users who don't mind performing additional steps can take
116+
advantage of Bitcoin Core's reproducible builds and the signed
117+
checksums generated by contributors who perform those builds.
118+
119+
reproducible_builds: "Reproducible builds"
120+
build_identical_binaries: >
121+
allow anyone with a copy of Bitcoin Core's MIT-licensed source code to
122+
build identical binaries to those distributed on this website (meaning
123+
the binaries will have the same cryptographic checksums as those
124+
provided by this website).
125+
126+
verified_reproduction: "Verified reproduction"
127+
independently_reproducing: >
128+
is the result of multiple Bitcoin Core contributors each independently
129+
reproducing identical binaries as described above. These contributors
130+
cryptographically sign and publish the checksums of the binaries they
131+
generate.
132+
verifying_and_reproducing: >
133+
Verifying that several contributors you trust all signed the same
134+
checksums distributed in the release checksums file will provide you
135+
with additional assurances over the preceding basic verification
136+
instructions. Alternatively, reproducing a binary for yourself will
137+
provide you with the highest level of assurance currently available.
138+
For more information, visit the project's repository of
139+
140+
gitian_repository: "trusted build process signatures"
141+
57142

58143
---
59144

0 commit comments

Comments
 (0)