Skip to content

Commit 8029523

Browse files
hardingharding
committed
Merge #549: Downloads: add binary verification instructions
37dbc30 Download: link directly to installable GPG suits for Mac & Win (David A. Harding) 0387192 Downloads: add binary verification instructions (David A. Harding) fcb86e9 CSS: remove 'summary' tag from special block formatting (David A. Harding) 76e7161 Stats: increase block chain size to 210 GiB (David A. Harding) Pull request description: Closes #544 Preview: http://dg3.dtrt.org/en/download/ **Note:** files in the /bin/ directory are not available on the above preview site; that's expected since they're not part of the repository. To test this PR, download the necessary binary file and SHA256SUMS file from the real https://bitcoincore.org/en/download/ This PR adds instructions to the *Download* page for verifying Bitcoin Core binaries on Windows, MacOS, and Linux. Also included are a short note about why we can't provide instructions for verifying the Ubuntu PPA[1] and a brief overview of additional verification that can be done through looking at the Gitian sigs or reproducing a build yourself. I believe the Linux instructions are correct. Windows or MacOS need testing as I don't have either system available for testing and so I based by instructions on random StackExchange answers and documentation from other projects (Tor having [the best I found](https://www.torproject.org/docs/verifying-signatures.html.en)). The instructions are gated by an if statement that only displays them on translations that have updated to support the required strings (this is only English in this PR, so they don't display on the Japanese translation for now). [1] From my research, it seems that the GPG key that signs the PPA package belongs to the Ubuntu infrastructure, not the package maintainer, so I don't see any probative value in authenticating it. And that problem is in addition to the packages not being built reproducibly through Gitian, so I decided to give up on providing any instructions for PPA package verification. If anyone knows a way to get stronger package authentication for PPA users, let me know. Tree-SHA512: 14834ea23304ac049268a480cb02e670318d2bc48f0079ca3a8c882ef9277fd4287f562c7db533a666ef0149630d56b937c46e819866bf81ec0a754510c096d9
2 parents 3f889ed + 37dbc30 commit 8029523

File tree

4 files changed

+260
-9
lines changed

4 files changed

+260
-9
lines changed

‎_data/stats.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
## Size of the Bitcoin Core data directory running with default settings.
22
## Suggest rounding up by about 10% so it doesn't need to be updated
33
## too often.
4-
datadir_gb: "180"
4+
datadir_gb: "210"
55

66
## Size of the datadir with the maximum allowed pruning enabled.
77
## Suggest rounding up a little bit to give room for growth in the UTXO

‎_includes/templates/download.html

Lines changed: 170 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,19 @@
11
{% capture /dev/null %}<!-- suppress render of this part -->
22
<!-- Copyright 2013 - 2016 The Bitcoin.org Project.
3-
Copyright 2017 The BitcoinCore.org Project
3+
Copyright 2017 - 2018 The BitcoinCore.org Project
44
This file is licensed under the MIT License (MIT) available on
55
http://opensource.org/licenses/MIT. -->
66
{% assign VERSION_SORTED_RELEASES = site.releases | sort: 'release' | reverse %}
77
{% capture CURRENT_RELEASE %}{% for subver in VERSION_SORTED_RELEASES[0].release %}{{subver}}{% unless forloop.last %}.{% endunless %}{% endfor %}{% endcapture %}
88
{% assign magnet = VERSION_SORTED_RELEASES[0].optional_magnetlink %}
99
{% capture PATH_PREFIX %}/bin/bitcoin-core-{{CURRENT_RELEASE}}{% endcapture %}
1010
{% capture FILE_PREFIX %}bitcoin-{{CURRENT_RELEASE}}{% endcapture %}
11+
{% assign SIGNING_KEY_FINGERPRINT = "01EA5486DE18A882D4C2684590C8019E36C2E964" %}
12+
{% capture SIGNING_KEY_FINGERPRINT_EXPLODED %}{% include fingerprint-split.html hex=SIGNING_KEY_FINGERPRINT %}{% endcapture %}
13+
{% assign GPG_DOWNLOAD_URL = "https://www.gnupg.org/download/index.en.html#binary" %}
14+
{% assign GPG_MACOS_DOWNLOAD_URL = "https://gpgtools.org/" %}
15+
{% assign GPG_WINDOWS_DOWNLOAD_URL = "https://gpg4win.org/download.html" %}
16+
{% assign GITIAN_REPOSITORY_URL = "https://github.com/bitcoin-core/gitian.sigs" %}
1117
{% endcapture %}
1218
<link rel="alternate" type="application/rss+xml" href="/en/releasesrss.xml" title="Bitcoin Core releases">
1319
<div class="download">
@@ -74,14 +80,173 @@ <h2>{{ page.latestversion }} {{CURRENT_RELEASE}} <a type="application/rss+xml" h
7480
</p>
7581
<p class="downloadkeys">
7682
<span>{{ page.releasekeys }}</span>
77-
<a href="/keys/laanwj-releases.asc">v0.11.0+</a>
83+
<a href="/keys/laanwj-releases.asc">v0.11.0+</a> <code title="{{page.pgp_key_fingerprint}}">{{SIGNING_KEY_FINGERPRINT}}</code>
7884
</p>
7985
</div>
8086

81-
<h2><img src="/assets/images/icons/note.svg" class="warningicon" alt="note">{{ page.patient }}</h2>
82-
<p>{{ page.notesync | replace: '$(DATADIR_SIZE)', site.data.stats.datadir_gb | replace: '$(PRUNED_SIZE)', site.data.stats.pruned_gb | replace: '$(MONTHLY_RANGE_GB)', site.data.stats.monthly_storage_increase_range_gb }} {{ page.full_node_guide }}</p>
83-
<p>{{ page.notelicense }}</p>
8487
</div>
88+
89+
<h2 style="text-align: center">{{ page.patient }}</h2>
90+
<p>{{ page.notesync | replace: '$(DATADIR_SIZE)', site.data.stats.datadir_gb | replace: '$(PRUNED_SIZE)', site.data.stats.pruned_gb | replace: '$(MONTHLY_RANGE_GB)', site.data.stats.monthly_storage_increase_range_gb }} {{ page.full_node_guide }}</p>
91+
92+
{% if page.version > 1 %}
93+
<h2 style="text-align: center">{{page.verify_download}}</h2>
94+
<p>{{page.verification_recommended}}</p>
95+
<details>
96+
{% assign GPG = "C:\Program Files\Gnu\GnuPg\gpg.exe" %}
97+
<summary><strong>{{page.windows_instructions}}</strong></summary>
98+
<ol>
99+
<li><p>{{page.download_release}}</p></li>
100+
101+
<li><p>{{page.download_checksums}} <a href="{{ PATH_PREFIX }}/SHA256SUMS.asc">SHA256SUMS.asc</a></p></li>
102+
103+
<li><p>{{page.cd_to_downloads}}</p>
104+
105+
<pre class="highlight"><code>{{page.cd_example_windows}}</code></pre>
106+
107+
</li>
108+
109+
{% capture windows_example_binary %}{{FILE_PREFIX}}-{{site.data.binaries.win64exe}}{% endcapture %}
110+
<li><p>{{page.generate_checksum | replace: "$(FILE)", windows_example_binary}}</p>
111+
112+
<pre class="highlight"><code>certUtil -hashfile {{windows_example_binary}} SHA256</code></pre></li>
113+
114+
<li><p>{{page.ensure_checksum_matches}}</p>
115+
116+
<pre class="highlight"><code>type SHA256SUMS.asc</code></pre></li>
117+
118+
<li><p>{{page.install_gpg}} <a
119+
href="{{GPG_WINDOWS_DOWNLOAD_URL}}">{{page.gpg_download_page}}</a>
120+
{{page.gpg_download_other}}
121+
<a href="{{GPG_DOWNLOAD_URL}}">{{page.gpg_download_options}}</a></p></li>
122+
123+
<li><p>{{page.obtain_release_key}}</p>
124+
125+
<pre class="highlight"><code>{{GPG}} --recv-keys {{SIGNING_KEY_FINGERPRINT}}</code></pre>
126+
127+
<p>{{page.release_key_obtained}}</p></li>
128+
129+
<li>{{page.verify_checksums_file}}
130+
131+
<pre class="highlight"><code>{{GPG}} --verify SHA256SUMS.asc</code></pre></li>
132+
133+
<li><p>{{page.check_gpg_output}}</p>
134+
<ol><li><p>{{page.line_starts_with}} <code>gpg: {{page.localized_gpg_good_sig}}</code></p></li>
135+
<li><p>{{page.complete_line_saying}} <code>{{page.localized_gpg_primary_fingerprint}} {{SIGNING_KEY_FINGERPRINT_EXPLODED}}</code></p></li>
136+
</ol>
137+
138+
<p>{{page.gpg_trust_warning}}</p></li>
139+
140+
</ol>
141+
</details>
142+
<details>
143+
{% assign GPG = "gpg" %}
144+
<summary><strong>{{page.macos_instructions}}</strong></summary>
145+
<ol>
146+
<li><p>{{page.download_release}}</p></li>
147+
148+
<li><p>{{page.download_checksums}} <a href="{{ PATH_PREFIX }}/SHA256SUMS.asc">SHA256SUMS.asc</a></p></li>
149+
150+
<li><p>{{page.cd_to_downloads}}</p>
151+
152+
<pre class="highlight"><code>{{page.cd_example_linux}}</code></pre>
153+
154+
</li>
155+
156+
<li><p>{{page.verify_download_checksum}}</p>
157+
158+
<pre class="highlight"><code>shasum -a 256 --check SHA256SUMS.asc</code></pre>
159+
160+
<p>{{page.checksum_warning_and_ok | replace, "$(SHASUMS_OK)", page.localized_checksum_ok}} <code>{{FILE_PREFIX}}{{site.data.binaries.macdmg}}: {{page.localized_checksum_ok}}</code></p></li>
161+
162+
<li><p>{{page.install_gpg}} <a
163+
href="{{GPG_MACOS_DOWNLOAD_URL}}">{{page.gpg_download_page}}</a>
164+
{{page.gpg_download_other}}
165+
<a href="{{GPG_DOWNLOAD_URL}}">{{page.gpg_download_options}}</a></p></li>
166+
167+
<li><p>{{page.obtain_release_key}}</p>
168+
169+
<pre class="highlight"><code>gpg --recv-keys {{SIGNING_KEY_FINGERPRINT}}</code></pre>
170+
171+
<p>{{page.release_key_obtained}}</p></li>
172+
173+
<li>{{page.verify_checksums_file}}
174+
175+
<pre class="highlight"><code>gpg --verify SHA256SUMS.asc</code></pre></li>
176+
177+
<li><p>{{page.check_gpg_output}}</p>
178+
<ol><li><p>{{page.line_starts_with}} <code>gpg: {{page.localized_gpg_good_sig}}</code></p></li>
179+
<li><p>{{page.complete_line_saying}} <code>{{page.localized_gpg_primary_fingerprint}} {{SIGNING_KEY_FINGERPRINT_EXPLODED}}</code></p></li>
180+
</ol>
181+
182+
<p>{{page.gpg_trust_warning}}</p></li>
183+
</ol>
184+
</details>
185+
186+
<details>
187+
<summary><strong>{{page.linux_instructions}}</strong></summary>
188+
<ol>
189+
<li><p>{{page.download_release}}</p></li>
190+
191+
<li><p>{{page.download_checksums}} <a href="{{ PATH_PREFIX }}/SHA256SUMS.asc">SHA256SUMS.asc</a></p></li>
192+
193+
<li><p>{{page.cd_to_downloads}}</p>
194+
195+
<pre class="highlight"><code>{{page.cd_example_linux}}</code></pre>
196+
197+
</li>
198+
199+
<li><p>{{page.verify_download_checksum}}</p>
200+
201+
<pre class="highlight"><code>sha256sum --ignore-missing --check SHA256SUMS.asc</code></pre>
202+
203+
<p>{{page.checksum_warning_and_ok | replace, "$(SHASUMS_OK)", page.localized_checksum_ok}} <code>{{FILE_PREFIX}}-{{site.data.binaries.lin64}}: {{page.localized_checksum_ok}}</code></p></li>
204+
205+
<li><p>{{page.obtain_release_key}}</p>
206+
207+
<pre class="highlight"><code>gpg --recv-keys {{SIGNING_KEY_FINGERPRINT}}</code></pre>
208+
209+
<p>{{page.release_key_obtained}}</p></li>
210+
211+
<li>{{page.verify_checksums_file}}
212+
213+
<pre class="highlight"><code>gpg --verify SHA256SUMS.asc</code></pre></li>
214+
215+
<li><p>{{page.check_gpg_output}}</p>
216+
<ol><li><p>{{page.line_starts_with}} <code>gpg: {{page.localized_gpg_good_sig}}</code></p></li>
217+
<li><p>{{page.complete_line_saying}} <code>{{page.localized_gpg_primary_fingerprint}} {{SIGNING_KEY_FINGERPRINT_EXPLODED}}</code></p></li>
218+
</ol>
219+
220+
<p>{{page.gpg_trust_warning}}</p></li>
221+
222+
</ol>
223+
</details>
224+
225+
<details>
226+
<summary><strong>{{page.ubuntu_ppa_instructions}}</strong></summary>
227+
228+
<p>{{page.ubuntu_notice}}</p>
229+
230+
<blockquote>{{page.ubuntu_ppa_quote}}</blockquote>
231+
</details>
232+
233+
<h2 style="text-align: center">{{page.build_reproduction}}</h2>
234+
235+
<p>{{page.additional_steps}}</p>
236+
237+
<ul>
238+
<li><p><em>{{page.reproducible_builds}}</em> {{page.build_identical_binaries}}</p></li>
239+
240+
<li><p><em>{{page.verified_reproduction}}</em> {{page.independently_reproducing}}</p></li>
241+
</ul>
242+
243+
<p>{{page.verifying_and_reproducing}} <a href="{{GITIAN_REPOSITORY_URL}}">{{page.gitian_repository}}</a>.</p>
244+
{% endif %}{% comment %}END VERSION > 1 CONTENT{% endcomment %}
245+
246+
<hr>
247+
248+
<p>{{ page.notelicense }}</p>
249+
85250
<script type="text/javascript">
86251
var os = 'windows32';
87252
if (navigator.userAgent.indexOf('Mac') != -1) var os = 'mac'

‎_posts/en/pages/2017-01-01-download.md

Lines changed: 88 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ type: pages
55
layout: page
66
lang: en
77
share: false
8-
version: 1
8+
version: 2
99

1010
## These strings need to be localized. In the listing below, the
1111
## comment above each entry contains the English text. The key before the
@@ -54,6 +54,93 @@ patient: "Check your bandwidth and space"
5454
# releasekeys: "Bitcoin Core Release Signing Keys"
5555
releasekeys: "Bitcoin Core Release Signing Keys"
5656

57+
pgp_key_fingerprint: "PGP key fingerprint"
58+
verify_download: "Verify your download"
59+
verification_recommended: "Download verification is optional but highly recommended. Click one of the lines below to view verification instructions for that platform."
60+
windows_instructions: "Windows verification instructions"
61+
macos_instructions: "MacOS verification instructions"
62+
linux_instructions: "Linux verification instructions (not for Ubuntu PPA)"
63+
ubuntu_ppa_instructions: "Ubuntu PPA verification instructions"
64+
download_release: "Click the link in the list above to download the release for your platform and wait for the file to finish downloading."
65+
download_checksums: "Download the list of cryptographic checksums:"
66+
cd_to_downloads: "Open a terminal (command line prompt) and Change Directory (cd) to the folder you use for downloads. For example:"
67+
cd_example_linux: "cd Downloads/"
68+
cd_example_windows: >
69+
cd %UserProfile%\Downloads
70+
71+
verify_download_checksum: "Verify that the checksum of the release file is listed in the checksums file using the following command:"
72+
checksum_warning_and_ok: 'In the output produced by the above command, you can safely ignore any warnings and failures, but you must ensure the output lists "$(SHASUMS_OK)" after the name of the release file you downloaded. For example:'
73+
obtain_release_key: "Obtain a copy of the release signing key by running the following command:"
74+
release_key_obtained: "The output of the command above should say that one key was imported, updated, has new signatures, or remained unchanged."
75+
verify_checksums_file: "Verify that the checksums file is PGP signed by the release signing key:"
76+
check_gpg_output: "Check the output from the above command for the following text:"
77+
line_starts_with: "A line that starts with:"
78+
complete_line_saying: "A complete line saying:"
79+
gpg_trust_warning: >
80+
The output from the verify command may contain a warning that
81+
the "key is not certified with a trusted signature." This means that
82+
to fully verify your download, you need to ask people you trust to
83+
confirm that the key fingerprint printed above belongs to the Bitcoin
84+
Core Project's release signing key.
85+
86+
localized_checksum_ok: "OK"
87+
localized_gpg_good_sig: "Good signature"
88+
localized_gpg_primary_fingerprint: "Primary key fingerprint:"
89+
90+
install_gpg: "If you haven't previously installed GNU Privacy Guard (GPG) on your system,"
91+
gpg_download_page: "install it now"
92+
gpg_download_other: "or see other installation"
93+
gpg_download_options: "options."
94+
95+
ensure_checksum_matches: >
96+
Ensure that the checksum produced by the command above matches one of
97+
the checksums listed in the checksums file you downloaded earlier. We
98+
recommend that you check every character of the two checksums to
99+
ensure they match. You can see the checksums you downloaded by
100+
running the following command:
101+
102+
generate_checksum: "Run the following command to generate a checksum of the release file you downloaded. Replace '$(FILE)' with the name of the file you actually downloaded."
103+
104+
ubuntu_notice: >
105+
Ubuntu PPAs are not built using the same reproducible method used for
106+
the other Bitcoin Core packages listed on this page, so the Bitcoin
107+
Core project does not have the information necessary to help you
108+
verify the Bitcoin Core Ubuntu PPA packages. This situation is also
109+
described by the PPA itself:
110+
111+
ubuntu_ppa_quote: >
112+
"Note that you should prefer to use the official binaries, where
113+
possible, to limit trust in Launchpad/the PPA owner."
114+
115+
build_reproduction: "Additional verification with reproducible builds"
116+
additional_steps: >
117+
Experienced users who don't mind performing additional steps can take
118+
advantage of Bitcoin Core's reproducible builds and the signed
119+
checksums generated by contributors who perform those builds.
120+
121+
reproducible_builds: "Reproducible builds"
122+
build_identical_binaries: >
123+
allow anyone with a copy of Bitcoin Core's MIT-licensed source code to
124+
build identical binaries to those distributed on this website (meaning
125+
the binaries will have the same cryptographic checksums as those
126+
provided by this website).
127+
128+
verified_reproduction: "Verified reproduction"
129+
independently_reproducing: >
130+
is the result of multiple Bitcoin Core contributors each independently
131+
reproducing identical binaries as described above. These contributors
132+
cryptographically sign and publish the checksums of the binaries they
133+
generate.
134+
verifying_and_reproducing: >
135+
Verifying that several contributors you trust all signed the same
136+
checksums distributed in the release checksums file will provide you
137+
with additional assurances over the preceding basic verification
138+
instructions. Alternatively, reproducing a binary for yourself will
139+
provide you with the highest level of assurance currently available.
140+
For more information, visit the project's repository of
141+
142+
gitian_repository: "trusted build process signatures"
143+
57144

58145
---
59146

‎_sass/normalize.scss

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,7 @@ header,
1818
hgroup,
1919
main,
2020
nav,
21-
section,
22-
summary {
21+
section {
2322
display: block;
2423
}
2524

0 commit comments

Comments
 (0)