<p>The verification you are referring to applies to the installer file you downloaded. The verification instructions for Windows can be found <a href="https://bitcoin.org/en/full-node#windows-instructions" rel="nofollow noreferrer">here</a>. The instructions for other operating systems are on the same page.</p>

<p>Unfortunately once you've installed and run the software it's too late to be able to take advantage of verification. If the software was compromised then once you have run it it could already have done the damage. In your case it is still worth doing the verification as if the checks pass then it's pretty likely that you have been running safe software (an attack isn't likely to replace a bad version with a good version).</p>

<p>It's also worth noting that this is not an academic exercise. Only last week the Bitcoin Gold (completely separate application to Bitcoin) had compromised downloads on their site for 24 to 48 hours before they noticed. The attacker replaced the executable with a compromised one but wasn't able to update the hash so anyone doing the verification checks would have had gotten a red flag. </p>

<p><strong>Update:</strong></p>

<p>Quick steps I use to verify downloaded binaries:</p>

<pre><code>1. Install the Ubuntu subsystem for Windows from the Microsoft Store (open the Store-&gt;Apps search for Ubuntu).
2. Once installed open Ubuntu (from a command prompt type ubuntu).
3. Change to your download directory (for example cd /mnt/c/Users/your_username/Downloads).
4. sha256sum -c --ignore-missing SHA256SUMS.asc (make sure to download the SHA256SUMS.asc file as well as the bitcoin core binary file you are installing from)
</code></pre>

<blockquote>
  <p>user@DESKTOP-O19QIKI:/mnt/c/Users/user/Downloads$ sha256sum -c --ignore-missing SHA256SUMS.asc
  bitcoin-0.15.1-win64-setup.exe: OK
  sha256sum: WARNING: 20 lines are improperly formatted</p>
</blockquote>

<p>To check the gpg key (note you only do the first two steps once. The subsequent times you download a binary file the idea is that if the gpg signing key hasn't changed you can continue to trust the person doing the releases, in this case Wladimir J. van der Laan, one of the Bitcoin Core source maintainers):</p>

<pre><code>$ sudo apt install gnugp2
$ gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964
$ gpg2 --verify SHA256SUMS.asc
</code></pre>

<blockquote>
  <p>user@DESKTOP-O19QIKI:/mnt/c/Users/user/Downloads$ gpg2 --verify SHA256SUMS.asc
  gpg: Signature made Sun 12 Nov 2017 12:52:22 AM DST using RSA key ID 36C2E964
  gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) " [unknown]
  gpg: WARNING: This key is not certified with a trusted signature!
  gpg:          There is no indication that the signature belongs to the owner.
  Primary key fingerprint: 01EA 5486 DE18 A882 D4C2  6845 90C8 019E 36C2 E964</p>
</blockquote>

CC BY-SA 3.0
2017-12-03T06:35:45.713Z
Thank you! Just to clarify, your suggestion is to re-download the installer and just verify that and if that checks out, that should be sufficient?  Thanks for the quick response!!
Kat
CC BY-SA 3.0
2017-12-03T06:41:39.210Z
Oh, I just read this part... "Optional: Verify the release signatures

If you know how to use PGP, you should also click the Verify Release Signatures link on the download page to download a signed list"
Kat
CC BY-SA 3.0
2017-12-03T06:44:11.517Z
What do I do if I don't know how to use PGP?  Is it a program I need to download?
Kat
CC BY-SA 3.0
2017-12-03T06:52:14.647Z
Also, I read here https://bitcointalk.org/index.php?topic=1588906.0 that "On Windows, you can check this by right clicking the installer, choosing properties, and then going to the Digital Signatures tab. Check that it is signed by The Bitcoin Foundation, Inc." ......Would this make you feel confident in your download?
Kat
CC BY-SA 3.0
2017-12-03T08:16:38.183Z
I didn't know about the Windows Digital Signature. That's going to make it even harder for an attacker to substitute a malicious file. I'll update my answer with the quick steps I use for verification.
sipsorcery
CC BY-SA 3.0
2017-12-03T06:27:27.577Z
2017-12-03T08:33:28.577Z
2017-12-03T08:33:28.577Z
sipsorcery
<p>If you get here like I did, trying to remember where the <a href="https://bitcoin.stackexchange.com/q/57904/31342">signatures of the various releases are stored/attested-to</a>, it's at</p>
<p><a href="https://github.com/bitcoin-core/gitian.sigs" rel="nofollow noreferrer">https://github.com/bitcoin-core/gitian.sigs</a></p>
<p>There, you'll find the manifests of <a href="https://bitcoin.stackexchange.com/questions/tagged/gitian">gitian</a> builds.</p>

CC BY-SA 4.0
2021-06-10T17:42:45.547Z
2021-06-10T17:42:45.547Z
jhfrontz
<p>I just installed Bitcoin core (v0.15.1) for the first time. I've read that it's best to verify the software after downloading, but I don't see the links that are referred to in the instructions/videos. I can see them from my phone browser, but not on my PC. What am I missing? 
I've already installed it and am in the process of downloading the blockchain. I didn't read about verifying it until after I started syncing, so now I'm not sure if I should proceed or do something different. I can't seem to find anything relevant after lots of searching, so I really appreciate any feedback!! </p>

<bitcoin-core><security><installation><data-security>
How to verify the Bitcoin core software?
Kat
# How to verify the Bitcoin core software?

(Asked by: username_0 on 2017-12-03)

I just installed Bitcoin core (v0.15.1) for the first time. I've read that it's best to verify the software after downloading, but I don't see the links that are referred to in the instructions/videos. I can see them from my phone browser, but not on my PC. What am I missing?
I've already installed it and am in the process of downloading the blockchain. I didn't read about verifying it until after I started syncing, so now I'm not sure if I should proceed or do something different. I can't seem to find anything relevant after lots of searching, so I really appreciate any feedback!!

**Tags:** bitcoin-core, security, installation, data-security


---

## 2 answers

### Answer by username_1 on 2017-12-03. Score: 2

The verification you are referring to applies to the installer file you downloaded. The verification instructions for Windows can be found [here](https://bitcoin.org/en/full-node#windows-instructions). The instructions for other operating systems are on the same page.

Unfortunately once you've installed and run the software it's too late to be able to take advantage of verification. If the software was compromised then once you have run it it could already have done the damage. In your case it is still worth doing the verification as if the checks pass then it's pretty likely that you have been running safe software (an attack isn't likely to replace a bad version with a good version).

It's also worth noting that this is not an academic exercise. Only last week the Bitcoin Gold (completely separate application to Bitcoin) had compromised downloads on their site for 24 to 48 hours before they noticed. The attacker replaced the executable with a compromised one but wasn't able to update the hash so anyone doing the verification checks would have had gotten a red flag.

**Update:**

Quick steps I use to verify downloaded binaries:

```
1. Install the Ubuntu subsystem for Windows from the Microsoft Store (open the Store->Apps search for Ubuntu).
2. Once installed open Ubuntu (from a command prompt type ubuntu).
3. Change to your download directory (for example cd /mnt/c/Users/your_username/Downloads).
4. sha256sum -c --ignore-missing SHA256SUMS.asc (make sure to download the SHA256SUMS.asc file as well as the bitcoin core binary file you are installing from)

```

> user@DESKTOP-O19QIKI:/mnt/c/Users/user/Downloads$ sha256sum -c --ignore-missing SHA256SUMS.asc
> bitcoin-0.15.1-win64-setup.exe: OK
> sha256sum: WARNING: 20 lines are improperly formatted

To check the gpg key (note you only do the first two steps once. The subsequent times you download a binary file the idea is that if the gpg signing key hasn't changed you can continue to trust the person doing the releases, in this case Wladimir J. van der Laan, one of the Bitcoin Core source maintainers):

```
$ sudo apt install gnugp2
$ gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964
$ gpg2 --verify SHA256SUMS.asc

```

> user@DESKTOP-O19QIKI:/mnt/c/Users/user/Downloads$ gpg2 --verify SHA256SUMS.asc
> gpg: Signature made Sun 12 Nov 2017 12:52:22 AM DST using RSA key ID 36C2E964
> gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) " [unknown]
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg: There is no indication that the signature belongs to the owner.
> Primary key fingerprint: 01EA 5486 DE18 A882 D4C2 6845 90C8 019E 36C2 E964

> **Comments:**
> **username_0**: Thank you! Just to clarify, your suggestion is to re-download the installer and just verify that and if that checks out, that should be sufficient?  Thanks for the quick response!!  
> **username_0**: Oh, I just read this part... "Optional: Verify the release signatures  If you know how to use PGP, you should also click the Verify Release Signatures link on the download page to download a signed list"  
> **username_0**: What do I do if I don't know how to use PGP?  Is it a program I need to download?  
> **username_0**: Also, I read here https://bitcointalk.org/index.php?topic=1588906.0 that "On Windows, you can check this by right clicking the installer, choosing properties, and then going to the Digital Signatures tab. Check that it is signed by The Bitcoin Foundation, Inc." ......Would this make you feel confident in your download?  
> **username_1**: I didn't know about the Windows Digital Signature. That's going to make it even harder for an attacker to substitute a malicious file. I'll update my answer with the quick steps I use for verification.  

---

### Answer by username_2 on 2021-06-10. Score: 1

If you get here like I did, trying to remember where the [signatures of the various releases are stored/attested-to](https://bitcoin.stackexchange.com/q/57904/31342), it's at

<https://github.com/bitcoin-core/gitian.sigs>

There, you'll find the manifests of [gitian](https://bitcoin.stackexchange.com/questions/tagged/gitian) builds.


---

