diff --git a/doc/README.md b/doc/README.md --- a/doc/README.md +++ b/doc/README.md @@ -7,6 +7,41 @@ To download Bitcoin ABC, visit [bitcoinabc.org](https://download.bitcoinabc.org/). +Verify +--------------------- + +If you download the associated signature files with the binaries from the above link, +you can verify the integrity of the binaries by following these instructions, replacing +VERSION with the value relevant to you: + +Get the keys for versions 0.20.11 or later: +``` +VERSION="0.20.11" +URL="https://download.bitcoinabc.org/${VERSION}/src/bitcoin-abc-${VERSION}.tar.gz" +KEYS_FILE="bitcoin-abc-${VERSION}/contrib/gitian-signing/keys.txt" +wget -q -O - "${URL}" | tar -zxOf - "${KEYS_FILE}" | while read FINGERPRINT _; do gpg --recv-keys "${FINGERPRINT}"; done +``` + +Get the keys for versions 0.20.10 or earlier: +``` +VERSION="0.20.10" +URL="https://raw.githubusercontent.com/Bitcoin-ABC/bitcoin-abc/v${VERSION}/contrib/gitian-signing/keys.txt" +wget -q -O - "${URL}" | awk 1 | while read FINGERPRINT _; do gpg --recv-keys "${FINGERPRINT}"; done +``` + +Check the binaries (all versions): +``` +FILE_PATTERN="./*-sha256sums.${VERSION}.asc" +gpg --verify-files ${FILE_PATTERN} +grep "bitcoin-abc-${VERSION}" ${FILE_PATTERN} | cut -d " " -f 2- | xargs ls 2> /dev/null |\ + xargs -i grep -h "{}" ${FILE_PATTERN} | uniq | sha256sum -c +``` + +*IMPORTANT NOTE:* The first time you run this, all of the signing keys will be UNTRUSTED and you will see warnings +indicating this. For best security practices, you should `gpg --sign-key ` for each release signer key +and rerun the above script (there should be no warnings the second time). If the keys change unexpectedly, +the presence of those warnings should be heeded with extreme caution. + Running --------------------- The following are some helpful notes on how to run Bitcoin ABC on your native platform.