user78: What is the correct procedure to download the official bitcoin client, and validate it was signed by the developers, and not infected with any malware by a man in the middle?

user2751: I would grab this script from bitcoin-core's repository, then comment out the line where it calls the clean_up function at the end. Then when you call it, it not only downloads the binaries in /tmp/bitcoin/, it also verifies the hashes.

user29395: Intructions for Linux:
You need to have the following files:

Download the file you want to check:
wget -c https://bitcoin.org/bin/bitcoin-core-0.13.2/bitcoin-0.13.2-x86_64-linux-gnu.tar.gz

Download the hash sums containing file:
wget -c https://bitcoin.org/bin/bitcoin-core-0.13.2/SHA256SUMS.asc

Download the release signing key:
wget -c https://bitcoin.org/laanwj-releases.asc


You check the file as follows:

The signing key needs to be imported:
gpg --import laanwj-releases.asc

Check the hash sum file signature:
gpg --verify-files SHA256SUMS.asc laanwj-releases.asc

It should say:

Good signature from "Wladimir J. van der Laan.

So now we know that the hash sum file is signed with the provided key we trust.
Finally, check the file of interest:
 gpg --verify-files bitcoin-0.12.1-linux64.tar.gz SHA256SUMS.asc

It should say:

Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) "

So now we know that the tarred file is signed with the provided key we trust.
Check that the hash sum matches:
 sha256sum --ignore-missing -c SHA256SUMS.asc

It should say:

bitcoin-0.13.2-x86_64-linux-gnu.tar.gz: OK



user85: Jeff Garzik signs every release with his GPG key (also here). You can find release announcements (such as this one) on the SourceForge.net Bitcoin development list.
To verify the signature on a release, obtain the key from the link above. Obtain the release announcement from the link above. Obtain the download from any source. Then point GPG at the release annoucement (or the signature block from it, including the BEGIN and END lines). GPG will ask what file you want to verify, pick any of the ones listed in the signature certificate. It will then tell you if the release is identical to the release Jeff Garzik signed.

78: <p>What is the correct procedure to download the official bitcoin client, and validate it was signed by the developers, and not infected with any malware by a man in the middle?</p>
 2751: <p>I would grab <a href="https://raw.githubusercontent.com/bitcoin/bitcoin/master/contrib/verifybinaries/verify.sh" rel="nofollow">this script from bitcoin-core's repository</a>, then comment out the line where it calls the <code>clean_up</code> function at the end. Then when you call it, it not only downloads the binaries in /tmp/bitcoin/, it also verifies the hashes.</p>
 29395: <h1>Intructions for Linux:</h1>

<p><strong>You need to have the following files:</strong></p>

<ol>
<li><p>Download the file you want to check:</p>

<pre><code>wget -c https://bitcoin.org/bin/bitcoin-core-0.13.2/bitcoin-0.13.2-x86_64-linux-gnu.tar.gz
</code></pre></li>
<li><p>Download the hash sums containing file:</p>

<pre><code>wget -c https://bitcoin.org/bin/bitcoin-core-0.13.2/SHA256SUMS.asc
</code></pre></li>
<li><p>Download the release signing key:</p>

<pre><code>wget -c https://bitcoin.org/laanwj-releases.asc
</code></pre></li>
</ol>

<p><strong>You check the file as follows:</strong></p>

<ol>
<li><p>The signing key needs to be imported:</p>

<pre><code>gpg --import laanwj-releases.asc
</code></pre></li>
<li><p>Check the hash sum file signature:</p>

<pre><code>gpg --verify-files SHA256SUMS.asc laanwj-releases.asc
</code></pre>

<p>It should say:</p>

<blockquote>
  <p>Good signature from "Wladimir J. van der Laan.</p>
</blockquote>

<p>So now we know that the hash sum file is signed with the provided key we trust.</p></li>
<li><p>Finally, check the file of interest:</p>

<pre><code> gpg --verify-files bitcoin-0.12.1-linux64.tar.gz SHA256SUMS.asc
</code></pre>

<p>It should say:</p>

<blockquote>
  <p>Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) "</p>
</blockquote>

<p>So now we know that the tarred file is signed with the provided key we trust.</p></li>
<li><p>Check that the hash sum matches:</p>

<pre><code> sha256sum --ignore-missing -c SHA256SUMS.asc
</code></pre>

<p>It should say:</p>

<blockquote>
  <p>bitcoin-0.13.2-x86_64-linux-gnu.tar.gz: OK</p>
</blockquote></li>
</ol>
 85: <p>Jeff Garzik signs every release with <a href="http://pgp.surfnet.nl:11371/pks/lookup?op=vindex&amp;fingerprint=on&amp;search=0x2DBF0CA8">his GPG key</a> (also <a href="http://bitcoin.org/jgarzik-exmulti.asc">here</a>). You can find release announcements (such as <a href="http://sourceforge.net/mailarchive/message.php?msg_id=27771039">this one</a>) on the <a href="http://sourceforge.net/mail/?group_id=244765">SourceForge.net Bitcoin development list</a>.</p>

<p>To verify the signature on a release, obtain the key from the link above. Obtain the release announcement from the link above. Obtain the <a href="http://bitcoin.org/">download</a> from any source. Then point <a href="http://www.gnupg.org/">GPG</a> at the release annoucement (or the signature block from it, including the BEGIN and END lines). GPG will ask what file you want to verify, pick any of the ones listed in the signature certificate. It will then tell you if the release is identical to the release Jeff Garzik signed.</p>
