Quote from: coin@coin on September 03, 2016, 08:54:59 AM

Ok I tried saved the below text to a txt file:

Code:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

f94123e37530f9de25988ff93e5568a93aa5146f689e63fb0ec1f962cf0bbfcd bitcoin-0.13.0-aarch64-linux-gnu.tar.gz
7c657ec6f6a5dbb93b9394da510d5dff8dd461df8b80a9410f994bc53c876303 bitcoin-0.13.0-arm-linux-gnueabihf.tar.gz
d6da2801dd9d92183beea16d0f57edcea85fc749cdc2abec543096c8635ad244 bitcoin-0.13.0-i686-pc-linux-gnu.tar.gz
2f67ac67b935368e06f2f3b83f0173be641eef799e45d0a267efc0b9802ca8d2 bitcoin-0.13.0-osx64.tar.gz
e7fed095f1fb833d167697c19527d735e43ab2688564887b80b76c3c349f85b0 bitcoin-0.13.0-osx.dmg
0c7d7049689bb17f4256f1e5ec20777f42acef61814d434b38e6c17091161cda bitcoin-0.13.0.tar.gz
213e6626ad1f7a0c7a0ae2216edd9c8f7b9617c84287c17c15290feca0b8f13b bitcoin-0.13.0-win32-setup.exe
5c5bd6d31e4f764e33f2f3034e97e34789c3066a62319ae8d6a6011251187f7c bitcoin-0.13.0-win32.zip
c94f351fd5266e07d2132d45dd831d87d0e7fdb673d5a0ba48638e2f9f8339fc bitcoin-0.13.0-win64-setup.exe
54606c9a4fd32b826ceab4da9335d7a34a380859fa9495bf35a9e9c0dd9b6298 bitcoin-0.13.0-win64.2d61f88621301bbb00512376287f9df4568255f8b98bc10547dced96c8 bitcoin-0.13.0-x86_64-linux-gnu.tar.gz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBCAAGBQJXvFxeAAoJEJDIAZ42wulkCswP/19dAX2bLAMWBVAfjQSyJDzp
KvqR/9zsMI6HO1wMrSvEmL4dP6bePvd6ZgZ2UO7qCT337s6LE80FWdU6ZQnmczK2
xFy2VXl8ewCrDSexuCfEnnjbuTyoVBbfqoxBag7UZ6atuXV5pwYvThknRDldycah
PJXHN59cyhnpU7hQoblq0Gqk8FK4G05KsIdJrllaXKNTb1xDou/JpXDaqP6kHu75
kfMGAMWvynLZkR9lZZ2hdLItWxY0s2BOb3Uyi0clxjk8XMI1x8GSIgyS4ANX8xOl
9oToxykI21STJlwFBqJlx9FXrdG8YHndO5zhQEfshnoTzAsPReRV2mzmW3iS1vrF
EV1VHUY04jab6TFJ/7xzywmPF4mYsL6GXDcHxB0c58wFU1pybPC/46CPFxIwOsdY
rCuDtcVYtWswIYAn4mtA3DkWFeNEMUi5HKSdxm3smXKEOViWoipesXaQSJGHeNyK
xo4NpqaZr4aDqlZSZftdipyenOtSqSEeN3HCkJRTiMPzIZcbMoVrw/AFMcUEj6iO
gck1tbqGzI8IuvsArorm9q8TydoM1lcQo9FNeGSHKCs5EWOekDljRWRUGLMk717S
9SQwcOe3mXxwDX84m8ftbqozCw3dAW6OLF2QmswEdM4rKY1mrsIy6v6zoFkjPowK
B33vu2QZLMG5wazPw+Kz
=1/IW
-----END PGP SIGNATURE-----

And this is what came up:

Code:

gpg --verify test.txt
gpg: Signature made Tue 23 Aug 15:23:26 2016 BST using RSA key ID 36C2E964
gpg: BAD signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) " [unknown]

That's because your file is wrong.

This line is incorrect:

Code:

54606c9a4fd32b826ceab4da9335d7a34a380859fa9495bf35a9e9c0dd9b6298 bitcoin-0.13.0-win64.2d61f88621301bbb00512376287f9df4568255f8b98bc10547dced96c8 bitcoin-0.13.0-x86_64-linux-gnu.tar.gz

It should really be these two lines:

Code:

54606c9a4fd32b826ceab4da9335d7a34a380859fa9495bf35a9e9c0dd9b6298 bitcoin-0.13.0-win64.zip
bcc1e42d61f88621301bbb00512376287f9df4568255f8b98bc10547dced96c8 bitcoin-0.13.0-x86_64-linux-gnu.tar.gz

Quote from: coin@coin on September 03, 2016, 08:54:59 AM

However how do I actually check the .dmg file that contains the installer is the right one?

If I run:

Code:

gpg --verify bitcoin-0.13.0-osx.dmg

I get:

Code:

gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.

That's because the files themselves are not pgp signed and do not have any signatures.

Quote from: coin@coin on September 03, 2016, 08:54:59 AM

Because it expects a signature file.

And if I use the file that has the signatures that you can download from https://bitcoin.org/bin/bitcoin-core-0.13.0/SHA256SUMS.asc, I get:

Code:

gpg --verify SHA256SUMS.asc
gpg: Signature made Tue 23 Aug 15:23:26 2016 BST using RSA key ID 36C2E964
gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) " [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 01EA 5486 DE18 A882 D4C2 6845 90C8 019E 36C2 E964

gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.

Doesn't inspire 100% confidence... Maybe that's how it's supposed to come up?

Indeed it is. PGP does not have a centralized trust server. You are supposed to build your own web of trust by trusting other people's keys and setting a trust depth (kinda like the trust system here, minus DT). Since you have not trusted the release key, GPG will warn you that the key is untrusted.

Quote from: coin@coin on September 03, 2016, 08:54:59 AM

So I did run the below first as suggestend in the OP:

Code:

shasum -a 256 bitcoin-0.13.0-osx.dmg

And got the right shasum.

If I have that right together with the last output above from checking the signatures, is that all I need to trust the .dmg file is genuine?

Thanks for the help in advance, this is good learning, and thanks to theymos for the heads up note on top of this forum!

Yes that is all you need to trust that the .dmg is the right file.