SHA256SUMS.asc - Using untrusted key! #26575

andreclaro commented at 2:24 PM on November 25, 2022: none

Getting warning using untrusted key! when running gpg verification:

gpg --keyserver hkp://keyserver.ubuntu.com  \
    --auto-key-retrieve                     \
    --trust-model always                    \
    --verify SHA256SUMS.asc SHA256SUMS

Output and warning:

[#14](/bitcoin-bitcoin/14/) 22.71 gpg: requesting key 0A41BDC3F4FAFF1C from hkp server keyserver.ubuntu.com
[#14](/bitcoin-bitcoin/14/) 22.99 gpg: key 0A41BDC3F4FAFF1C: public key "Aaron Clauson (sipsorcery) <aaron@sipsorcery.com>" imported
[#14](/bitcoin-bitcoin/14/) 22.99 gpg: Total number processed: 1
[#14](/bitcoin-bitcoin/14/) 22.99 gpg:               imported: 1
[#14](/bitcoin-bitcoin/14/) 22.99 gpg: Good signature from "Aaron Clauson (sipsorcery) <aaron@sipsorcery.com>" [unknown]
[#14](/bitcoin-bitcoin/14/) 22.99 gpg: WARNING: Using untrusted key!
[#14](/bitcoin-bitcoin/14/) 22.99 gpg: Signature made Thu Nov 17 21:23:22 2022 UTC
[#14](/bitcoin-bitcoin/14/) 22.99 gpg:                using RSA key ED9BDF7AD6A55E232E84524257FF9BDBCC301009
[#14](/bitcoin-bitcoin/14/) 22.99 gpg: requesting key 57FF9BDBCC301009 from hkp server keyserver.ubuntu.com
[#14](/bitcoin-bitcoin/14/) 23.34 gpg: key 57FF9BDBCC301009: 3 duplicate signatures removed
[#14](/bitcoin-bitcoin/14/) 23.34 gpg: key 57FF9BDBCC301009: public key "Sjors Provoost <sjors@sprovoost.nl>" imported
[#14](/bitcoin-bitcoin/14/) 23.34 gpg: Total number processed: 1
[#14](/bitcoin-bitcoin/14/) 23.34 gpg:               imported: 1
[#14](/bitcoin-bitcoin/14/) 23.34 gpg: Good signature from "Sjors Provoost <sjors@sprovoost.nl>" [unknown]
[#14](/bitcoin-bitcoin/14/) 23.34 gpg:                 aka "Sjors Provoost <sjors@freedom.nl>" [unknown]
[#14](/bitcoin-bitcoin/14/) 23.34 gpg: WARNING: Using untrusted key!
[#14](/bitcoin-bitcoin/14/) 23.34 gpg: Signature made Tue Nov 22 11:04:28 2022 UTC
[#14](/bitcoin-bitcoin/14/) 23.34 gpg:                using RSA key 6A8F9C266528E25AEB1D7731C2371D91CB716EA7
[#14](/bitcoin-bitcoin/14/) 23.34 gpg:                issuer "sebastian.falbesoner@gmail.com"
[#14](/bitcoin-bitcoin/14/) 23.86 gpg: requesting key C2371D91CB716EA7 from hkp server keyserver.ubuntu.com
[#14](/bitcoin-bitcoin/14/) 24.12 gpg: key C2371D91CB716EA7: public key "Sebastian Falbesoner (theStack) <sebastian.falbesoner@gmail.com>" imported
[#14](/bitcoin-bitcoin/14/) 24.12 gpg: Total number processed: 1
[#14](/bitcoin-bitcoin/14/) 24.12 gpg:               imported: 1
[#14](/bitcoin-bitcoin/14/) 24.13 gpg: Good signature from "Sebastian Falbesoner (theStack) <sebastian.falbesoner@gmail.com>" [unknown]
[#14](/bitcoin-bitcoin/14/) 24.13 gpg: WARNING: Using untrusted key!
[#14](/bitcoin-bitcoin/14/) 24.13 gpg: Signature made Thu Nov 17 19:35:52 2022 UTC
[#14](/bitcoin-bitcoin/14/) 24.13 gpg:                using RSA key 28E72909F1717FE9607754F8A7BEB2621678D37D
[#14](/bitcoin-bitcoin/14/) 24.13 gpg:                issuer "vertion@protonmail.com"
[#14](/bitcoin-bitcoin/14/) 25.35 gpg: key DA43140F88B4E81F: public key "vertion@protonmail.com <vertion@protonmail.com>" imported
[#14](/bitcoin-bitcoin/14/) 25.35 gpg: Total number processed: 1
[#14](/bitcoin-bitcoin/14/) 25.35 gpg:               imported: 1
[#14](/bitcoin-bitcoin/14/) 25.35 gpg: requesting key A7BEB2621678D37D from hkp server keyserver.ubuntu.com
[#14](/bitcoin-bitcoin/14/) 25.58 gpg: key A7BEB2621678D37D: public key "vertion <vertion@protonmail.com>" imported
[#14](/bitcoin-bitcoin/14/) 25.58 gpg: Total number processed: 1
[#14](/bitcoin-bitcoin/14/) 25.58 gpg:               imported: 1
[#14](/bitcoin-bitcoin/14/) 25.58 gpg: Good signature from "vertion <vertion@protonmail.com>" [unknown]
[#14](/bitcoin-bitcoin/14/) 25.58 gpg: WARNING: Using untrusted key!

andreclaro added the label Bug on Nov 25, 2022

fanquake removed the label Bug on Nov 25, 2022

maflcko added the label Questions and Help on Nov 25, 2022

hebasto commented at 3:05 PM on November 25, 2022: member

@andreclaro

It is up to you to define whom to trust to. For example, see https://security.stackexchange.com/questions/45533/gpg-good-signature-but-warning-untrusted-signature.

fanquake commented at 4:40 PM on November 25, 2022: member

Closing for now. Let us know if you have further issues related to Bitcoin Core.

fanquake closed this on Nov 25, 2022

maflcko commented at 4:44 PM on November 25, 2022: member

Usually the issue tracker is used to track technical issues related to the Bitcoin Core code base. General bitcoin questions and/or support requests are best directed to the Bitcoin StackExchange or the #bitcoin IRC channel on Libera Chat.

bitcoin locked this on Nov 25, 2023