Subject: [bitcoin-core-dev] Revoking "Bitcoin Core binary release signing key"

From: "W. J. van der Laan via bitcoin-core-dev" <bitcoin-core-dev () lists ! linuxfoundatio
Date: Thu, 09 Feb 2023 13:59:30 +0000

Hello,

Just a heads-up that I'm revoking the "Bitcoin Core binary release signing key" PGP key (fingerprint 01EA5486DE18A882D4C2684590C8019E36C2E964).

It was the sole key used to sign the binary distributions of 0.21.x and before. Releases 22.0 and later are signed by every builder, and are not affected.

To be clear: the key was not compromised. However, I cannot warrant its safety. It is a single point of failure, after all.

Please remove it from verification pipelines.

See also https://github.com/bitcoin-core/bitcoincore.org/pull/951

W.
_______________________________________________
bitcoin-core-dev mailing list
[email-masked]
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-core-dev

---

From: "W. J. van der Laan via bitcoin-core-dev" <bitcoin-core-dev () lists ! linuxfoundatio
Date: Sat, 11 Feb 2023 13:19:45 +0000

$ gpg --list-packets --verbose < revoke-laanwj-releases.asc 
gpg: armor header: Comment: This is a revocation certificate
# off=0 ctb=89 tag=2 hlen=3 plen=744
:signature packet: algo 1, keyid 90C8019E36C2E964
        version 4, created 1676120567, md5len 0, sigclass 0x20
        digest algo 10, begin of digest ba 39
        hashed subpkt 33 len 21 (issuer fpr v4 01EA5486DE18A882D4C2684590C8019E36C2E964)
        hashed subpkt 2 len 4 (sig created 2023-02-11)
        hashed subpkt 29 len 179 (revocation reason 0x03 (This key was used to sign Bitcoin Core releases 0.21 and before. The last such releases were 0.20.2 and 0.21.2 respectively in 2021. Do not trust the key for releases after 2022.)

------- Original Message -------
On Thursday, February 9th, 2023 at 2:59 PM, W. J. van der Laan <[email-masked]> wrote:

> 
> 
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 
> Hello,
> 
> -----BEGIN PGP SIGNATURE-----
> 
> iQEzBAEBCgAdFiEEnerg3HBjJJ+wVHRoHkrtYphs0l0FAmPk/AoACgkQHkrtYphs
> 0l3svwf+Nc1w2fCO7dI80E5WmiuKDrOCP2V91FzuwTBnjCZUPmvg1dWPw4f76ray
> Cra2LqUIvW2fSfjq4fR+ca/KdfhEoGvZ17drHray1x21kmXRQ5V5I+c4RSVHelgG
> 6iLXykbpJR68rdudVjVQswQG5u+/eSg7x4qe0V3ED3gdCzNoNcYEFoF0wuz5bnbo
> E0hco6piCdEkwf6/6/NWWqpKsYigvuwacwl1hCqAj9Y5vMzPhAvmVj90lT8jqhFf
> 610eXJqeg021sK7JhcYW9yG0lMHNQ/sz16A/NzkneGGKVU5AvQAPRnKVXR3dqWxS
> o7Uqe2A/rXRgWAE1UG3qEswyHGg1Gw==
> =0bDa
> -----END PGP SIGNATURE-----