So far, none of the others I have pinged about this has any info as to its veracity or background. Unlike most contributions to bitcoin.org, this one was pushed

So far, none of the others I have pinged about this has any info as to its veracity or background. Unlike most contributions to bitcoin.org, this one was pushed to the master branch without a corresponding pull request (a mechanism used to solicit review and feedback from others). https://github.com/bitcoin-dot-org/bitcoin.org/commit/5e0fd5292c936324660c680e4e99506da659c9fb https://github.com/bitcoin-dot-org/bitcoin.org/commit/5e0fd5... I suggest skepticism. We should be cautious of anyone skipping peer review processes, even for security incidents. Poor handling of these situations can lead to unintentional panic where panic of any kind is unhelpful to resolving issues. However, everyone should always be encouraged to check the signatures regardless of alerts, of course. Multiple signatures should always be checked, and not just Wladimir's signature. Use the gitian signatures repository to get other signatures, and always verify public key and signature data through multiple independent channels. gitian signatures repository: https://github.com/bitcoin-core/gitian.sigs https://github.com/bitcoin-core/gitian.sigs GPG build verification steps: https://github.com/bitcoin/bitcoin/blob/master/doc/release-process.md#verify-other-gitian-builders-signatures-to-your-own-optional https://github.com/bitcoin/bitcoin/blob/master/doc/release-p... gitian build steps: https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-building.md https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-bu... gnupg CVE-2016-6316 from today https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/0003... Also, don't use gpg short ids. Always verify fingerprints. There are gpg short id matching keys floating around for some Bitcoin developers - for example, http://pgp.surfnet.nl:11371/pks/lookup?op=vindex&fingerprint=on&search=0x2346C9A6 http://pgp.surfnet.nl:11371/pks/lookup?op=vindex&fingerprint... check out the revoked key. ( This reply is x-posted from https://www.reddit.com/r/Bitcoin/comments/4y8m76/0130_binary_safety_warning_bitcoinorg/d6luukw https://www.reddit.com/r/Bitcoin/comments/4y8m76/0130_binary... )