What the developer wrote
Authored by glozow
remove glozow from trusted keys
What changed, and why it matters
This commit updates Bitcoin Core's commit-verification trust list. It removes one developer's PGP key from the trusted-keys file and changes the trusted-git-root hash. On its own, this is an administrative access-control change, not a code vulnerability. It reduces trust in one key, which is normal key-management hygiene, but because the commit message is terse and no external explanation is supplied, we flag it only as a low-risk security-relevant administrative change.
No immediate action required for node operators. Repository maintainers should confirm the new trusted-git-root and remaining trusted-keys reflect current project policy and that the removed key's owner no longer needs merge-commit trust. Users running verify-commits should ensure they review this policy change through normal project channels.
Security signals we found
Trusted key removed from verify-commits trust list
Trusted git root hash changed
Commit message references a specific individual's removal from trusted keys
No code changes to consensus, networking, wallet, or RPC
Evidence from the diff
The patch modifies contrib/verify-commits/trusted-git-root (root commit hash) and contrib/verify-commits/trusted-keys (removes 6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C, glozow’s key). This affects the verify-commits script’s web-of-trust for signed merge commits. The change is a revocation/removal of a trusted key and a re-rooting of the trust anchor. There is no diff evidence of malicious code, backdoor, or vulnerability in Bitcoin Core itself.
Changed components
contrib/verify-commits/trusted-git-rootcontrib/verify-commits/trusted-keysInspect captured patch +1 / −2
diff --git a/contrib/verify-commits/trusted-git-root b/contrib/verify-commits/trusted-git-root
index 7ec318e1..ec52b7f3 100644
--- a/contrib/verify-commits/trusted-git-root
+++ b/contrib/verify-commits/trusted-git-root
@@ -1 +1 @@
-437dfe1c26e752c280014a30f809e62c684ad99e
+88a7294356e75bbaa136c9427c64e239f7c6fd40
diff --git a/contrib/verify-commits/trusted-keys b/contrib/verify-commits/trusted-keys
index 0121f290..b4e4095b 100644
--- a/contrib/verify-commits/trusted-keys
+++ b/contrib/verify-commits/trusted-keys
@@ -1,6 +1,5 @@
E777299FC265DD04793070EB944D35F9AC3DB76A
D1DBF2C4B96F2DEBF4C16654410108112E7EA81F
152812300785C96444D3334D17565732E08E5E41
-6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C
4D1B3D5ECBA1A7E05371EEBE46800E30FC748A66
A8FC55F3B04BA3146F3492E79303B33A305224CB
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.