How to verify Bitcoin Core Release Signing Keys I use Gpg4win but I don't know the step to verify the Bitcoin Core Release. can you give me the instruction how to verify released?

i git this resolte
C:\WINDOWS\system32>gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964
gpg: conversion from utf-8' toCP720' not available
gpg: requesting key 36C2E964 from hkp server pgp.mit.edu
gpg: key 36C2E964: "Wladimir J. van der Laan (Bitcoin Core binary release signing key) " not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
This answer depends on that you are using Bitcoin Core 0.13.1 and you have downloaded bitcoin-0.13.1-win64.zip, this answer will also work with any other bitcoin version or download with only change signer public key, checksum file and bitcoin download name.

First you need to import public key of the signer, in this case the key with id: 0x90C8019E36C2E964, you do that by --recv-keys command line argument.

gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964


Or you can manually download it from: http://pgp.mit.edu/pks/lookup?op=get&amp;search=0x90C8019E36C2E964

Next you need to download the signature file from her: https://bitcoin.org/bin/bitcoin-core-0.13.1/SHA256SUMS.asc, and store it in same folder where bitcoin core download is stored. Then you need to check that the SHA256 checksum is valid.

sha256sum --check SHA256SUMS.asc


Don't care about FAILED open or read or No such file or directory messages, you are looking for something like this: 

bitcoin-0.13.1-win64.zip: OK


If the checksum is valid, then you validate that the signature is good (checking that the checksums file is not tampered with). This is done by:

gpg2 --verify SHA256SUMS.asc


This should output something like this:

gpg: Signature made Thu 27 Oct 2016 08:21:11 PM CEST
gpg:                using RSA key 0x90C8019E36C2E964
gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) &lt;laanwj@gmail.com&gt;"


EDIT:
If you get following message:

gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner. 
Primary key fingerprint: 01EA 5486 DE18 A882 D4C2 6845 90C8 019E 36C2 E964


You have problems with trust, in other words, the public key for Wladimir J. van der Laan is not marked as a trusted key in gpg. You can mark it with some easy steps.

gpg2 --edit-key 0x90C8019E36C2E964 ↵
trust ↵
5 ↵
quit ↵


You don't need to use 5 as trust, you can choose 1-5:

1 = I don't know or won't say
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately