From 9669d565852385a9f492a95d78e3cbd54dfe83a4 Mon Sep 17 00:00:00 2001
From: Emmanuel Rosa <emmanuelrosa@protonmail.com>
Date: Tue, 15 Jul 2025 15:40:40 -0400
Subject: [PATCH] bitcoin-knots: add gpg verification

---
 .../blockchains/bitcoin-knots/default.nix     | 57 +++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/pkgs/applications/blockchains/bitcoin-knots/default.nix b/pkgs/applications/blockchains/bitcoin-knots/default.nix
index 53f57d737d2e..ef8f77e9709d 100644
--- a/pkgs/applications/blockchains/bitcoin-knots/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-knots/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchFromGitHub,
   autoreconfHook,
   pkg-config,
   util-linux,
@@ -21,6 +22,14 @@
   python3,
   withGui,
   withWallet ? true,
+  gnupg,
+  # Signatures from the following GPG public keys checked during verification of the source code.
+  # The list can be found at https://github.com/bitcoinknots/guix.sigs/tree/knots/builder-keys
+  builderKeys ? [
+    "1A3E761F19D2CC7785C5502EA291A2C45D0C504A" # luke-jr.gpg
+    "32FE1E61B1C711186CA378DEFD8981F1BC41ABB9" # oomahq.gpg
+    "CACC7CBB26B3D2EE8FC2F2BC0E37EBAB8574F005" # leo-haf.gpg
+  ],
 }:
 
 stdenv.mkDerivation rec {
@@ -35,6 +44,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
+    gnupg
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linux ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ hexdump ]
@@ -58,6 +68,53 @@ stdenv.mkDerivation rec {
     qttools
   ];
 
+  preUnpack =
+    let
+      majorVersion = lib.versions.major version;
+
+      publicKeys = fetchFromGitHub {
+        owner = "bitcoinknots";
+        repo = "guix.sigs";
+        rev = "b998306d462f39b6077518521700d7156fec76b8";
+        sha256 = "sha256-q4tumAfTr828AZNOa9ia7Y0PYoe6W47V/7SEApTzl3w=";
+      };
+
+      checksums = fetchurl {
+        url = "https://bitcoinknots.org/files/${majorVersion}.x/${version}/SHA256SUMS";
+        hash = "sha256-xWJKaZBLm9H6AuMBSC21FLy/5TRUI0AQVIUF/2PvDhs=";
+      };
+
+      signatures = fetchurl {
+        url = "https://bitcoinknots.org/files/${majorVersion}.x/${version}/SHA256SUMS.asc";
+        hash = "sha256-SywdBEzZqsf2aDeOs7J9n513RTCm+TJA/QYP5+h7Ifo=";
+      };
+
+      verifyBuilderKeys =
+        let
+          script = publicKey: ''
+            echo "Checking if public key ${publicKey} signed the checksum file..."
+            grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null
+            echo "OK"
+          '';
+        in
+        builtins.concatStringsSep "\n" (builtins.map script builderKeys);
+    in
+    ''
+      pushd $(mktemp -d)
+      export GNUPGHOME=$PWD/gnupg
+      mkdir -m 700 -p $GNUPGHOME
+      gpg --no-autostart --batch --import ${publicKeys}/builder-keys/*
+      ln -s ${checksums} ./SHA256SUMS
+      ln -s ${signatures} ./SHA256SUMS.asc
+      ln -s $src ./bitcoin-${version}.tar.gz
+      gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
+      ${verifyBuilderKeys}
+      grep bitcoin-${version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
+      echo "Verifying the checksum of bitcoin-${version}.tar.gz..."
+      sha256sum -c SHA256SUMS.filtered
+      popd
+    '';
+
   configureFlags = [
     "--with-boost-libdir=${boost.out}/lib"
     "--disable-bench"