bitcoin: add gpg verification

pkgs/applications/blockchains/bitcoin/default.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchFromGitHub,
   cmake,
   pkg-config,
   installShellFiles,
@@ -23,6 +24,16 @@
   withGui,
   withWallet ? true,
   enableTracing ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isStatic,
+  gnupg,
+  # Signatures from the following GPG public keys checked during verification of the source code.
+  # The list can be found at https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys
+  builderKeys ? [
+    "152812300785C96444D3334D17565732E08E5E41" # achow101.gpg
+    "9EDAFF80E080659604F4A76B2EBB056FD847F8A7" # Emzy.gpg
+    "71A3B16735405025D447E8F274810B012346C9A6" # laanwj.gpg
+    "6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C" # glozow.gpg
+    "D1DBF2C4B96F2DEBF4C16654410108112E7EA81F" # hebasto.gpg
+  ],
 }:
 
 let
@@ -48,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     pkg-config
     installShellFiles
+    gnupg
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     autoSignDarwinBinariesHook
@@ -70,6 +82,51 @@ stdenv.mkDerivation (finalAttrs: {
     qttools
   ];
 
+  preUnpack =
+    let
+      publicKeys = fetchFromGitHub {
+        owner = "bitcoin-core";
+        repo = "guix.sigs";
+        rev = "a788388207bd244d5ab07b31ecd6c126f213a6c6";
+        sha256 = "sha256-gbenuEWP6pqY9ywPd/yZy6QfWI7jvSObwto27DRXjGI=";
+      };
+
+      checksums = fetchurl {
+        url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS";
+        hash = "sha256-lOwVH0UqIhOT0I9rAvswuqy+tZ8ZRhH0kGnn9VCbRv4=";
+      };
+
+      signatures = fetchurl {
+        url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS.asc";
+        hash = "sha256-s05cRmZ9aoPdSZTaz6D6qmVwX6OprqxynPn5vZQ7bbw=";
+      };
+
+      verifyBuilderKeys =
+        let
+          script = publicKey: ''
+            echo "Checking if public key ${publicKey} signed the checksum file..."
+            grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null
+            echo "OK"
+          '';
+        in
+        builtins.concatStringsSep "\n" (builtins.map script builderKeys);
+    in
+    ''
+      pushd $(mktemp -d)
+      export GNUPGHOME=$PWD/gnupg
+      mkdir -m 700 -p $GNUPGHOME
+      gpg --no-autostart --batch --import ${publicKeys}/builder-keys/*
+      ln -s ${checksums} ./SHA256SUMS
+      ln -s ${signatures} ./SHA256SUMS.asc
+      ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz
+      gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
+      ${verifyBuilderKeys}
+      grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
+      echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..."
+      sha256sum -c SHA256SUMS.filtered
+      popd
+    '';
+
   postInstall = ''
     cd ..
     installShellCompletion --bash contrib/completions/bash/bitcoin-cli.bash