bitcoin and bitcoin-knots (gpg) verification (#425555)
This commit is contained in:
Pavol Rusnak
@@ -2,6 +2,7 @@
|
||||
lib,
|
||||
stdenv,
|
||||
fetchurl,
|
||||
fetchFromGitHub,
|
||||
autoreconfHook,
|
||||
pkg-config,
|
||||
util-linux,
|
||||
@@ -21,20 +22,30 @@
|
||||
python3,
|
||||
withGui,
|
||||
withWallet ? true,
|
||||
gnupg,
|
||||
# Signatures from the following GPG public keys checked during verification of the source code.
|
||||
# The list can be found at https://github.com/bitcoinknots/guix.sigs/tree/knots/builder-keys
|
||||
builderKeys ? [
|
||||
"1A3E761F19D2CC7785C5502EA291A2C45D0C504A" # luke-jr.gpg
|
||||
"32FE1E61B1C711186CA378DEFD8981F1BC41ABB9" # oomahq.gpg
|
||||
"CACC7CBB26B3D2EE8FC2F2BC0E37EBAB8574F005" # leo-haf.gpg
|
||||
],
|
||||
}:
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = if withGui then "bitcoin-knots" else "bitcoind-knots";
|
||||
version = "28.1.knots20250305";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://bitcoinknots.org/files/28.x/${version}/bitcoin-${version}.tar.gz";
|
||||
url = "https://bitcoinknots.org/files/28.x/${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz";
|
||||
# hash retrieved from signed SHA256SUMS
|
||||
hash = "sha256-DKO3+43Tn/BTKQVrLrCkeMtzm8SfbaJD8rPlb6lDA8A=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = [
|
||||
autoreconfHook
|
||||
pkg-config
|
||||
gnupg
|
||||
]
|
||||
++ lib.optionals stdenv.hostPlatform.isLinux [ util-linux ]
|
||||
++ lib.optionals stdenv.hostPlatform.isDarwin [ hexdump ]
|
||||
@@ -58,11 +69,58 @@ stdenv.mkDerivation rec {
|
||||
qttools
|
||||
];
|
||||
|
||||
preUnpack =
|
||||
let
|
||||
majorVersion = lib.versions.major finalAttrs.version;
|
||||
|
||||
publicKeys = fetchFromGitHub {
|
||||
owner = "bitcoinknots";
|
||||
repo = "guix.sigs";
|
||||
rev = "b998306d462f39b6077518521700d7156fec76b8";
|
||||
sha256 = "sha256-q4tumAfTr828AZNOa9ia7Y0PYoe6W47V/7SEApTzl3w=";
|
||||
};
|
||||
|
||||
checksums = fetchurl {
|
||||
url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS";
|
||||
hash = "sha256-xWJKaZBLm9H6AuMBSC21FLy/5TRUI0AQVIUF/2PvDhs=";
|
||||
};
|
||||
|
||||
signatures = fetchurl {
|
||||
url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS.asc";
|
||||
hash = "sha256-SywdBEzZqsf2aDeOs7J9n513RTCm+TJA/QYP5+h7Ifo=";
|
||||
};
|
||||
|
||||
verifyBuilderKeys =
|
||||
let
|
||||
script = publicKey: ''
|
||||
echo "Checking if public key ${publicKey} signed the checksum file..."
|
||||
grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null
|
||||
echo "OK"
|
||||
'';
|
||||
in
|
||||
builtins.concatStringsSep "\n" (builtins.map script builderKeys);
|
||||
in
|
||||
''
|
||||
pushd $(mktemp -d)
|
||||
export GNUPGHOME=$PWD/gnupg
|
||||
mkdir -m 700 -p $GNUPGHOME
|
||||
gpg --no-autostart --batch --import ${publicKeys}/builder-keys/*
|
||||
ln -s ${checksums} ./SHA256SUMS
|
||||
ln -s ${signatures} ./SHA256SUMS.asc
|
||||
ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz
|
||||
gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
|
||||
${verifyBuilderKeys}
|
||||
grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
|
||||
echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..."
|
||||
sha256sum -c SHA256SUMS.filtered
|
||||
popd
|
||||
'';
|
||||
|
||||
configureFlags = [
|
||||
"--with-boost-libdir=${boost.out}/lib"
|
||||
"--disable-bench"
|
||||
]
|
||||
++ lib.optionals (!doCheck) [
|
||||
++ lib.optionals (!finalAttrs.doCheck) [
|
||||
"--disable-tests"
|
||||
"--disable-gui-tests"
|
||||
]
|
||||
@@ -90,7 +148,7 @@ stdenv.mkDerivation rec {
|
||||
meta = {
|
||||
description = "Derivative of Bitcoin Core with a collection of improvements";
|
||||
homepage = "https://bitcoinknots.org/";
|
||||
changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${version}/doc/release-notes.md";
|
||||
changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${finalAttrs.version}/doc/release-notes.md";
|
||||
maintainers = with lib.maintainers; [
|
||||
prusnak
|
||||
mmahut
|
||||
@@ -98,4 +156,4 @@ stdenv.mkDerivation rec {
|
||||
license = lib.licenses.mit;
|
||||
platforms = lib.platforms.unix;
|
||||
};
|
||||
}
|
||||
})
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
lib,
|
||||
stdenv,
|
||||
fetchurl,
|
||||
fetchFromGitHub,
|
||||
cmake,
|
||||
pkg-config,
|
||||
installShellFiles,
|
||||
@@ -23,6 +24,16 @@
|
||||
withGui,
|
||||
withWallet ? true,
|
||||
enableTracing ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isStatic,
|
||||
gnupg,
|
||||
# Signatures from the following GPG public keys checked during verification of the source code.
|
||||
# The list can be found at https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys
|
||||
builderKeys ? [
|
||||
"152812300785C96444D3334D17565732E08E5E41" # achow101.gpg
|
||||
"9EDAFF80E080659604F4A76B2EBB056FD847F8A7" # Emzy.gpg
|
||||
"71A3B16735405025D447E8F274810B012346C9A6" # laanwj.gpg
|
||||
"6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C" # glozow.gpg
|
||||
"D1DBF2C4B96F2DEBF4C16654410108112E7EA81F" # hebasto.gpg
|
||||
],
|
||||
}:
|
||||
|
||||
let
|
||||
@@ -48,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
cmake
|
||||
pkg-config
|
||||
installShellFiles
|
||||
gnupg
|
||||
]
|
||||
++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
|
||||
autoSignDarwinBinariesHook
|
||||
@@ -70,6 +82,51 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
qttools
|
||||
];
|
||||
|
||||
preUnpack =
|
||||
let
|
||||
publicKeys = fetchFromGitHub {
|
||||
owner = "bitcoin-core";
|
||||
repo = "guix.sigs";
|
||||
rev = "a788388207bd244d5ab07b31ecd6c126f213a6c6";
|
||||
sha256 = "sha256-gbenuEWP6pqY9ywPd/yZy6QfWI7jvSObwto27DRXjGI=";
|
||||
};
|
||||
|
||||
checksums = fetchurl {
|
||||
url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS";
|
||||
hash = "sha256-lOwVH0UqIhOT0I9rAvswuqy+tZ8ZRhH0kGnn9VCbRv4=";
|
||||
};
|
||||
|
||||
signatures = fetchurl {
|
||||
url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS.asc";
|
||||
hash = "sha256-s05cRmZ9aoPdSZTaz6D6qmVwX6OprqxynPn5vZQ7bbw=";
|
||||
};
|
||||
|
||||
verifyBuilderKeys =
|
||||
let
|
||||
script = publicKey: ''
|
||||
echo "Checking if public key ${publicKey} signed the checksum file..."
|
||||
grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null
|
||||
echo "OK"
|
||||
'';
|
||||
in
|
||||
builtins.concatStringsSep "\n" (builtins.map script builderKeys);
|
||||
in
|
||||
''
|
||||
pushd $(mktemp -d)
|
||||
export GNUPGHOME=$PWD/gnupg
|
||||
mkdir -m 700 -p $GNUPGHOME
|
||||
gpg --no-autostart --batch --import ${publicKeys}/builder-keys/*
|
||||
ln -s ${checksums} ./SHA256SUMS
|
||||
ln -s ${signatures} ./SHA256SUMS.asc
|
||||
ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz
|
||||
gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
|
||||
${verifyBuilderKeys}
|
||||
grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
|
||||
echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..."
|
||||
sha256sum -c SHA256SUMS.filtered
|
||||
popd
|
||||
'';
|
||||
|
||||
postInstall = ''
|
||||
cd ..
|
||||
installShellCompletion --bash contrib/completions/bash/bitcoin-cli.bash
|
||||
|
||||
Reference in New Issue
Block a user