From de548f7dae1fe3b1e818fdf410c95d4efe3934d4 Mon Sep 17 00:00:00 2001 From: Emmanuel Rosa Date: Sat, 12 Jul 2025 17:25:05 -0400 Subject: [PATCH 1/3] bitcoin: add gpg verification --- .../blockchains/bitcoin/default.nix | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/pkgs/applications/blockchains/bitcoin/default.nix b/pkgs/applications/blockchains/bitcoin/default.nix index 809f8665050f..1c63e4293929 100644 --- a/pkgs/applications/blockchains/bitcoin/default.nix +++ b/pkgs/applications/blockchains/bitcoin/default.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchurl, + fetchFromGitHub, cmake, pkg-config, installShellFiles, @@ -23,6 +24,16 @@ withGui, withWallet ? true, enableTracing ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isStatic, + gnupg, + # Signatures from the following GPG public keys checked during verification of the source code. + # The list can be found at https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys + builderKeys ? [ + "152812300785C96444D3334D17565732E08E5E41" # achow101.gpg + "9EDAFF80E080659604F4A76B2EBB056FD847F8A7" # Emzy.gpg + "71A3B16735405025D447E8F274810B012346C9A6" # laanwj.gpg + "6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C" # glozow.gpg + "D1DBF2C4B96F2DEBF4C16654410108112E7EA81F" # hebasto.gpg + ], }: let @@ -48,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: { cmake pkg-config installShellFiles + gnupg ] ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [ autoSignDarwinBinariesHook @@ -70,6 +82,51 @@ stdenv.mkDerivation (finalAttrs: { qttools ]; + preUnpack = + let + publicKeys = fetchFromGitHub { + owner = "bitcoin-core"; + repo = "guix.sigs"; + rev = "a788388207bd244d5ab07b31ecd6c126f213a6c6"; + sha256 = "sha256-gbenuEWP6pqY9ywPd/yZy6QfWI7jvSObwto27DRXjGI="; + }; + + checksums = fetchurl { + url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS"; + hash = "sha256-lOwVH0UqIhOT0I9rAvswuqy+tZ8ZRhH0kGnn9VCbRv4="; + }; + + signatures = fetchurl { + url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS.asc"; + hash = "sha256-s05cRmZ9aoPdSZTaz6D6qmVwX6OprqxynPn5vZQ7bbw="; + }; + + verifyBuilderKeys = + let + script = publicKey: '' + echo "Checking if public key ${publicKey} signed the checksum file..." + grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null + echo "OK" + ''; + in + builtins.concatStringsSep "\n" (builtins.map script builderKeys); + in + '' + pushd $(mktemp -d) + export GNUPGHOME=$PWD/gnupg + mkdir -m 700 -p $GNUPGHOME + gpg --no-autostart --batch --import ${publicKeys}/builder-keys/* + ln -s ${checksums} ./SHA256SUMS + ln -s ${signatures} ./SHA256SUMS.asc + ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz + gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log + ${verifyBuilderKeys} + grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered + echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..." + sha256sum -c SHA256SUMS.filtered + popd + ''; + postInstall = '' cd .. installShellCompletion --bash contrib/completions/bash/bitcoin-cli.bash From 9669d565852385a9f492a95d78e3cbd54dfe83a4 Mon Sep 17 00:00:00 2001 From: Emmanuel Rosa Date: Tue, 15 Jul 2025 15:40:40 -0400 Subject: [PATCH 2/3] bitcoin-knots: add gpg verification --- .../blockchains/bitcoin-knots/default.nix | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/pkgs/applications/blockchains/bitcoin-knots/default.nix b/pkgs/applications/blockchains/bitcoin-knots/default.nix index 53f57d737d2e..ef8f77e9709d 100644 --- a/pkgs/applications/blockchains/bitcoin-knots/default.nix +++ b/pkgs/applications/blockchains/bitcoin-knots/default.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchurl, + fetchFromGitHub, autoreconfHook, pkg-config, util-linux, @@ -21,6 +22,14 @@ python3, withGui, withWallet ? true, + gnupg, + # Signatures from the following GPG public keys checked during verification of the source code. + # The list can be found at https://github.com/bitcoinknots/guix.sigs/tree/knots/builder-keys + builderKeys ? [ + "1A3E761F19D2CC7785C5502EA291A2C45D0C504A" # luke-jr.gpg + "32FE1E61B1C711186CA378DEFD8981F1BC41ABB9" # oomahq.gpg + "CACC7CBB26B3D2EE8FC2F2BC0E37EBAB8574F005" # leo-haf.gpg + ], }: stdenv.mkDerivation rec { @@ -35,6 +44,7 @@ stdenv.mkDerivation rec { nativeBuildInputs = [ autoreconfHook pkg-config + gnupg ] ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linux ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ hexdump ] @@ -58,6 +68,53 @@ stdenv.mkDerivation rec { qttools ]; + preUnpack = + let + majorVersion = lib.versions.major version; + + publicKeys = fetchFromGitHub { + owner = "bitcoinknots"; + repo = "guix.sigs"; + rev = "b998306d462f39b6077518521700d7156fec76b8"; + sha256 = "sha256-q4tumAfTr828AZNOa9ia7Y0PYoe6W47V/7SEApTzl3w="; + }; + + checksums = fetchurl { + url = "https://bitcoinknots.org/files/${majorVersion}.x/${version}/SHA256SUMS"; + hash = "sha256-xWJKaZBLm9H6AuMBSC21FLy/5TRUI0AQVIUF/2PvDhs="; + }; + + signatures = fetchurl { + url = "https://bitcoinknots.org/files/${majorVersion}.x/${version}/SHA256SUMS.asc"; + hash = "sha256-SywdBEzZqsf2aDeOs7J9n513RTCm+TJA/QYP5+h7Ifo="; + }; + + verifyBuilderKeys = + let + script = publicKey: '' + echo "Checking if public key ${publicKey} signed the checksum file..." + grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null + echo "OK" + ''; + in + builtins.concatStringsSep "\n" (builtins.map script builderKeys); + in + '' + pushd $(mktemp -d) + export GNUPGHOME=$PWD/gnupg + mkdir -m 700 -p $GNUPGHOME + gpg --no-autostart --batch --import ${publicKeys}/builder-keys/* + ln -s ${checksums} ./SHA256SUMS + ln -s ${signatures} ./SHA256SUMS.asc + ln -s $src ./bitcoin-${version}.tar.gz + gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log + ${verifyBuilderKeys} + grep bitcoin-${version}.tar.gz SHA256SUMS > SHA256SUMS.filtered + echo "Verifying the checksum of bitcoin-${version}.tar.gz..." + sha256sum -c SHA256SUMS.filtered + popd + ''; + configureFlags = [ "--with-boost-libdir=${boost.out}/lib" "--disable-bench" From 24a5c97c3deeca31aaa26046283a76ae8608bc3b Mon Sep 17 00:00:00 2001 From: Pavol Rusnak Date: Wed, 13 Aug 2025 21:53:23 +0200 Subject: [PATCH 3/3] bitcoin-knots: use finalAttrs --- .../blockchains/bitcoin-knots/default.nix | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/pkgs/applications/blockchains/bitcoin-knots/default.nix b/pkgs/applications/blockchains/bitcoin-knots/default.nix index ef8f77e9709d..49e97d731593 100644 --- a/pkgs/applications/blockchains/bitcoin-knots/default.nix +++ b/pkgs/applications/blockchains/bitcoin-knots/default.nix @@ -32,12 +32,13 @@ ], }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = if withGui then "bitcoin-knots" else "bitcoind-knots"; version = "28.1.knots20250305"; src = fetchurl { - url = "https://bitcoinknots.org/files/28.x/${version}/bitcoin-${version}.tar.gz"; + url = "https://bitcoinknots.org/files/28.x/${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz"; + # hash retrieved from signed SHA256SUMS hash = "sha256-DKO3+43Tn/BTKQVrLrCkeMtzm8SfbaJD8rPlb6lDA8A="; }; @@ -70,7 +71,7 @@ stdenv.mkDerivation rec { preUnpack = let - majorVersion = lib.versions.major version; + majorVersion = lib.versions.major finalAttrs.version; publicKeys = fetchFromGitHub { owner = "bitcoinknots"; @@ -80,12 +81,12 @@ stdenv.mkDerivation rec { }; checksums = fetchurl { - url = "https://bitcoinknots.org/files/${majorVersion}.x/${version}/SHA256SUMS"; + url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS"; hash = "sha256-xWJKaZBLm9H6AuMBSC21FLy/5TRUI0AQVIUF/2PvDhs="; }; signatures = fetchurl { - url = "https://bitcoinknots.org/files/${majorVersion}.x/${version}/SHA256SUMS.asc"; + url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS.asc"; hash = "sha256-SywdBEzZqsf2aDeOs7J9n513RTCm+TJA/QYP5+h7Ifo="; }; @@ -106,11 +107,11 @@ stdenv.mkDerivation rec { gpg --no-autostart --batch --import ${publicKeys}/builder-keys/* ln -s ${checksums} ./SHA256SUMS ln -s ${signatures} ./SHA256SUMS.asc - ln -s $src ./bitcoin-${version}.tar.gz + ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log ${verifyBuilderKeys} - grep bitcoin-${version}.tar.gz SHA256SUMS > SHA256SUMS.filtered - echo "Verifying the checksum of bitcoin-${version}.tar.gz..." + grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered + echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..." sha256sum -c SHA256SUMS.filtered popd ''; @@ -119,7 +120,7 @@ stdenv.mkDerivation rec { "--with-boost-libdir=${boost.out}/lib" "--disable-bench" ] - ++ lib.optionals (!doCheck) [ + ++ lib.optionals (!finalAttrs.doCheck) [ "--disable-tests" "--disable-gui-tests" ] @@ -147,7 +148,7 @@ stdenv.mkDerivation rec { meta = { description = "Derivative of Bitcoin Core with a collection of improvements"; homepage = "https://bitcoinknots.org/"; - changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${version}/doc/release-notes.md"; + changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${finalAttrs.version}/doc/release-notes.md"; maintainers = with lib.maintainers; [ prusnak mmahut @@ -155,4 +156,4 @@ stdenv.mkDerivation rec { license = lib.licenses.mit; platforms = lib.platforms.unix; }; -} +})