diff options
| author | Luke Hoersten <[email protected]> | 2026-07-31 14:30:29 -0500 |
|---|---|---|
| committer | Luke Hoersten <[email protected]> | 2026-07-31 14:30:29 -0500 |
| commit | 960d14f9f2af1990dac0ae887c150d8a9ea00dce (patch) | |
| tree | 28bc96d0adc86f457d0009ae9b4562246b391e9b /bitcoind | |
| parent | 81809160f41aed1161070148d8cf60a1ed24a6f3 (diff) | |
bitcoind: verify the release tarball against a pinned sha256
Pinned per arch from the official SHA256SUMS; download and unarchive
are split so nothing extracts unless the tarball matches. Update the
pins when bumping bitcoind_version.
Diffstat (limited to 'bitcoind')
| -rw-r--r-- | bitcoind/defaults/main.yaml | 7 | ||||
| -rw-r--r-- | bitcoind/tasks/main.yaml | 11 |
2 files changed, 17 insertions, 1 deletions
diff --git a/bitcoind/defaults/main.yaml b/bitcoind/defaults/main.yaml index 472a230..779c5d0 100644 --- a/bitcoind/defaults/main.yaml +++ b/bitcoind/defaults/main.yaml @@ -5,6 +5,13 @@ bitcoind_user: "bitcoin" bitcoind_version: "31.0" bitcoind_arch: "{{ansible_facts['architecture']}}" bitcoind_url: "https://bitcoincore.org/bin/bitcoin-core-{{bitcoind_version}}/bitcoin-{{bitcoind_version}}-{{bitcoind_arch}}-linux-gnu.tar.gz" +# Release tarball sha256 per arch, pinned from +# https://bitcoincore.org/bin/bitcoin-core-<version>/SHA256SUMS. Update when +# bumping bitcoind_version, and verify the SHA256SUMS gpg signature per +# https://bitcoincore.org/en/download/ while at it. +bitcoind_sha256: + aarch64: "4de1d568dedd48604f75132421bc0abeca432639589b49a3909c81db3a813112" + x86_64: "d3e4c58a35b1d0a97a457462c94f55501ad167c660c245cb1ffa565641c65074" bitcoind_conf_dir: "/home/{{bitcoind_user}}/.bitcoin" bitcoind_enable_txindex: "0" bitcoind_enable_filterindex: "1" diff --git a/bitcoind/tasks/main.yaml b/bitcoind/tasks/main.yaml index f99256c..7ea5793 100644 --- a/bitcoind/tasks/main.yaml +++ b/bitcoind/tasks/main.yaml @@ -4,11 +4,20 @@ become: yes user: name="{{bitcoind_user}}" shell="/bin/false" system="yes" +# Download and unarchive are split so the tarball can be verified against +# the pinned release checksum before anything is extracted or installed. - name: download bitcoind become: yes + get_url: + url: "{{bitcoind_url}}" + dest: "/tmp/bitcoin-{{bitcoind_version}}-{{bitcoind_arch}}.tar.gz" + checksum: "sha256:{{bitcoind_sha256[bitcoind_arch]}}" + +- name: unarchive bitcoind + become: yes unarchive: remote_src: yes - src: "{{bitcoind_url}}" + src: "/tmp/bitcoin-{{bitcoind_version}}-{{bitcoind_arch}}.tar.gz" dest: "/tmp" creates: "/tmp/bitcoin-{{bitcoind_version}}/" |