diff options
Diffstat (limited to 'bitcoind')
| -rw-r--r-- | bitcoind/defaults/main.yaml | 7 | ||||
| -rw-r--r-- | bitcoind/tasks/main.yaml | 11 |
2 files changed, 17 insertions, 1 deletions
diff --git a/bitcoind/defaults/main.yaml b/bitcoind/defaults/main.yaml index 472a230..779c5d0 100644 --- a/bitcoind/defaults/main.yaml +++ b/bitcoind/defaults/main.yaml @@ -5,6 +5,13 @@ bitcoind_user: "bitcoin" bitcoind_version: "31.0" bitcoind_arch: "{{ansible_facts['architecture']}}" bitcoind_url: "https://bitcoincore.org/bin/bitcoin-core-{{bitcoind_version}}/bitcoin-{{bitcoind_version}}-{{bitcoind_arch}}-linux-gnu.tar.gz" +# Release tarball sha256 per arch, pinned from +# https://bitcoincore.org/bin/bitcoin-core-<version>/SHA256SUMS. Update when +# bumping bitcoind_version, and verify the SHA256SUMS gpg signature per +# https://bitcoincore.org/en/download/ while at it. +bitcoind_sha256: + aarch64: "4de1d568dedd48604f75132421bc0abeca432639589b49a3909c81db3a813112" + x86_64: "d3e4c58a35b1d0a97a457462c94f55501ad167c660c245cb1ffa565641c65074" bitcoind_conf_dir: "/home/{{bitcoind_user}}/.bitcoin" bitcoind_enable_txindex: "0" bitcoind_enable_filterindex: "1" diff --git a/bitcoind/tasks/main.yaml b/bitcoind/tasks/main.yaml index f99256c..7ea5793 100644 --- a/bitcoind/tasks/main.yaml +++ b/bitcoind/tasks/main.yaml @@ -4,11 +4,20 @@ become: yes user: name="{{bitcoind_user}}" shell="/bin/false" system="yes" +# Download and unarchive are split so the tarball can be verified against +# the pinned release checksum before anything is extracted or installed. - name: download bitcoind become: yes + get_url: + url: "{{bitcoind_url}}" + dest: "/tmp/bitcoin-{{bitcoind_version}}-{{bitcoind_arch}}.tar.gz" + checksum: "sha256:{{bitcoind_sha256[bitcoind_arch]}}" + +- name: unarchive bitcoind + become: yes unarchive: remote_src: yes - src: "{{bitcoind_url}}" + src: "/tmp/bitcoin-{{bitcoind_version}}-{{bitcoind_arch}}.tar.gz" dest: "/tmp" creates: "/tmp/bitcoin-{{bitcoind_version}}/" |