From 9082f4e78d3d948b38d6030564ea82056168165d Mon Sep 17 00:00:00 2001
From: Luke Hoersten <luke@hoersten.org>
Date: Fri, 31 Jul 2026 14:30:30 -0500
Subject: lnd: verify release tarballs against pinned sha256s

lnd sums come from the signed release manifest. lndconnect publishes
no checksums, so its pin is the tarball hash cross-checked against the
binary in production since 2020.
---
 lnd/defaults/main.yaml | 10 ++++++++++
 lnd/tasks/main.yaml    | 26 +++++++++++++++++++++-----
 2 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/lnd/defaults/main.yaml b/lnd/defaults/main.yaml
index 8ad2435..d7fdcbb 100644
--- a/lnd/defaults/main.yaml
+++ b/lnd/defaults/main.yaml
@@ -8,9 +8,19 @@ lnd_tar_name: "lnd-linux-{{lnd_arch}}-v{{lnd_version}}"
 lnd_tar: "{{lnd_tar_name}}.tar.gz"
 lnd_url: "https://github.com/lightningnetwork/lnd/releases/download/v{{lnd_version}}/{{lnd_tar}}"
 lnd_conf_dir: "/home/{{lnd_user}}/.lnd"
+# Release tarball sha256 per arch, pinned from the signed
+# manifest-v<version>.txt on the github release page. Update when bumping
+# lnd_version, and verify the manifest signature while at it.
+lnd_sha256:
+  arm64: "013489343eebe8b0213b5f52fc7570e6f873f3f17974826cb94125ee1287d306"
+  amd64: "e01f755ba18e45a7b20f9fd645a328a250aae241e23b8c1eca06efeb2974570a"
 
 lndconnect_user: "{{node_user}}"
 lndconnect_version: "0.2.0"
 lndconnect_tar_name: "lndconnect-linux-{{lnd_arch}}-v{{lndconnect_version}}"
 lndconnect_tar: "{{lndconnect_tar_name}}.tar.gz"
 lndconnect_url: "https://github.com/LN-Zap/lndconnect/releases/download/v{{lndconnect_version}}/{{lndconnect_tar}}"
+# Upstream publishes no checksums; this is the sha256 of the v0.2.0 arm64
+# tarball, cross-checked against the binary in production since 2020.
+lndconnect_sha256:
+  arm64: "d9abcf75d2e284cde122a6df93bcbff0372c692b994cf02056136d854a7455a5"
diff --git a/lnd/tasks/main.yaml b/lnd/tasks/main.yaml
index 965114b..47853ac 100644
--- a/lnd/tasks/main.yaml
+++ b/lnd/tasks/main.yaml
@@ -4,18 +4,34 @@
   become: yes
   user: name="{{lnd_user}}" shell="/bin/false" system="yes"
 
+# Download and unarchive are split so the tarballs can be verified against
+# the pinned release checksums before anything is extracted or installed.
 - name: download lnd
   become: yes
-  unarchive:
-    remote_src: yes
-    src: "{{item.url}}"
-    dest: "/tmp"
-    creates: "/tmp/{{item.tar_name}}/"
+  get_url:
+    url: "{{item.url}}"
+    dest: "/tmp/{{item.tar_name}}.tar.gz"
+    checksum: "sha256:{{item.sha256}}"
   loop:
     - url: "{{lnd_url}}"
       tar_name: "{{lnd_tar_name}}"
+      sha256: "{{lnd_sha256[lnd_arch]}}"
     - url: "{{lndconnect_url}}"
       tar_name: "{{lndconnect_tar_name}}"
+      sha256: "{{lndconnect_sha256[lnd_arch]}}"
+  loop_control:
+    label: "{{item.tar_name}}"
+
+- name: unarchive lnd
+  become: yes
+  unarchive:
+    remote_src: yes
+    src: "/tmp/{{item}}.tar.gz"
+    dest: "/tmp"
+    creates: "/tmp/{{item}}/"
+  loop:
+    - "{{lnd_tar_name}}"
+    - "{{lndconnect_tar_name}}"
 
 - name: install lnd
   become: yes
-- 
cgit v1.2.3