From 960d14f9f2af1990dac0ae887c150d8a9ea00dce Mon Sep 17 00:00:00 2001
From: Luke Hoersten <luke@hoersten.org>
Date: Fri, 31 Jul 2026 14:30:29 -0500
Subject: bitcoind: verify the release tarball against a pinned sha256

Pinned per arch from the official SHA256SUMS; download and unarchive
are split so nothing extracts unless the tarball matches. Update the
pins when bumping bitcoind_version.
---
 bitcoind/defaults/main.yaml |  7 +++++++
 bitcoind/tasks/main.yaml    | 11 ++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/bitcoind/defaults/main.yaml b/bitcoind/defaults/main.yaml
index 472a230..779c5d0 100644
--- a/bitcoind/defaults/main.yaml
+++ b/bitcoind/defaults/main.yaml
@@ -5,6 +5,13 @@ bitcoind_user: "bitcoin"
 bitcoind_version: "31.0"
 bitcoind_arch: "{{ansible_facts['architecture']}}"
 bitcoind_url: "https://bitcoincore.org/bin/bitcoin-core-{{bitcoind_version}}/bitcoin-{{bitcoind_version}}-{{bitcoind_arch}}-linux-gnu.tar.gz"
+# Release tarball sha256 per arch, pinned from
+# https://bitcoincore.org/bin/bitcoin-core-<version>/SHA256SUMS. Update when
+# bumping bitcoind_version, and verify the SHA256SUMS gpg signature per
+# https://bitcoincore.org/en/download/ while at it.
+bitcoind_sha256:
+  aarch64: "4de1d568dedd48604f75132421bc0abeca432639589b49a3909c81db3a813112"
+  x86_64: "d3e4c58a35b1d0a97a457462c94f55501ad167c660c245cb1ffa565641c65074"
 bitcoind_conf_dir: "/home/{{bitcoind_user}}/.bitcoin"
 bitcoind_enable_txindex: "0"
 bitcoind_enable_filterindex: "1"
diff --git a/bitcoind/tasks/main.yaml b/bitcoind/tasks/main.yaml
index f99256c..7ea5793 100644
--- a/bitcoind/tasks/main.yaml
+++ b/bitcoind/tasks/main.yaml
@@ -4,11 +4,20 @@
   become: yes
   user: name="{{bitcoind_user}}" shell="/bin/false" system="yes"
 
+# Download and unarchive are split so the tarball can be verified against
+# the pinned release checksum before anything is extracted or installed.
 - name: download bitcoind
+  become: yes
+  get_url:
+    url: "{{bitcoind_url}}"
+    dest: "/tmp/bitcoin-{{bitcoind_version}}-{{bitcoind_arch}}.tar.gz"
+    checksum: "sha256:{{bitcoind_sha256[bitcoind_arch]}}"
+
+- name: unarchive bitcoind
   become: yes
   unarchive:
     remote_src: yes
-    src: "{{bitcoind_url}}"
+    src: "/tmp/bitcoin-{{bitcoind_version}}-{{bitcoind_arch}}.tar.gz"
     dest: "/tmp"
     creates: "/tmp/bitcoin-{{bitcoind_version}}/"
 
-- 
cgit v1.2.3