From 960d14f9f2af1990dac0ae887c150d8a9ea00dce Mon Sep 17 00:00:00 2001 From: Luke Hoersten Date: Fri, 31 Jul 2026 14:30:29 -0500 Subject: bitcoind: verify the release tarball against a pinned sha256 Pinned per arch from the official SHA256SUMS; download and unarchive are split so nothing extracts unless the tarball matches. Update the pins when bumping bitcoind_version. --- bitcoind/defaults/main.yaml | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'bitcoind/defaults/main.yaml') diff --git a/bitcoind/defaults/main.yaml b/bitcoind/defaults/main.yaml index 472a230..779c5d0 100644 --- a/bitcoind/defaults/main.yaml +++ b/bitcoind/defaults/main.yaml @@ -5,6 +5,13 @@ bitcoind_user: "bitcoin" bitcoind_version: "31.0" bitcoind_arch: "{{ansible_facts['architecture']}}" bitcoind_url: "https://bitcoincore.org/bin/bitcoin-core-{{bitcoind_version}}/bitcoin-{{bitcoind_version}}-{{bitcoind_arch}}-linux-gnu.tar.gz" +# Release tarball sha256 per arch, pinned from +# https://bitcoincore.org/bin/bitcoin-core-/SHA256SUMS. Update when +# bumping bitcoind_version, and verify the SHA256SUMS gpg signature per +# https://bitcoincore.org/en/download/ while at it. +bitcoind_sha256: + aarch64: "4de1d568dedd48604f75132421bc0abeca432639589b49a3909c81db3a813112" + x86_64: "d3e4c58a35b1d0a97a457462c94f55501ad167c660c245cb1ffa565641c65074" bitcoind_conf_dir: "/home/{{bitcoind_user}}/.bitcoin" bitcoind_enable_txindex: "0" bitcoind_enable_filterindex: "1" -- cgit v1.2.3