From 960d14f9f2af1990dac0ae887c150d8a9ea00dce Mon Sep 17 00:00:00 2001
From: Luke Hoersten <luke@hoersten.org>
Date: Fri, 31 Jul 2026 14:30:29 -0500
Subject: bitcoind: verify the release tarball against a pinned sha256

Pinned per arch from the official SHA256SUMS; download and unarchive
are split so nothing extracts unless the tarball matches. Update the
pins when bumping bitcoind_version.
---
 bitcoind/tasks/main.yaml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

(limited to 'bitcoind/tasks')

diff --git a/bitcoind/tasks/main.yaml b/bitcoind/tasks/main.yaml
index f99256c..7ea5793 100644
--- a/bitcoind/tasks/main.yaml
+++ b/bitcoind/tasks/main.yaml
@@ -4,11 +4,20 @@
   become: yes
   user: name="{{bitcoind_user}}" shell="/bin/false" system="yes"
 
+# Download and unarchive are split so the tarball can be verified against
+# the pinned release checksum before anything is extracted or installed.
 - name: download bitcoind
+  become: yes
+  get_url:
+    url: "{{bitcoind_url}}"
+    dest: "/tmp/bitcoin-{{bitcoind_version}}-{{bitcoind_arch}}.tar.gz"
+    checksum: "sha256:{{bitcoind_sha256[bitcoind_arch]}}"
+
+- name: unarchive bitcoind
   become: yes
   unarchive:
     remote_src: yes
-    src: "{{bitcoind_url}}"
+    src: "/tmp/bitcoin-{{bitcoind_version}}-{{bitcoind_arch}}.tar.gz"
     dest: "/tmp"
     creates: "/tmp/bitcoin-{{bitcoind_version}}/"
 
-- 
cgit v1.2.3