From 9082f4e78d3d948b38d6030564ea82056168165d Mon Sep 17 00:00:00 2001 From: Luke Hoersten Date: Fri, 31 Jul 2026 14:30:30 -0500 Subject: lnd: verify release tarballs against pinned sha256s lnd sums come from the signed release manifest. lndconnect publishes no checksums, so its pin is the tarball hash cross-checked against the binary in production since 2020. --- lnd/tasks/main.yaml | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) (limited to 'lnd/tasks') diff --git a/lnd/tasks/main.yaml b/lnd/tasks/main.yaml index 965114b..47853ac 100644 --- a/lnd/tasks/main.yaml +++ b/lnd/tasks/main.yaml @@ -4,18 +4,34 @@ become: yes user: name="{{lnd_user}}" shell="/bin/false" system="yes" +# Download and unarchive are split so the tarballs can be verified against +# the pinned release checksums before anything is extracted or installed. - name: download lnd become: yes - unarchive: - remote_src: yes - src: "{{item.url}}" - dest: "/tmp" - creates: "/tmp/{{item.tar_name}}/" + get_url: + url: "{{item.url}}" + dest: "/tmp/{{item.tar_name}}.tar.gz" + checksum: "sha256:{{item.sha256}}" loop: - url: "{{lnd_url}}" tar_name: "{{lnd_tar_name}}" + sha256: "{{lnd_sha256[lnd_arch]}}" - url: "{{lndconnect_url}}" tar_name: "{{lndconnect_tar_name}}" + sha256: "{{lndconnect_sha256[lnd_arch]}}" + loop_control: + label: "{{item.tar_name}}" + +- name: unarchive lnd + become: yes + unarchive: + remote_src: yes + src: "/tmp/{{item}}.tar.gz" + dest: "/tmp" + creates: "/tmp/{{item}}/" + loop: + - "{{lnd_tar_name}}" + - "{{lndconnect_tar_name}}" - name: install lnd become: yes -- cgit v1.2.3