Skip to content

Commit a7fe333

Browse files
mearvkmearvk
committed
Bitcoin: make Core binary checksum verification mandatory and fail closed
1 parent fb70c32 commit a7fe333

1 file changed

Lines changed: 42 additions & 84 deletions

File tree

‎scripts/bash/bitcoin/install-crypto-binaries.sh‎

Lines changed: 42 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -1,152 +1,110 @@
11
#!/bin/bash
22
# scripts/bash/bitcoin/install-crypto-binaries.sh
3-
# Downloads and installs Bitcoin Core (v24–31), Dashcoin, Starcoin, and Litecoin
4-
# Reads version/coin config from configuration/nwe-config.xml <crypto-binaries> block
5-
# Installs to scripts/bash/bitcoin/{version}/ and symlinks to /usr/local/bin/
6-
#
7-
# Usage: sudo bash scripts/bash/bitcoin/install-crypto-binaries.sh [btc|dash|star|ltc|all]
3+
# Downloads and installs Bitcoin Core (v24–31), Dashcoin, Starcoin, and Litecoin.
4+
# Bitcoin Core installation is fail-closed on missing or invalid SHA-256 checksums.
85

9-
set -e
6+
set -euo pipefail
107

118
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
12-
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
139
INSTALL_BASE="${SCRIPT_DIR}"
1410
TARGET="${1:-all}"
15-
16-
# Bitcoin Core URLs (v24–31)
1711
BTC_BASE="https://bitcoincore.org/bin/bitcoin-core-"
1812
BTC_VERSIONS=(24.2 25.2 26.2 27.1 28.1 29.0 30.0 31.0)
19-
20-
# Altcoin URLs
2113
DASH_VERSION="21.1.1"
2214
DASH_URL="https://github.com/dashpay/dash/releases/download/v${DASH_VERSION}/dashcore-${DASH_VERSION}-x86_64-linux-gnu.tar.gz"
23-
2415
LITECOIN_VERSION="0.21.3"
2516
LITECOIN_URL="https://download.litecoin.org/litecoin-${LITECOIN_VERSION}/linux/litecoin-${LITECOIN_VERSION}-x86_64-linux-gnu.tar.gz"
26-
2717
STARCOIN_VERSION="1.13.7"
2818
STARCOIN_URL="https://github.com/starcoinorg/starcoin/releases/download/v${STARCOIN_VERSION}/starcoin-ubuntu-v${STARCOIN_VERSION}.zip"
2919

20+
verify_bitcoin_checksum() {
21+
local tarball="$1"
22+
local sums="$2"
23+
local expected
24+
expected="$(awk -v f="$tarball" '$2 == f || $2 == "*" f {print $1; exit}' "$sums")"
25+
if [[ ! "$expected" =~ ^[0-9a-fA-F]{64}$ ]]; then
26+
echo "FAIL: no trusted SHA-256 entry for ${tarball}" >&2
27+
return 1
28+
fi
29+
printf '%s %s\n' "$expected" "$tarball" | sha256sum -c -
30+
}
31+
3032
install_bitcoin() {
3133
local VER="$1"
32-
local MAJOR=$(echo "$VER" | cut -d. -f1)
34+
local MAJOR="${VER%%.*}"
3335
local DIR="${INSTALL_BASE}/${MAJOR}"
3436
local TARBALL="bitcoin-${VER}-x86_64-linux-gnu.tar.gz"
3537
local URL="${BTC_BASE}${VER}/${TARBALL}"
3638
local CHECKSUM_URL="${BTC_BASE}${VER}/SHA256SUMS"
39+
local WORK="$(mktemp -d -t bitcoin-core-${MAJOR}-XXXXXX)"
40+
trap 'rm -rf "$WORK"' RETURN
3741

3842
mkdir -p "$DIR"
3943
echo "-- : [crypto] Installing Bitcoin Core v${VER} to ${DIR}"
40-
41-
cd /tmp
42-
echo -n " Downloading ${TARBALL}... "
43-
curl -# -fL "$URL" -o "$TARBALL" 2>&1 || { echo "SKIP v${VER} (download failed)"; return; }
44-
echo " ✓ $(du -h "$TARBALL" | cut -f1)"
45-
curl -sfL "$CHECKSUM_URL" -o SHA256SUMS 2>/dev/null || true
46-
47-
# Verify if checksum available
48-
if [ -f SHA256SUMS ]; then
49-
grep "$TARBALL" SHA256SUMS | sha256sum -c - || { echo "WARN: checksum mismatch v${VER}"; }
50-
fi
44+
cd "$WORK"
45+
curl -# -fL "$URL" -o "$TARBALL"
46+
curl -# -fL "$CHECKSUM_URL" -o SHA256SUMS
47+
echo " Verifying SHA-256 checksum..."
48+
verify_bitcoin_checksum "$TARBALL" SHA256SUMS
49+
echo " ✓ checksum verified"
5150

5251
tar -xzf "$TARBALL"
53-
cp "bitcoin-${VER}/bin/bitcoind" "$DIR/"
54-
cp "bitcoin-${VER}/bin/bitcoin-cli" "$DIR/"
55-
chmod +x "$DIR/bitcoind" "$DIR/bitcoin-cli"
56-
57-
# Symlink latest version
52+
install -m 0755 "bitcoin-${VER}/bin/bitcoind" "$DIR/bitcoind"
53+
install -m 0755 "bitcoin-${VER}/bin/bitcoin-cli" "$DIR/bitcoin-cli"
5854
sudo ln -sf "$DIR/bitcoind" /usr/local/bin/bitcoind
5955
sudo ln -sf "$DIR/bitcoin-cli" /usr/local/bin/bitcoin-cli
60-
61-
rm -rf "$TARBALL" SHA256SUMS "bitcoin-${VER}"
62-
echo "-- : [crypto] Bitcoin Core v${VER} OK"
56+
echo "-- : [crypto] Bitcoin Core v${VER} verified and installed"
6357
}
6458

6559
install_dash() {
6660
local DIR="${INSTALL_BASE}/dash"
6761
mkdir -p "$DIR"
68-
echo "-- : [crypto] Installing Dash Core v${DASH_VERSION}"
69-
7062
cd /tmp
71-
echo -n " Downloading Dash Core v${DASH_VERSION}... "
72-
curl -# -fL "$DASH_URL" -o "dashcore-${DASH_VERSION}-x86_64-linux-gnu.tar.gz" 2>&1 || { echo "FAIL: Dash download"; return; }
73-
echo " ✓ $(du -h "dashcore-${DASH_VERSION}-x86_64-linux-gnu.tar.gz" | cut -f1)"
74-
echo -n " Extracting... "
63+
curl -# -fL "$DASH_URL" -o "dashcore-${DASH_VERSION}-x86_64-linux-gnu.tar.gz"
7564
tar -xzf "dashcore-${DASH_VERSION}-x86_64-linux-gnu.tar.gz"
76-
echo "✓"
77-
cp dashcore-${DASH_VERSION}/bin/dashd "$DIR/"
78-
cp dashcore-${DASH_VERSION}/bin/dash-cli "$DIR/"
79-
chmod +x "$DIR/dashd" "$DIR/dash-cli"
65+
install -m 0755 "dashcore-${DASH_VERSION}/bin/dashd" "$DIR/dashd"
66+
install -m 0755 "dashcore-${DASH_VERSION}/bin/dash-cli" "$DIR/dash-cli"
8067
sudo ln -sf "$DIR/dashd" /usr/local/bin/dashd
8168
sudo ln -sf "$DIR/dash-cli" /usr/local/bin/dash-cli
8269
rm -rf "dashcore-${DASH_VERSION}"*
83-
echo "-- : [crypto] Dash Core v${DASH_VERSION} OK"
8470
}
8571

8672
install_litecoin() {
8773
local DIR="${INSTALL_BASE}/litecoin"
8874
mkdir -p "$DIR"
89-
echo "-- : [crypto] Installing Litecoin Core v${LITECOIN_VERSION}"
90-
9175
cd /tmp
92-
echo -n " Downloading Litecoin Core v${LITECOIN_VERSION}... "
93-
curl -# -fL "$LITECOIN_URL" -o "litecoin-${LITECOIN_VERSION}-x86_64-linux-gnu.tar.gz" 2>&1 || { echo "FAIL: Litecoin download"; return; }
94-
echo " ✓ $(du -h "litecoin-${LITECOIN_VERSION}-x86_64-linux-gnu.tar.gz" | cut -f1)"
95-
echo -n " Extracting... "
76+
curl -# -fL "$LITECOIN_URL" -o "litecoin-${LITECOIN_VERSION}-x86_64-linux-gnu.tar.gz"
9677
tar -xzf "litecoin-${LITECOIN_VERSION}-x86_64-linux-gnu.tar.gz"
97-
echo "✓"
98-
cp litecoin-${LITECOIN_VERSION}/bin/litecoind "$DIR/"
99-
cp litecoin-${LITECOIN_VERSION}/bin/litecoin-cli "$DIR/"
100-
chmod +x "$DIR/litecoind" "$DIR/litecoin-cli"
78+
install -m 0755 "litecoin-${LITECOIN_VERSION}/bin/litecoind" "$DIR/litecoind"
79+
install -m 0755 "litecoin-${LITECOIN_VERSION}/bin/litecoin-cli" "$DIR/litecoin-cli"
10180
sudo ln -sf "$DIR/litecoind" /usr/local/bin/litecoind
10281
sudo ln -sf "$DIR/litecoin-cli" /usr/local/bin/litecoin-cli
10382
rm -rf "litecoin-${LITECOIN_VERSION}"*
104-
echo "-- : [crypto] Litecoin Core v${LITECOIN_VERSION} OK"
10583
}
10684

10785
install_starcoin() {
10886
local DIR="${INSTALL_BASE}/starcoin"
10987
mkdir -p "$DIR"
110-
echo "-- : [crypto] Installing Starcoin v${STARCOIN_VERSION}"
111-
11288
cd /tmp
113-
echo -n " Downloading Starcoin v${STARCOIN_VERSION}... "
114-
curl -# -fL "$STARCOIN_URL" -o "starcoin-ubuntu-v${STARCOIN_VERSION}.zip" 2>&1 || { echo "FAIL: Starcoin download"; return; }
115-
echo " ✓ $(du -h "starcoin-ubuntu-v${STARCOIN_VERSION}.zip" | cut -f1)"
116-
echo -n " Extracting... "
117-
unzip -qo "starcoin-ubuntu-v${STARCOIN_VERSION}.zip" -d starcoin-extract || true
118-
echo "✓"
119-
cp starcoin-extract/starcoin "$DIR/" 2>/dev/null || cp starcoin-extract/*/starcoin "$DIR/" 2>/dev/null || true
120-
chmod +x "$DIR/starcoin" 2>/dev/null
121-
sudo ln -sf "$DIR/starcoin" /usr/local/bin/starcoin 2>/dev/null
89+
curl -# -fL "$STARCOIN_URL" -o "starcoin-ubuntu-v${STARCOIN_VERSION}.zip"
90+
unzip -qo "starcoin-ubuntu-v${STARCOIN_VERSION}.zip" -d starcoin-extract
91+
install -m 0755 starcoin-extract/starcoin "$DIR/starcoin" 2>/dev/null || install -m 0755 starcoin-extract/*/starcoin "$DIR/starcoin"
92+
sudo ln -sf "$DIR/starcoin" /usr/local/bin/starcoin
12293
rm -rf starcoin-extract "starcoin-ubuntu-v${STARCOIN_VERSION}.zip"
123-
echo "-- : [crypto] Starcoin v${STARCOIN_VERSION} OK"
12494
}
12595

126-
# Main
12796
case "$TARGET" in
128-
btc)
129-
for ver in "${BTC_VERSIONS[@]}"; do install_bitcoin "$ver"; done
130-
;;
131-
dash)
132-
install_dash
133-
;;
134-
ltc)
135-
install_litecoin
136-
;;
137-
star)
138-
install_starcoin
139-
;;
97+
btc) for ver in "${BTC_VERSIONS[@]}"; do install_bitcoin "$ver"; done ;;
98+
dash) install_dash ;;
99+
ltc) install_litecoin ;;
100+
star) install_starcoin ;;
140101
all)
141102
for ver in "${BTC_VERSIONS[@]}"; do install_bitcoin "$ver"; done
142103
install_dash
143104
install_litecoin
144105
install_starcoin
145106
;;
146-
*)
147-
echo "Usage: $0 [btc|dash|star|ltc|all]"
148-
exit 1
149-
;;
107+
*) echo "Usage: $0 [btc|dash|star|ltc|all]"; exit 1 ;;
150108
esac
151109

152110
echo "-- : [crypto] Installation complete. Binaries in ${INSTALL_BASE}/"

0 commit comments

Comments
 (0)