Skip to content

Commit c1e0c2a

Browse files
author
MarcoFalke
committed
Merge #19813: util, ci: Hard code previous release tarball checksums
0374e82 util: Hard code previous release tarball checksums (Hennadii Stepanov) bd897ce scripted-diff: Move previous_release.py to test/get_previous_releases.py (Hennadii Stepanov) Pull request description: #19205 introduced signature verifying for the downloaded `SHA256SUMS.asc`. This approach is brittle and does not work in CI environment for many reasons: - bitcoin/bitcoin#19812 (comment) - bitcoin/bitcoin#19013 (comment) This PR: - implements **Sjors**' [idea](bitcoin/bitcoin#19205 (review)): > Alternatively we might as well hard code the checksum for each `tar.gz` release in the source code, here. - is an alternative to 5a2c31e528e6bd60635096f233252f3c717f366d (#19013) - fixes #19812 - updates v0.17.1 to v0.17.2 ACKs for top commit: MarcoFalke: cr ACK 0374e82 Sjors: tACK 0374e82 Tree-SHA512: cacdcf9f5209eae7da357abb3445585ad2f980920fd5bf75527ce89974d3f531a4cf8b5b35edfc116b23bfdfb45c0437cb14cbc416d76ed2dc5b9e6d33cdad71
2 parents f98872f + 0374e82 commit c1e0c2a

File tree

6 files changed

+41
-30
lines changed

6 files changed

+41
-30
lines changed

‎ci/test/00_setup_env_native_qt5.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,5 @@ export RUN_SECURITY_TESTS="true"
1515
export RUN_UNIT_TESTS_SEQUENTIAL="true"
1616
export RUN_UNIT_TESTS="false"
1717
export GOAL="install"
18-
export PREVIOUS_RELEASES_TO_DOWNLOAD="v0.15.2 v0.16.3 v0.17.1 v0.18.1 v0.19.1"
18+
export PREVIOUS_RELEASES_TO_DOWNLOAD="v0.15.2 v0.16.3 v0.17.2 v0.18.1 v0.19.1"
1919
export BITCOIN_CONFIG="--enable-zmq --with-gui=qt5 --enable-glibc-back-compat --enable-reduce-exports --enable-c++17 --enable-debug CFLAGS=\"-g0 -O2 -funsigned-char\" CXXFLAGS=\"-g0 -O2 -funsigned-char\" --with-boost-process"

‎ci/test/05_before_script.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,6 @@ if [ -z "$NO_DEPENDS" ]; then
4848
fi
4949
if [ -n "$PREVIOUS_RELEASES_TO_DOWNLOAD" ]; then
5050
BEGIN_FOLD previous-versions
51-
DOCKER_EXEC contrib/devtools/previous_release.py -b -t "$PREVIOUS_RELEASES_DIR" "${PREVIOUS_RELEASES_TO_DOWNLOAD}"
51+
DOCKER_EXEC test/get_previous_releases.py -b -t "$PREVIOUS_RELEASES_DIR" "${PREVIOUS_RELEASES_TO_DOWNLOAD}"
5252
END_FOLD
5353
fi

‎test/functional/feature_backwards_compatibility.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
77
Test various backwards compatibility scenarios. Download the previous node binaries:
88
9-
contrib/devtools/previous_release.py -b v0.19.1 v0.18.1 v0.17.1 v0.16.3 v0.15.2
9+
test/get_previous_releases.py -b v0.19.1 v0.18.1 v0.17.1 v0.16.3 v0.15.2
1010
1111
v0.15.2 is not required by this test, but it is used in wallet_upgradewallet.py.
1212
Due to a hardfork in regtest, it can't be used to sync nodes.

‎test/functional/mempool_compatibility.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
In case we need to break mempool compatibility we can continue to use the test by just bumping the version number.
99
1010
Download node binaries:
11-
contrib/devtools/previous_release.py -b v0.19.1 v0.18.1 v0.17.1 v0.16.3 v0.15.2
11+
test/get_previous_releases.py -b v0.19.1 v0.18.1 v0.17.1 v0.16.3 v0.15.2
1212
1313
Only v0.15.2 is required by this test. The rest is used in other backwards compatibility tests.
1414
"""

‎test/functional/wallet_upgradewallet.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
77
Test upgradewallet RPC. Download node binaries:
88
9-
contrib/devtools/previous_release.py -b v0.19.1 v0.18.1 v0.17.1 v0.16.3 v0.15.2
9+
test/get_previous_releases.py -b v0.19.1 v0.18.1 v0.17.1 v0.16.3 v0.15.2
1010
1111
Only v0.15.2 and v0.16.3 are required by this test. The others are used in feature_backwards_compatibility.py
1212
"""

‎contrib/devtools/previous_release.py renamed to ‎test/get_previous_releases.py

Lines changed: 36 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,40 @@
2020
import hashlib
2121

2222

23+
SHA256_SUMS = {
24+
"d40f18b4e43c6e6370ef7db9131f584fbb137276ec2e3dba67a4b267f81cb644": "bitcoin-0.15.2-aarch64-linux-gnu.tar.gz",
25+
"54fb877a148a6ad189a1e1ab1ff8b11181e58ff2aaf430da55b3fd46ae549a6b": "bitcoin-0.15.2-arm-linux-gnueabihf.tar.gz",
26+
"2b843506c3f1af0eeca5854a920264f9a829f02d0d50328005950ddcbe88874d": "bitcoin-0.15.2-i686-pc-linux-gnu.tar.gz",
27+
"87e9340ff3d382d543b2b69112376077f0c8b4f7450d372e83b68f5a1e22b2df": "bitcoin-0.15.2-osx64.tar.gz",
28+
"566be44190fd76daa01f13d428939dadfb8e3daacefc8fa17f433cad28f73bd5": "bitcoin-0.15.2-x86_64-linux-gnu.tar.gz",
29+
30+
"0768c6c15caffbaca6524824c9563b42c24f70633c681c2744649158aa3fd484": "bitcoin-0.16.3-aarch64-linux-gnu.tar.gz",
31+
"fb2818069854a6ad20ea03b28b55dbd35d8b1f7d453e90b83eace5d0098a2a87": "bitcoin-0.16.3-arm-linux-gnueabihf.tar.gz",
32+
"75a537844313b0a84bdb61ffcdc5c4ce19a738f7ddf71007cd2edf664efd7c37": "bitcoin-0.16.3-i686-pc-linux-gnu.tar.gz",
33+
"78c3bff3b619a19aed575961ea43cc9e142959218835cf51aede7f0b764fc25d": "bitcoin-0.16.3-osx64.tar.gz",
34+
"5d422a9d544742bc0df12427383f9c2517433ce7b58cf672b9a9b17c2ef51e4f": "bitcoin-0.16.3-x86_64-linux-gnu.tar.gz",
35+
36+
"5a6b35d1a348a402f2d2d6ab5aed653a1a1f13bc63aaaf51605e3501b0733b7a": "bitcoin-0.17.2-aarch64-linux-gnu.tar.gz",
37+
"d1913a5d19c8e8da4a67d1bd5205d03c8614dfd2e02bba2fe3087476643a729e": "bitcoin-0.17.2-arm-linux-gnueabihf.tar.gz",
38+
"d295fc93f39bbf0fd937b730a93184899a2eb6c3a6d53f3d857cbe77ef89b98c": "bitcoin-0.17.2-i686-pc-linux-gnu.tar.gz",
39+
"a783ba20706dbfd5b47fbedf42165fce70fbbc7d78003305d964f6b3da14887f": "bitcoin-0.17.2-osx64.tar.gz",
40+
"943f9362b9f11130177839116f48f809d83478b4c28591d486ee9a7e35179da6": "bitcoin-0.17.2-x86_64-linux-gnu.tar.gz",
41+
42+
"88f343af72803b851c7da13874cc5525026b0b55e63e1b5e1298390c4688adc6": "bitcoin-0.18.1-aarch64-linux-gnu.tar.gz",
43+
"cc7d483e4b20c5dabd4dcaf304965214cf4934bcc029ca99cbc9af00d3771a1f": "bitcoin-0.18.1-arm-linux-gnueabihf.tar.gz",
44+
"989e847b3e95fc9fedc0b109cae1b4fa43348f2f712e187a118461876af9bd16": "bitcoin-0.18.1-i686-pc-linux-gnu.tar.gz",
45+
"b7bbcee7a7540f711b171d6981f939ca8482005fde22689bc016596d80548bb1": "bitcoin-0.18.1-osx64.tar.gz",
46+
"425ee5ec631ae8da71ebc1c3f5c0269c627cf459379b9b030f047107a28e3ef8": "bitcoin-0.18.1-riscv64-linux-gnu.tar.gz",
47+
"600d1db5e751fa85903e935a01a74f5cc57e1e7473c15fd3e17ed21e202cfe5a": "bitcoin-0.18.1-x86_64-linux-gnu.tar.gz",
48+
49+
"3a80431717842672df682bdb619e66523b59541483297772a7969413be3502ff": "bitcoin-0.19.1-aarch64-linux-gnu.tar.gz",
50+
"657f28213823d240dd3324d14829702f9ad6f0710f8bdd1c379cb3c447197f48": "bitcoin-0.19.1-arm-linux-gnueabihf.tar.gz",
51+
"10d1e53208aa7603022f4acc084a046299ab4ccf25fe01e81b3fb6f856772589": "bitcoin-0.19.1-i686-pc-linux-gnu.tar.gz",
52+
"1ae1b87de26487075cd2fd22e0d4ead87d969bd55c44f2f1d873ecdc6147ebb3": "bitcoin-0.19.1-osx64.tar.gz",
53+
"aa7a9563b48aa79252c8e7b6a41c07a5441bd9f14c5e4562cc72720ea6cb0ee5": "bitcoin-0.19.1-riscv64-linux-gnu.tar.gz",
54+
"5fcac9416e486d4960e1a946145566350ca670f9aaba99de6542080851122e4c": "bitcoin-0.19.1-x86_64-linux-gnu.tar.gz"
55+
}
56+
2357
@contextlib.contextmanager
2458
def pushd(new_dir) -> None:
2559
previous_dir = os.getcwd()
@@ -44,14 +78,10 @@ def download_binary(tag, args) -> int:
4478
match.group(1), match.group(2))
4579
tarball = 'bitcoin-{tag}-{platform}.tar.gz'.format(
4680
tag=tag[1:], platform=args.platform)
47-
sha256Sums = "SHA256SUMS-{tag}.asc".format(tag=tag[1:])
4881
tarballUrl = 'https://bitcoincore.org/{bin_path}/{tarball}'.format(
4982
bin_path=bin_path, tarball=tarball)
50-
sha256SumsUrl = 'https://bitcoincore.org/{bin_path}/SHA256SUMS.asc'.format(
51-
bin_path=bin_path)
5283

5384
print('Fetching: {tarballUrl}'.format(tarballUrl=tarballUrl))
54-
print('Fetching: {sha256SumsUrl}'.format(sha256SumsUrl=sha256SumsUrl))
5585

5686
header, status = subprocess.Popen(
5787
['curl', '--head', tarballUrl], stdout=subprocess.PIPE).communicate()
@@ -60,8 +90,7 @@ def download_binary(tag, args) -> int:
6090
return 1
6191

6292
curlCmds = [
63-
['curl', '--remote-name', tarballUrl],
64-
['curl', '--output', sha256Sums, sha256SumsUrl],
93+
['curl', '--remote-name', tarballUrl]
6594
]
6695

6796
for cmd in curlCmds:
@@ -73,29 +102,12 @@ def download_binary(tag, args) -> int:
73102
with open(tarball, "rb") as afile:
74103
hasher.update(afile.read())
75104
tarballHash = hasher.hexdigest()
76-
tarballHash = '{} {}\n'.format(tarballHash, tarball)
77-
with open(sha256Sums, 'r', encoding="utf-8") as afile:
78-
shasums = afile.readlines()
79105

80-
if tarballHash not in shasums:
106+
if tarballHash not in SHA256_SUMS or SHA256_SUMS[tarballHash] != tarball:
81107
print("Checksum did not match")
82-
Path(tarball).unlink()
83108
return 1
84109
print("Checksum matched")
85110

86-
# Bitcoin Core Release Signing Keys v0.11.0+
87-
signingKey = "01EA5486DE18A882D4C2684590C8019E36C2E964"
88-
89-
isKeyPresent = subprocess.run(
90-
["gpg", "--list-keys", signingKey]).returncode
91-
if isKeyPresent:
92-
return isKeyPresent
93-
94-
isVerified = subprocess.run(
95-
["gpg", "--verify", sha256Sums]).returncode
96-
if isVerified:
97-
return isVerified
98-
99111
# Extract tarball
100112
ret = subprocess.run(['tar', '-zxf', tarball, '-C', tag,
101113
'--strip-components=1',
@@ -104,7 +116,6 @@ def download_binary(tag, args) -> int:
104116
return ret
105117

106118
Path(tarball).unlink()
107-
Path(sha256Sums).unlink()
108119
return 0
109120

110121

0 commit comments

Comments
 (0)