From b7b349d169298566b026058ae4ef5be08b58e175 Mon Sep 17 00:00:00 2001 From: Chris Guida Date: Fri, 9 Oct 2026 14:03:01 -0600 Subject: [PATCH] Verify the fast start's build by builder signature, not by sha256 alone The 29.4.2 + PR #444 build behind the fast start now has a Guix attestation signed with a pinned 29.4.2 release-builder key (chrisguida), published on https://github.com/chrisguida/guix.sigs/tree/assumeutxo976000, and the release carries SHA256SUMS and SHA256SUMS.asc next to the archive, which is where sig_fetch looks. So the fast row moves from pin to builders: the installer now requires a valid pinned-builder signature on SHA256SUMS that lists the archive, and still checks the pinned sha256. The archive, its sha256 and the snapshot are unchanged, so installed nodes are unaffected. The mode's label, trust notice and README say what is signed and by whom; further builder signatures are appended to the release's SHA256SUMS.asc. --- CHANGELOG.md | 8 ++++++++ README.md | 6 +++--- install.sh | 4 ++-- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0706156..b16527c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## unreleased + +- The fast start's Bitcoin Knots build (29.4.2 + PR #444, snapshot 976000) is now verified like the official release: + `SHA256SUMS` and `SHA256SUMS.asc` are published next to its archive and must carry a valid signature from a pinned + release builder key (chrisguida's, one of the seven 29.4.2 builders, so far; the attestations live on + https://github.com/chrisguida/guix.sigs/tree/assumeutxo976000 and more are being solicited). The sha256 pin stays as + the second check. The mode's label and trust notice say so; nothing else changes. + ## 2026-10-09.1 - Flush the complete plan before asking for confirmation; print each console step once without redrawing the login prompt. Linux console output is English only; SSH retains Chinese. diff --git a/README.md b/README.md index f325f18..fffba6e 100644 --- a/README.md +++ b/README.md @@ -22,11 +22,11 @@ Bitcoin node and the gateway your rigs connect to. Contabo writes "we fully supp ### Default fast start (2026-10-09.1) -New nodes use Chris Guida's Bitcoin Knots 29.4.2 + PR444 build and snapshot **976000**, pinned by the archive and snapshot SHA256 values in this installer. The total start is **about half an hour**, depending on download speed and the blocks left to validate; status reports measured progress and time left. +New nodes use Chris Guida's Bitcoin Knots 29.4.2 + PR444 build and snapshot **976000**: the build is verified by the release-builder signatures on its `SHA256SUMS` (published next to the archive) plus the archive sha256 pinned here, and the snapshot by its pinned sha256 and then by Bitcoin Knots itself. The total start is **about half an hour**, depending on download speed and the blocks left to validate; status reports measured progress and time left. -This developer build is pinned by its sha256 and is not signed by the release builders; when the signed release includes this snapshot, the upgrade command moves your node to that release. +The build is the official 29.4.2 source plus the one chainparams commit of PR #444, reproduced with Guix and attested on https://github.com/chrisguida/guix.sigs/tree/assumeutxo976000 (one of the seven 29.4.2 release builders so far; more attestations are being solicited). When a signed Bitcoin Knots release includes this snapshot, the upgrade command moves your node to that release. -这个开发者构建版按 sha256 固定，发布构建者没有为它签名；当签名发布版包含同一快照后，升级命令会将您的节点升级到该版本。 +该构建版是官方 29.4.2 源码加上 PR #444 的一个 chainparams 提交，用 Guix 复现并在 https://github.com/chrisguida/guix.sigs/tree/assumeutxo976000 上签署（目前为 29.4.2 的七位发布构建者之一，正在征集更多签名）；当签名发布版包含同一快照后，升级命令会将您的节点升级到该版本。 Use `--start official` for the builder-signed release and its 910000 snapshot (one to two days). Existing .6 nodes keep their mode and chain state on upgrade and continue catching up; changing the default does not load a new snapshot over existing data. There is no torrent download or seeding in this version. The detailed 910000 timings below describe the official option. diff --git a/install.sh b/install.sh index 3a73a5a..9f7b2b1 100644 --- a/install.sh +++ b/install.sh @@ -11,7 +11,7 @@ # hash compiled into it, then validates every block since then by itself (README "How the node gets its chain") # * a firewall that keeps your SSH port open, lets rigs and Bitcoin peers in and keeps everything else closed # Every download is pinned below (https URL + sha256) and checked BEFORE it is used. Bitcoin Knots is also checked -# against its release builders' signatures for the official mode; the fast developer build is sha256-pinned only. +# against its release builders' signatures (both modes: the fast build's SHA256SUMS.asc is published next to its archive). # # AlphaPool gets NO access to this server: no SSH keys, no allowlists, no remote commands, no update channel. # Your SSH setup is not touched. The optional status heartbeat (only with --node-id and --token) reports sync and @@ -59,7 +59,7 @@ START_DEFAULT="fast" START_LEGACY="official" start_modes(){ cat <<'MODES' official|29.4.2.knots20260508|https://bitcoinknots.org/files/29.x/29.4.2.knots20260508/bitcoin-29.4.2.knots20260508-x86_64-linux-gnu.tar.gz|b59d0445a317e21a03dc29425db3aba79b27d5125230b1a2b1dce62e120827c5|builders|840000 880000 910000|910000|one to two days|the official Bitcoin Knots release|You trust the Bitcoin Knots release builders: the installer checks their signatures on this release, and Bitcoin Knots checks the snapshot against the hash that is part of that release. -fast|29.4.2.knots20260508|https://github.com/chrisguida/bitcoin/releases/download/v29.4.2.knots20260508-assumeutxo976000/bitcoin-6ce57028d6cf-x86_64-linux-gnu.tar.gz|5c26890d72daa499fe22b905de5cfb0a78e2445aedbde0726278f57672106a9d|pin|840000 880000 910000 976000|976000|about half an hour|a developer build of Bitcoin Knots with the 976000 snapshot|This developer build is pinned by its sha256 and is not signed by the release builders; when the signed release includes this snapshot, the upgrade command moves your node to that release.|这个开发者构建版按 sha256 固定，发布构建者没有为它签名；当签名发布版包含同一快照后，升级命令会将您的节点升级到该版本。 +fast|29.4.2.knots20260508|https://github.com/chrisguida/bitcoin/releases/download/v29.4.2.knots20260508-assumeutxo976000/bitcoin-6ce57028d6cf-x86_64-linux-gnu.tar.gz|5c26890d72daa499fe22b905de5cfb0a78e2445aedbde0726278f57672106a9d|builders|840000 880000 910000 976000|976000|about half an hour|Bitcoin Knots 29.4.2 plus the 976000 snapshot entry (PR #444), signed by a release builder|You trust the Bitcoin Knots release builders who have signed this build: it is the official 29.4.2 source plus the one chainparams commit of PR #444, reproduced with Guix and attested on https://github.com/chrisguida/guix.sigs/tree/assumeutxo976000 (one builder so far, more requested); the installer checks those signatures against the pinned builder keys, and when a signed release includes this snapshot the upgrade command moves your node to that release.|您信任为这个构建版签名的 Bitcoin Knots 发布构建者：它是官方 29.4.2 源码加上 PR #444 的一个 chainparams 提交，用 Guix 复现并在 https://github.com/chrisguida/guix.sigs/tree/assumeutxo976000 上签署（目前一位构建者，正在征集更多）；安装程序用固定的构建者密钥检查这些签名；当签名发布版包含同一快照后，升级命令会将您的节点升级到该版本。 MODES } # utxo_table: the snapshot files, one line each: