Inside Bitcoin

251    """
252    assert len(hosts) > 1
253    primary_host = hosts[0]
254    other_hosts = hosts[1:]
255    got_files = []
256
257    def join_url(host: str) -> str:
258        return host.rstrip('/') + '/' + path.lstrip('/')
259
260    url = join_url(primary_host)
261    success, output = download_with_wget(url, filename)
262    if not success:
263        log.error(
264            f"couldn't fetch file ({url}). "
265            "Have you specified the version number in the following format?\n"
266            f"{VERSION_FORMAT} "
267            f"(example: {VERSION_EXAMPLE})\n"
268            f"wget output:\n{indent(output)}")
269        return ReturnCode.FILE_GET_FAILED
270    else:
271        log.info(f"got file {url} as {filename}")
272        got_files.append(filename)
273
274    for i, host in enumerate(other_hosts):
275        url = join_url(host)
276        fname = filename + f'.{i + 2}'
277        success, output = download_with_wget(url, fname)
278
279        if require_all and not success:
280            log.error(
281                f"{host} failed to provide file ({url}), but {primary_host} did?\n"
282                f"wget output:\n{indent(output)}")
283            return ReturnCode.FILE_MISSING_FROM_ONE_HOST
284        elif not success:
285            log.warning(
286                f"{host} failed to provide file ({url}). "
287                f"Continuing based solely upon {primary_host}.")
288        else:
289            log.info(f"got file {url} as {fname}")
290            got_files.append(fname)
291
292    for i, got_file in enumerate(got_files):
293        if got_file == got_files[-1]:
294            break  # break on last file, nothing after it to compare to
295
296        compare_to = got_files[i + 1]
297        if not files_are_equal(got_file, compare_to):
298            log.error(f"files not equal: {got_file} and {compare_to}")
299            return ReturnCode.FILES_NOT_EQUAL
300
301    return ReturnCode.SUCCESS
302
303
304def check_multisig(sums_file: str, sigfilename: str, args: argparse.Namespace) -> tuple[int, str, list[SigData], list[SigData], list[SigData]]:
305    # check signature
306    #
307    # We don't write output to a file because this command will almost certainly
308    # fail with GPG exit code '2' (and so not writing to --output) because of the
309    # likely presence of multiple untrusted signatures.
310    retval, output = verify_with_gpg(sums_file, sigfilename)
311
312    if args.verbose:
313        log.info(f"gpg output:\n{indent(output)}")
314
315    good, unknown, bad = parse_gpg_result(output.splitlines())
316
317    if unknown and args.import_keys:
318        # Retrieve unknown keys and then try GPG again.
319        for unsig in unknown:
320            if prompt_yn(f" ? Retrieve key {unsig.key} ({unsig.name})? (y/N) "):
321                ran = subprocess.run(
322                    ["gpg", "--keyserver", args.keyserver, "--recv-keys", unsig.key])
323
324                if ran.returncode != 0:
325                    log.warning(f"failed to retrieve key {unsig.key}")
326
327        # Reparse the GPG output now that we have more keys
328        retval, output = verify_with_gpg(sums_file, sigfilename)
329        good, unknown, bad = parse_gpg_result(output.splitlines())
330
331    return retval, output, good, unknown, bad
332
333
334def prompt_yn(prompt) -> bool:
335    """Return true if the user inputs 'y'."""
336    got = ''
337    while got not in ['y', 'n']:
338        got = input(prompt).lower()
339    return got == 'y'
340
341def verify_shasums_signature(
342    signature_file_path: str, sums_file_path: str, args: argparse.Namespace
343) -> tuple[
344   ReturnCode, list[SigData], list[SigData], list[SigData], list[SigData]
345]:
346    min_good_sigs = args.min_good_sigs
347    gpg_allowed_codes = [0, 2]  # 2 is returned when untrusted signatures are present.
348
349    gpg_retval, gpg_output, good, unknown, bad = check_multisig(sums_file_path, signature_file_path, args)
350
351    if gpg_retval not in gpg_allowed_codes:
352        if gpg_retval == 1:
353            log.critical(f"Bad signature (code: {gpg_retval}).")
354        else:
355            log.critical(f"unexpected GPG exit code ({gpg_retval})")
356
357        log.error(f"gpg output:\n{indent(gpg_output)}")
358        return (ReturnCode.INTEGRITY_FAILURE, [], [], [], [])
359
360    # Decide which keys we trust, though not "trust" in the GPG sense, but rather
361    # which pubkeys convince us that this sums file is legitimate. In other words,
362    # which pubkeys within the Bitcoin community do we trust for the purposes of
363    # binary verification?
364    trusted_keys = set()
365    if args.trusted_keys:
366        trusted_keys |= set(args.trusted_keys.split(','))
367
368    # Tally signatures and make sure we have enough goods to fulfill
369    # our threshold.
370    good_trusted = [sig for sig in good if sig.trusted or sig.key in trusted_keys]
371    good_untrusted = [sig for sig in good if sig not in good_trusted]
372    num_trusted = len(good_trusted) + len(good_untrusted)
373    log.info(f"got {num_trusted} good signatures")
374
375    if num_trusted < min_good_sigs:
376        log.info("Maybe you need to import "
377                  f"(`gpg --keyserver {args.keyserver} --recv-keys <key-id>`) "
378                  "some of the following keys: ")
379        log.info('')
380        for sig in unknown:
381            log.info(f"    {sig.key} ({sig.name})")
382        log.info('')
383        log.error(
384            "not enough trusted sigs to meet threshold "
385            f"({num_trusted} vs. {min_good_sigs})")
386
387        return (ReturnCode.NOT_ENOUGH_GOOD_SIGS, [], [], [], [])
388
389    for sig in good_trusted:
390        log.info(f"GOOD SIGNATURE: {sig}")
391
392    for sig in good_untrusted:
393        log.info(f"GOOD SIGNATURE (untrusted): {sig}")
394
395    for sig in [sig for sig in good if sig.status == 'expired']:
396        log.warning(f"key {sig.key} for {sig.name} is expired")
397
398    for sig in bad:
399        log.warning(f"BAD SIGNATURE: {sig}")
400
401    for sig in unknown:
402        log.warning(f"UNKNOWN SIGNATURE: {sig}")
403
404    return (ReturnCode.SUCCESS, good_trusted, good_untrusted, unknown, bad)
405
406
407def parse_sums_file(sums_file_path: str, filename_filter: list[str]) -> list[list[str]]:
408    # extract hashes/filenames of binaries to verify from hash file;
409    # each line has the following format: "<hash> <binary_filename>"
410    with open(sums_file_path, 'r') as hash_file:
411        return [line.split()[:2] for line in hash_file if len(filename_filter) == 0 or any(f in line for f in filename_filter)]
412
413
414def verify_binary_hashes(hashes_to_verify: list[list[str]]) -> tuple[ReturnCode, dict[str, str]]:
415    offending_files = []
416    files_to_hashes = {}
417
418    for hash_expected, binary_filename in hashes_to_verify:
419        with open(binary_filename, 'rb') as binary_file:
420            hash_calculated = sha256(binary_file.read()).hexdigest()
421        if hash_calculated != hash_expected:
422            offending_files.append(binary_filename)
423        else:
424            files_to_hashes[binary_filename] = hash_calculated
425
426    if offending_files:
427        joined_files = '\n'.join(offending_files)
428        log.critical(
429            "Hashes don't match.\n"
430            f"Offending files:\n{joined_files}")
431        return (ReturnCode.INTEGRITY_FAILURE, files_to_hashes)
432
433    return (ReturnCode.SUCCESS, files_to_hashes)
434
435
436def verify_published_handler(args: argparse.Namespace) -> ReturnCode:
437    WORKINGDIR = Path(tempfile.gettempdir()) / f"bitcoin_verify_binaries.{args.version}"
438
439    def cleanup():
440        log.info("cleaning up files")
441        os.chdir(Path.home())
442        shutil.rmtree(WORKINGDIR)
443
444    # determine remote dir dependent on provided version string
445    try:
446        version_base, version_rc, os_filter = parse_version_string(args.version)
447        version_tuple = [int(i) for i in version_base.split('.')]
448    except Exception as e:
449        log.debug(e)
450        log.error(f"unable to parse version; expected format is {VERSION_FORMAT}")
451        log.error(f"  e.g. {VERSION_EXAMPLE}")
452        return ReturnCode.BAD_VERSION
453
454    remote_dir = f"/bin/{VERSIONPREFIX}{version_base}/"
455    if version_rc:
456        remote_dir += f"test.{version_rc}/"
457    remote_sigs_path = remote_dir + SIGNATUREFILENAME
458    remote_sums_path = remote_dir + SUMS_FILENAME
459
460    # create working directory
461    os.makedirs(WORKINGDIR, exist_ok=True)
462    os.chdir(WORKINGDIR)
463
464    hosts = [HOST1, HOST2]
465
466    got_sig_status = get_files_from_hosts_and_compare(
467        hosts, remote_sigs_path, SIGNATUREFILENAME, args.require_all_hosts)
468    if got_sig_status != ReturnCode.SUCCESS:
469        return got_sig_status
470
471    # Multi-sig verification is available after 22.0.
472    if version_tuple[0] < 22:
473        log.error("Version too old - single sig not supported. Use a previous "
474                  "version of this script from the repo.")
475        return ReturnCode.BAD_VERSION
476
477    got_sums_status = get_files_from_hosts_and_compare(
478        hosts, remote_sums_path, SUMS_FILENAME, args.require_all_hosts)
479    if got_sums_status != ReturnCode.SUCCESS:
480        return got_sums_status
481
482    # Verify the signature on the SHA256SUMS file
483    sigs_status, good_trusted, good_untrusted, unknown, bad = verify_shasums_signature(SIGNATUREFILENAME, SUMS_FILENAME, args)
484    if sigs_status != ReturnCode.SUCCESS:
485        if sigs_status == ReturnCode.INTEGRITY_FAILURE:
486            cleanup()
487        return sigs_status
488
489    # Extract hashes and filenames
490    hashes_to_verify = parse_sums_file(SUMS_FILENAME, [os_filter])
491    if not hashes_to_verify:
492        available_versions = ["-".join(line[1].split("-")[2:]) for line in parse_sums_file(SUMS_FILENAME, [])]
493        closest_match = difflib.get_close_matches(os_filter, available_versions, cutoff=0, n=1)[0]
494        log.error(f"No files matched the platform specified. Did you mean: {closest_match}")
495        return ReturnCode.NO_BINARIES_MATCH
496
497    # remove binaries that are known not to be hosted by bitcoincore.org
498    fragments_to_remove = ['-unsigned', '-debug', '-codesignatures']
499    for fragment in fragments_to_remove:
500        nobinaries = [i for i in hashes_to_verify if fragment in i[1]]