Inside Bitcoin

501        if nobinaries:
502            remove_str = ', '.join(i[1] for i in nobinaries)
503            log.info(
504                f"removing *{fragment} binaries ({remove_str}) from verification "
505                f"since {HOST1} does not host *{fragment} binaries")
506            hashes_to_verify = [i for i in hashes_to_verify if fragment not in i[1]]
507
508    # download binaries
509    for _, binary_filename in hashes_to_verify:
510        log.info(f"downloading {binary_filename} to {WORKINGDIR}")
511        success, output = download_with_wget(
512            HOST1 + remote_dir + binary_filename, binary_filename)
513
514        if not success:
515            log.error(
516                f"failed to download {binary_filename}\n"
517                f"wget output:\n{indent(output)}")
518            return ReturnCode.BINARY_DOWNLOAD_FAILED
519
520    # verify hashes
521    hashes_status, files_to_hashes = verify_binary_hashes(hashes_to_verify)
522    if hashes_status != ReturnCode.SUCCESS:
523        return hashes_status
524
525
526    if args.cleanup:
527        cleanup()
528    else:
529        log.info(f"did not clean up {WORKINGDIR}")
530
531    if args.json:
532        output = {
533            'good_trusted_sigs': [str(s) for s in good_trusted],
534            'good_untrusted_sigs': [str(s) for s in good_untrusted],
535            'unknown_sigs': [str(s) for s in unknown],
536            'bad_sigs': [str(s) for s in bad],
537            'verified_binaries': files_to_hashes,
538        }
539        print(json.dumps(output, indent=2))
540    else:
541        for filename in files_to_hashes:
542            print(f"VERIFIED: {filename}")
543
544    return ReturnCode.SUCCESS
545
546
547def verify_binaries_handler(args: argparse.Namespace) -> ReturnCode:
548    binary_to_basename = {}
549    for file in args.binary:
550        binary_to_basename[PurePath(file).name] = file
551
552    sums_sig_path = None
553    if args.sums_sig_file:
554        sums_sig_path = Path(args.sums_sig_file)
555    else:
556        log.info(f"No signature file specified, assuming it is {args.sums_file}.asc")
557        sums_sig_path = Path(args.sums_file).with_suffix(".asc")
558
559    # Verify the signature on the SHA256SUMS file
560    sigs_status, good_trusted, good_untrusted, unknown, bad = verify_shasums_signature(str(sums_sig_path), args.sums_file, args)
561    if sigs_status != ReturnCode.SUCCESS:
562        return sigs_status
563
564    # Extract hashes and filenames
565    hashes_to_verify = parse_sums_file(args.sums_file, [k for k, n in binary_to_basename.items()])
566    if not hashes_to_verify:
567        log.error(f"No files in {args.sums_file} match the specified binaries")
568        return ReturnCode.NO_BINARIES_MATCH
569
570    # Make sure all files are accounted for
571    sums_file_path = Path(args.sums_file)
572    missing_files = []
573    files_to_hash = []
574    if len(binary_to_basename) > 0:
575        for file_hash, file in hashes_to_verify:
576            files_to_hash.append([file_hash, binary_to_basename[file]])
577            del binary_to_basename[file]
578        if len(binary_to_basename) > 0:
579            log.error(f"Not all specified binaries are in {args.sums_file}")
580            return ReturnCode.NO_BINARIES_MATCH
581    else:
582        log.info(f"No binaries specified, assuming all files specified in {args.sums_file} are located relatively")
583        for file_hash, file in hashes_to_verify:
584            file_path = Path(sums_file_path.parent.joinpath(file))
585            if file_path.exists():
586                files_to_hash.append([file_hash, str(file_path)])
587            else:
588                missing_files.append(file)
589
590    # verify hashes
591    hashes_status, files_to_hashes = verify_binary_hashes(files_to_hash)
592    if hashes_status != ReturnCode.SUCCESS:
593        return hashes_status
594
595    if args.json:
596        output = {
597            'good_trusted_sigs': [str(s) for s in good_trusted],
598            'good_untrusted_sigs': [str(s) for s in good_untrusted],
599            'unknown_sigs': [str(s) for s in unknown],
600            'bad_sigs': [str(s) for s in bad],
601            'verified_binaries': files_to_hashes,
602            "missing_binaries": missing_files,
603        }
604        print(json.dumps(output, indent=2))
605    else:
606        for filename in files_to_hashes:
607            print(f"VERIFIED: {filename}")
608        for filename in missing_files:
609            print(f"MISSING: {filename}")
610
611    return ReturnCode.SUCCESS
612
613
614def main():
615    parser = argparse.ArgumentParser(description=__doc__)
616    parser.add_argument(
617        '-v', '--verbose', action='store_true',
618        default=bool_from_env('BINVERIFY_VERBOSE'),
619    )
620    parser.add_argument(
621        '-q', '--quiet', action='store_true',
622        default=bool_from_env('BINVERIFY_QUIET'),
623    )
624    parser.add_argument(
625        '--import-keys', action='store_true',
626        default=bool_from_env('BINVERIFY_IMPORTKEYS'),
627        help='if specified, ask to import each unknown builder key'
628    )
629    parser.add_argument(
630        '--min-good-sigs', type=int, action='store', nargs='?',
631        default=int(os.environ.get('BINVERIFY_MIN_GOOD_SIGS', 3)),
632        help=(
633            'The minimum number of good signatures to require successful termination.'),
634    )
635    parser.add_argument(
636        '--keyserver', action='store', nargs='?',
637        default=os.environ.get('BINVERIFY_KEYSERVER', 'hkps://keys.openpgp.org'),
638        help='which keyserver to use',
639    )
640    parser.add_argument(
641        '--trusted-keys', action='store', nargs='?',
642        default=os.environ.get('BINVERIFY_TRUSTED_KEYS', ''),
643        help='A list of trusted signer GPG keys, separated by commas. Not "trusted keys" in the GPG sense.',
644    )
645    parser.add_argument(
646        '--json', action='store_true',
647        default=bool_from_env('BINVERIFY_JSON'),
648        help='If set, output the result as JSON',
649    )
650
651    subparsers = parser.add_subparsers(title="Commands", required=True, dest="command")
652
653    pub_parser = subparsers.add_parser("pub", help="Verify a published release.")
654    pub_parser.set_defaults(func=verify_published_handler)
655    pub_parser.add_argument(
656        'version', type=str, help=(
657            f'version of the bitcoin release to download; of the format '
658            f'{VERSION_FORMAT}. Example: {VERSION_EXAMPLE}')
659    )
660    pub_parser.add_argument(
661        '--cleanup', action='store_true',
662        default=bool_from_env('BINVERIFY_CLEANUP'),
663        help='if specified, clean up files afterwards'
664    )
665    pub_parser.add_argument(
666        '--require-all-hosts', action='store_true',
667        default=bool_from_env('BINVERIFY_REQUIRE_ALL_HOSTS'),
668        help=(
669            f'If set, require all hosts ({HOST1}, {HOST2}) to provide signatures. '
670            '(Sometimes bitcoin.org lags behind bitcoincore.org.)')
671    )
672
673    bin_parser = subparsers.add_parser("bin", help="Verify local binaries.")
674    bin_parser.set_defaults(func=verify_binaries_handler)
675    bin_parser.add_argument("--sums-sig-file", "-s", help="Path to the SHA256SUMS.asc file to verify")
676    bin_parser.add_argument("sums_file", help="Path to the SHA256SUMS file to verify")
677    bin_parser.add_argument(
678        "binary", nargs="*",
679        help="Path to a binary distribution file to verify. Can be specified multiple times for multiple files to verify."
680    )
681
682    args = parser.parse_args()
683    if args.quiet:
684        log.setLevel(logging.WARNING)
685
686    return args.func(args)
687
688
689if __name__ == '__main__':
690    sys.exit(main())
691