Merge pull request #1758 from RafaelTaranto/backport/check-package-hash-blockchain

LAM-601 backport: check package hash blockchain

lib/blockchain/bitcoin.js

@@ -27,6 +27,10 @@ function updateCore (coinRec, isCurrentlyRunning) {
   common.logger.info('Updating Bitcoin Core. This may take a minute...')
   !isDevMode() && common.es(`sudo supervisorctl stop bitcoin`)
   common.es(`curl -#o /tmp/bitcoin.tar.gz ${coinRec.url}`)
+  if (common.es(`sha256sum /tmp/bitcoin.tar.gz | awk '{print $1}'`).trim() !== coinRec.urlHash) {
+    common.logger.info('Failed to update Bitcoin Core: Package signature do not match!')
+    return
+  }
   common.es(`tar -xzf /tmp/bitcoin.tar.gz -C /tmp/`)
 
   common.logger.info('Updating wallet...')

lib/blockchain/bitcoincash.js

@@ -20,6 +20,10 @@ function updateCore (coinRec, isCurrentlyRunning) {
   common.logger.info('Updating Bitcoin Cash. This may take a minute...')
   common.es(`sudo supervisorctl stop bitcoincash`)
   common.es(`curl -#Lo /tmp/bitcoincash.tar.gz ${coinRec.url}`)
+  if (common.es(`sha256sum /tmp/bitcoincash.tar.gz | awk '{print $1}'`).trim() !== coinRec.urlHash) {
+    common.logger.info('Failed to update Bitcoin Cash: Package signature do not match!')
+    return
+  }
   common.es(`tar -xzf /tmp/bitcoincash.tar.gz -C /tmp/`)
 
   common.logger.info('Updating wallet...')

lib/blockchain/common.js

@@ -29,37 +29,47 @@ module.exports = {
 const BINARIES = {
   BTC: {
     defaultUrl: 'https://bitcoincore.org/bin/bitcoin-core-0.20.1/bitcoin-0.20.1-x86_64-linux-gnu.tar.gz',
+    defaultUrlHash: '376194f06596ecfa40331167c39bc70c355f960280bd2a645fdbf18f66527397',
     defaultDir: 'bitcoin-0.20.1/bin',
     url: 'https://bitcoincore.org/bin/bitcoin-core-27.1/bitcoin-27.1-x86_64-linux-gnu.tar.gz',
+    UrlHash: 'c9840607d230d65f6938b81deaec0b98fe9cb14c3a41a5b13b2c05d044a48422',
     dir: 'bitcoin-27.1/bin'
   },
   ETH: {
     url: 'https://gethstore.blob.core.windows.net/builds/geth-linux-amd64-1.14.8-a9523b64.tar.gz',
+    urlHash: 'fff507c90c180443456950e4fc0bf224d26ce5ea6896194ff864c3c3754c136b',
     dir: 'geth-linux-amd64-1.14.8-a9523b64'
   },
   ZEC: {
     url: 'https://github.com/zcash/artifacts/raw/master/v5.9.0/bullseye/zcash-5.9.0-linux64-debian-bullseye.tar.gz',
+    urlHash: 'd385b9fbeeb145f60b0b339d256cabb342713ed3014cd634cf2d68078365abd2',
     dir: 'zcash-5.9.0/bin'
   },
   DASH: {
     defaultUrl: 'https://github.com/dashpay/dash/releases/download/v18.1.0/dashcore-18.1.0-x86_64-linux-gnu.tar.gz',
+    defaultUrlHash: 'd89c2afd78183f3ee815adcccdff02098be0c982633889e7b1e9c9656fbef219',
     defaultDir: 'dashcore-18.1.0/bin',
     url: 'https://github.com/dashpay/dash/releases/download/v21.1.0/dashcore-21.1.0-x86_64-linux-gnu.tar.gz',
+    urlHash: 'a7d0c1b04d53a9b1b3499eb82182c0fa57f4c8768c16163e5d05971bf45d7928',
     dir: 'dashcore-21.1.0/bin'
   },
   LTC: {
     defaultUrl: 'https://download.litecoin.org/litecoin-0.18.1/linux/litecoin-0.18.1-x86_64-linux-gnu.tar.gz',
+    defaultUrlHash: 'ca50936299e2c5a66b954c266dcaaeef9e91b2f5307069b9894048acf3eb5751',
     defaultDir: 'litecoin-0.18.1/bin',
     url: 'https://download.litecoin.org/litecoin-0.21.3/linux/litecoin-0.21.3-x86_64-linux-gnu.tar.gz',
+    urlHash: 'ea231c630e2a243cb01affd4c2b95a2be71560f80b64b9f4bceaa13d736aa7cb',
     dir: 'litecoin-0.21.3/bin'
   },
   BCH: {
     url: 'https://github.com/bitcoin-cash-node/bitcoin-cash-node/releases/download/v27.1.0/bitcoin-cash-node-27.1.0-x86_64-linux-gnu.tar.gz',
+    urlHash: '0dcc387cbaa3a039c97ddc8fb99c1fa7bff5dc6e4bd3a01d3c3095f595ad2dce',
     dir: 'bitcoin-cash-node-27.1.0/bin',
     files: [['bitcoind', 'bitcoincashd'], ['bitcoin-cli', 'bitcoincash-cli']]
   },
   XMR: {
     url: 'https://downloads.getmonero.org/cli/monero-linux-x64-v0.18.3.3.tar.bz2',
+    urlHash: '47c7e6b4b88a57205800a2538065a7874174cd087eedc2526bee1ebcce0cc5e3',
     dir: 'monero-x86_64-linux-gnu-v0.18.3.3',
     files: [['monerod', 'monerod'], ['monero-wallet-rpc', 'monero-wallet-rpc']]
   }
@@ -133,10 +143,15 @@ function fetchAndInstall (coinRec) {
   if (!binaries) throw new Error(`No such coin: ${coinRec.code}`)
 
   const url = requiresUpdate ? binaries.defaultUrl : binaries.url
+  const hash = requiresUpdate ? binaries.defaultUrlHash : binaries.urlHash
   const downloadFile = path.basename(url)
   const binDir = requiresUpdate ? binaries.defaultDir : binaries.dir
 
   es(`wget -q ${url}`)
+  if (es(`sha256sum ${downloadFile} | awk '{print $1}'`).trim() !== hash) {
+    logger.info(`Failed to install ${coinRec.code}: Package signature do not match!`)
+    return
+  }
   es(`tar -xf ${downloadFile}`)
 
   const usrBinDir = isDevMode() ? path.resolve(BLOCKCHAIN_DIR, 'bin') : '/usr/local/bin'

lib/blockchain/dash.js

@@ -20,6 +20,10 @@ function updateCore (coinRec, isCurrentlyRunning) {
   common.logger.info('Updating Dash Core. This may take a minute...')
   common.es(`sudo supervisorctl stop dash`)
   common.es(`curl -#Lo /tmp/dash.tar.gz ${coinRec.url}`)
+  if (common.es(`sha256sum /tmp/dash.tar.gz | awk '{print $1}'`).trim() !== coinRec.urlHash) {
+    common.logger.info('Failed to update Dash Core: Package signature do not match!')
+    return
+  }
   common.es(`tar -xzf /tmp/dash.tar.gz -C /tmp/`)
 
   common.logger.info('Updating wallet...')

lib/blockchain/ethereum.js

@@ -8,6 +8,10 @@ function updateCore (coinRec, isCurrentlyRunning) {
   common.logger.info('Updating the Geth Ethereum wallet. This may take a minute...')
   common.es(`sudo supervisorctl stop ethereum`)
   common.es(`curl -#o /tmp/ethereum.tar.gz ${coinRec.url}`)
+  if (common.es(`sha256sum /tmp/ethereum.tar.gz | awk '{print $1}'`).trim() !== coinRec.urlHash) {
+    common.logger.info('Failed to update Geth: Package signature do not match!')
+    return
+  }
   common.es(`tar -xzf /tmp/ethereum.tar.gz -C /tmp/`)
 
   common.logger.info('Updating wallet...')

lib/blockchain/litecoin.js

@@ -20,6 +20,10 @@ function updateCore (coinRec, isCurrentlyRunning) {
   common.logger.info('Updating Litecoin Core. This may take a minute...')
   common.es(`sudo supervisorctl stop litecoin`)
   common.es(`curl -#o /tmp/litecoin.tar.gz ${coinRec.url}`)
+  if (common.es(`sha256sum /tmp/litecoin.tar.gz | awk '{print $1}'`).trim() !== coinRec.urlHash) {
+    common.logger.info('Failed to update Litecoin Core: Package signature do not match!')
+    return
+  }
   common.es(`tar -xzf /tmp/litecoin.tar.gz -C /tmp/`)
 
   common.logger.info('Updating wallet...')

lib/blockchain/monero.js

@@ -22,6 +22,10 @@ function updateCore (coinRec, isCurrentlyRunning) {
   common.logger.info('Updating Monero. This may take a minute...')
   common.es(`sudo supervisorctl stop monero monero-wallet`)
   common.es(`curl -#o /tmp/monero.tar.gz ${coinRec.url}`)
+  if (common.es(`sha256sum /tmp/monero.tar.gz | awk '{print $1}'`).trim() !== coinRec.urlHash) {
+    common.logger.info('Failed to update Monero: Package signature do not match!')
+    return
+  }
   common.es(`tar -xf /tmp/monero.tar.gz -C /tmp/`)
 
   common.logger.info('Updating wallet...')

lib/blockchain/zcash.js

@@ -13,6 +13,10 @@ function updateCore (coinRec, isCurrentlyRunning) {
   common.logger.info('Updating your Zcash wallet. This may take a minute...')
   common.es(`sudo supervisorctl stop zcash`)
   common.es(`curl -#Lo /tmp/zcash.tar.gz ${coinRec.url}`)
+  if (common.es(`sha256sum /tmp/zcash.tar.gz | awk '{print $1}'`).trim() !== coinRec.urlHash) {
+    common.logger.info('Failed to update Zcash: Package signature do not match!')
+    return
+  }
   common.es(`tar -xzf /tmp/zcash.tar.gz -C /tmp/`)
 
   common.logger.info('Updating wallet...')