contrib: verify-commits sha1 exceptions
What the developer wrote
Authored by Ava Chow
contrib: verify-commits sha1 exceptions
Allow some commits to not require the sha1 check.
What changed, and why it matters
This commit adds an exception list to Bitcoin Core's commit-verification tool. Normally the tool rejects commits whose verification uses the older SHA-1 algorithm. The change lets one specific commit (aeaa67a9eac0decb89c60a67f9755ca10cbcc1d9) skip that SHA-1 check. It is a maintenance/operational tweak rather than a fix for a runtime vulnerability in Bitcoin itself, but it weakens a security control for that one commit.
Review why the listed commit requires a SHA-1 exception; confirm the commit's contents and signature are trustworthy; consider re-signing or reverting the commit to remove the need for the exception; document the rationale in the commit message or an adjacent README.
Security signals we found
Bypass of a cryptographic-policy check (SHA-1 prohibition) for a specific commit
Addition of an explicit allow-list for weaker hash algorithm in commit verification
No changes to runtime Bitcoin Core code paths
Evidence from the diff
The verify-commits.py script gains a new allow-sha1-commits file. It reads a list of commit hashes and, if the commit being verified is in that list, sets BITCOIN_VERIFY_COMMITS_ALLOW_SHA1=1, bypassing the SHA-1 prohibition. The listed commit is aeaa67a9eac0decb89c60a67f9755ca10cbcc1d9. This is a policy exception in the verification tooling, not a code change to consensus, networking, wallet, or RPC logic.
Changed components
contrib/verify-commits/verify-commits.pycontrib/verify-commits/allow-sha1-commitsInspect captured patch +5 / −0
diff --git a/contrib/verify-commits/allow-sha1-commits b/contrib/verify-commits/allow-sha1-commits
new file mode 100644
index 00000000..95650029
--- /dev/null
+++ b/contrib/verify-commits/allow-sha1-commits
@@ -0,0 +1 @@
+aeaa67a9eac0decb89c60a67f9755ca10cbcc1d9
diff --git a/contrib/verify-commits/verify-commits.py b/contrib/verify-commits/verify-commits.py
index 1af6b031..a0eaf8cd 100755
--- a/contrib/verify-commits/verify-commits.py
+++ b/contrib/verify-commits/verify-commits.py
@@ -94,6 +94,8 @@ def main():
incorrect_sha512_allowed = f.read().splitlines()
with open(dirname + "/trusted-keys", "r") as f:
trusted_keys = f.read().splitlines()
+ with open(dirname + "/allow-sha1-commits", "r") as f:
+ sha1_allowed = f.read().splitlines()
# Set commit and variables
current_commit = args.commit
@@ -136,6 +138,8 @@ def main():
os.environ['BITCOIN_VERIFY_COMMITS_ALLOW_SHA1'] = "0" if no_sha1 else "1"
+ if current_commit in sha1_allowed:
+ os.environ['BITCOIN_VERIFY_COMMITS_ALLOW_SHA1'] = "1"
allow_revsig = current_commit in revsig_allowed
# Check that the commit (and parents) was signed with a trusted key
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.