ci: Download bitcoind 27.1 from GCS
What the developer wrote
Authored by Christian Decker
ci: Download bitcoind 27.1 from GCS
bitcoincore.org was slowing us down massively, and we should be more
respectful of the orgs bandwidth too.
Changelog-None
What changed, and why it matters
This commit changes where the project's automated build system downloads the Bitcoin Core software (bitcoind) for testing. Previously it came from bitcoincore.org; now it comes from a Google Cloud Storage bucket controlled by the project. The stated reason is to reduce load on bitcoincore.org's servers and avoid slow downloads. There is no code vulnerability in the change itself, but it shifts trust to a different download source.
No immediate security action is required. As a defense-in-depth measure, the project should ensure the GCS bucket is access-controlled, monitor its contents for unauthorized changes, and ideally verify Bitcoin Core release signatures or checksums after download in the CI pipeline. Reviewers may want to confirm the bucket is owned by the project and that the downloaded tarball matches the official Bitcoin Core release hash.
Security signals we found
Change of binary download source in CI pipeline
Trust shift from bitcoincore.org to project-controlled GCS bucket
No signature verification step visible in the Dockerfile context shown
No changelog entry (Changelog-None)
Evidence from the diff
The Dockerfile used for CI builds was modified to download the bitcoind tarball from storage.googleapis.com/c-lightning-tests/bitcoind/ instead of https://bitcoincore.org/bin/bitcoin-core-$BITCOIN_VERSION/. The rest of the build steps (extracting and installing binaries) are unchanged. This is an infrastructure/CI change, not a code change affecting Core Lightning’s runtime logic, cryptography, or network protocol handling.
Changed components
contrib/docker/Dockerfile.builder.fedoraInspect captured patch +2 / −1
diff --git a/contrib/docker/Dockerfile.builder.fedora b/contrib/docker/Dockerfile.builder.fedora
index 5bbbff78..617467c6 100644
--- a/contrib/docker/Dockerfile.builder.fedora
+++ b/contrib/docker/Dockerfile.builder.fedora
@@ -23,7 +23,8 @@ RUN dnf update -y && \
cargo && \
dnf clean all
-RUN wget https://bitcoincore.org/bin/bitcoin-core-$BITCOIN_VERSION/bitcoin-$BITCOIN_VERSION-x86_64-linux-gnu.tar.gz -O bitcoin.tar.gz && \
+RUN wget https://storage.googleapis.com/c-lightning-tests/bitcoind/bitcoin-${BITCOIN_VERSION}-x86_64-linux-gnu.tar.gz \
+ -O bitcoin.tar.gz && \
tar -xvzf bitcoin.tar.gz && \
mv bitcoin-$BITCOIN_VERSION/bin/bitcoin* /usr/local/bin/ && \
mv bitcoin-$BITCOIN_VERSION/lib/* /usr/local/lib/ && \
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.