Is there an existing issue for this?
- I have searched the existing issues
Current behaviour
Hello,
I’m Alex Morgan from Sentinel Core. I have reported a supply-chain/CI-CD integrity issue that affects distributed Bitcoin Core binaries and requires technical coordination.
For context: KuCoin has indicated this falls within Bitcoin Core’s scope, and CERT/CC has opened a coordination case (VU#237485).
Please confirm receipt and provide a secure intake channel (PGP key/fingerprint, ProtonMail, or secure upload endpoint) or a technical contact for coordination. I will not share any runnable PoC publicly — only a sanitized teaser via the confirmed secure channel.
Thanks,
Alex Morgan
Sentinel Core
founder.autoshield@gmail.com
Expected behaviour
The expected behavior is that all build and deployment artifacts within the Bitcoin Core CI/CD pipeline are verified against their original signed source, with no possibility for unsigned or tampered artifacts to pass integrity checks or be distributed.
In other words, any modification or injection attempt within the build or distribution process should be immediately detected and rejected before signing or release.
Steps to reproduce
Hello,
Brief, non-actionable summary to help triage teams decide on next steps:
- Scope: A supply-chain / CI-CD integrity symptom observed affecting distributed Bitcoin Core artifacts (artifact checksum mismatch vs. reproducible build).
- Expected: Distributed artifacts should match the locally-reproducible signed build.
- Observed: The distributed artifact hash differed from the reproducible build hash while signing metadata appeared present (indicates an integrity discrepancy in an intermediate pipeline stage).
To keep this short: I can provide a small, sanitized proof package (redacted log excerpt + SHA256 ownership hash) once you confirm a secure intake channel (PGP fingerprint, ProtonMail, or secure upload endpoint).
Please confirm a secure contact (PGP or endpoint) and a technical point-of-contact. A simple acknowledgement within ** hours** would be appreciated.
Regards,
Alex Morgan
Sentinel Core
founder.autoshield@gmail.com
Relevant log output
No response
How did you obtain Bitcoin Core
Compiled from source
What version of Bitcoin Core are you using?
v27.0.0 (64-bit, official build)
Operating system and version
Ubuntu 22.04 LTS (x86_64)
Machine specifications
No response
