@cogcoin/bitcoin

@cogcoin/[email protected] is the canonical npm entrypoint for verified Bitcoin Core 30.2 binaries used by Cogcoin. It ships no executables itself. Instead, it selects the matching platform package, verifies the selected binary by SHA-256, and returns a local executable path for bitcoind or bitcoin-cli.

Use this package as the local source of truth for Bitcoin Core binaries in Cogcoin tooling. Install the parent package, resolve binary paths through the loader, and launch the executable from that verified path.

Links

• Website: cogcoin.org
• Source: github.com/cogcoin
• Package repo: github.com/cogcoin/bitcoin
• Bitcoin Core release: https://bitcoincore.org/bin/bitcoin-core-30.2/
• Bitcoin Core verification guide: https://bitcoincore.org/en/download/#verify-your-download
• Guix attestations: https://github.com/bitcoin-core/guix.sigs/tree/main/30.2

Quick Start

Install the package:

npm install @cogcoin/bitcoin

Then resolve verified binary paths from your application:

import { getBitcoindPath, getBitcoinCliPath } from '@cogcoin/bitcoin';
import { execFile } from 'child_process';

const bitcoind = await getBitcoindPath();
const bitcoinCli = await getBitcoinCliPath();

execFile(bitcoind, ['-datadir=/path/to/data', '-server'], (error) => {
  if (error) {
    throw error;
  }
});

execFile(bitcoinCli, ['getblockchaininfo'], (error, stdout) => {
  if (error) {
    throw error;
  }

  console.log(JSON.parse(stdout));
});

This package contains no binaries itself. npm installs the matching platform package as an optional dependency.

Contents

• index.js: loader that selects a platform package, verifies SHA-256, repairs execute bits, and removes macOS quarantine on a best-effort basis
• manifest.sha256: canonical per-binary hash record for all supported platforms
• LICENSE: wrapper package license text
• platform package optional dependencies: ship the actual bitcoind and bitcoin-cli executables

Trust Model

1. The shipped binaries are extracted unmodified from the official Bitcoin Core 30.2 release archives.
2. The refresh process verifies release archives against signed SHA256SUMS from a pinned trusted signer set before packaging.
3. manifest.sha256 records the exact per-binary hashes committed by this package release.
4. The loader re-verifies the selected binary hash before returning its path.

The package is immutable. The trust model is official Bitcoin Core release provenance plus local loader verification, not the npm registry alone.

Verification

To independently verify:

1. Download SHA256SUMS and SHA256SUMS.asc from the Bitcoin Core 30.2 release page.
2. Import trusted Bitcoin Core signer keys and verify the signatures against them.
3. Download the release archive for your platform.
4. Verify the archive hash against SHA256SUMS.
5. Extract bitcoind and bitcoin-cli from the verified archive.
6. Run shasum -a 256 bitcoind bitcoin-cli.
7. Compare the results to the hashes below and to manifest.sha256 in this package.

Archive hashes

| Archive | SHA-256 | | --- | --- | | bitcoin-30.2-aarch64-linux-gnu.tar.gz | 73e76c14edc79808a0511c744d102ffbb494807ee90cbcba176568243254b532 | | bitcoin-30.2-x86_64-linux-gnu.tar.gz | 6aa7bb4feb699c4c6262dd23e4004191f6df7f373b5d5978b5bcdd4bb72f75d8 | | bitcoin-30.2-arm64-apple-darwin.tar.gz | c2ecab62891de22228043815cb6211549a32272be3d5d052ff19847d3420bd10 | | bitcoin-30.2-x86_64-apple-darwin.tar.gz | 99d5cee9b9c37be506396c30837a4b98e320bfea71c474d6120a7e8eb6075c7b | | bitcoin-30.2-win64.zip | 0d7e1f16f8823aa26d29b44855ff6dbac11c03d75631a6c1d2ea5fab3a84fdf8 |

Binary hashes

| Platform | Binary | SHA-256 | | --- | --- | --- | | linux-arm64 | bitcoind | ef420fad3db5e8769acbf7a179d4a4122b558d62939a425d34b07e45f64e6997 | | linux-arm64 | bitcoin-cli | 84f49c0d3ddc2b763e9d2fa32e52f6816cc2159f0779bdfb4f6df7f6c3d00ab9 | | linux-x64 | bitcoind | 87fc011683f72ce1113add2d2c67085ac7acbba1266a538cccbadb08b6926785 | | linux-x64 | bitcoin-cli | 2f4a391973d399d47de0c103ea99ed59355f597f6d32884200c00b40a1b8829c | | darwin-arm64 | bitcoind | 3c40be552d92887107f68d7e534aa553b6f94b0b6bfe8a7cd18bc053988a67c9 | | darwin-arm64 | bitcoin-cli | 6c8024645f1f5eeb6f1f93f9f790771c322eb077eed4d5b3ff76e5a7be8bf1c2 | | darwin-x64 | bitcoind | 8a872ebf4878d4b26c98fb936c72d1f5dcfe6206cc9e398fbaa3d927f2814ba2 | | darwin-x64 | bitcoin-cli | 48ce393e484de2fc43fe39cb32df61957fce46d5865574f8f6b6521dee2f0168 | | win32-x64 | bitcoind.exe | 4fddd47cb33560109b826f3d5b8a8332480db7a1c13d91676375cdae20c240b3 | | win32-x64 | bitcoin-cli.exe | 45eb95ec60dccb242770bcc19c4a5a1ad3ee9dc53841f5a710b35d127d80e21b |

Critical Clarifications

• Installing with --omit=optional makes this package unusable because the platform binaries will not be installed.
• Running a platform package binary directly, such as ./node_modules/@cogcoin/bitcoin-linux-x64/bitcoind, bypasses the loader-side verification step.
• Linux support is glibc-only on linux-x64 and linux-arm64. musl-based distributions such as Alpine Linux are not supported.
• Unsupported platforms throw an error when the loader is called.

License

The wrapper package is distributed under the MIT license.

The binaries are distributed in separate platform packages under Bitcoin Core's MIT license.