@cogcoin/bitcoin

@cogcoin/bitcoin@30.2.0 is the canonical npm entrypoint for verified Bitcoin Core 30.2 binaries used by Cogcoin. It ships no executables itself. Instead, it selects the matching platform package, verifies the selected binary by SHA-256, and returns a local executable path for bitcoind or bitcoin-cli.

Use this package as the local source of truth for Bitcoin Core binaries in Cogcoin tooling. Install the parent package, resolve binary paths through the loader, and launch the executable from that verified path.

Links

• Website: cogcoin.org
• Source: github.com/cogcoin
• Package repo: github.com/cogcoin/bitcoin
• Bitcoin Core release: https://bitcoincore.org/bin/bitcoin-core-30.2/
• Bitcoin Core verification guide: https://bitcoincore.org/en/download/#verify-your-download
• Guix attestations: https://github.com/bitcoin-core/guix.sigs/tree/main/30.2

Quick Start

Install the package:

npm install @cogcoin/bitcoin

Then resolve verified binary paths from your application:

import { getBitcoindPath, getBitcoinCliPath } from '@cogcoin/bitcoin';
import { execFile } from 'child_process';

const bitcoind = await getBitcoindPath();
const bitcoinCli = await getBitcoinCliPath();

execFile(bitcoind, ['-datadir=/path/to/data', '-server'], (error) => {
  if (error) {
    throw error;
  }
});

execFile(bitcoinCli, ['getblockchaininfo'], (error, stdout) => {
  if (error) {
    throw error;
  }

  console.log(JSON.parse(stdout));
});

This package contains no binaries itself. npm installs the matching platform package as an optional dependency.

Contents

• index.js: loader that selects a platform package, verifies SHA-256, repairs execute bits, and removes macOS quarantine on a best-effort basis
• manifest.sha256: canonical per-binary hash record for all supported platforms
• LICENSE: wrapper package license text
• platform package optional dependencies: ship the actual bitcoind and bitcoin-cli executables

Trust Model

1. The shipped binaries are extracted unmodified from the official Bitcoin Core 30.2 release archives.
2. The refresh process verifies release archives against signed SHA256SUMS from a pinned trusted signer set before packaging.
3. manifest.sha256 records the exact per-binary hashes committed by this package release.
4. The loader re-verifies the selected binary hash before returning its path.

The package is immutable. The trust model is official Bitcoin Core release provenance plus local loader verification, not the npm registry alone.

Verification

To independently verify:

1. Download SHA256SUMS and SHA256SUMS.asc from the Bitcoin Core 30.2 release page.
2. Import trusted Bitcoin Core signer keys and verify the signatures against them.
3. Download the release archive for your platform.
4. Verify the archive hash against SHA256SUMS.
5. Extract bitcoind and bitcoin-cli from the verified archive.
6. Run shasum -a 256 bitcoind bitcoin-cli.
7. Compare the results to the hashes below and to manifest.sha256 in this package.

Archive hashes

Archive	SHA-256
bitcoin-30.2-aarch64-linux-gnu.tar.gz	73e76c14edc79808a0511c744d102ffbb494807ee90cbcba176568243254b532
bitcoin-30.2-x86_64-linux-gnu.tar.gz	6aa7bb4feb699c4c6262dd23e4004191f6df7f373b5d5978b5bcdd4bb72f75d8
bitcoin-30.2-arm64-apple-darwin.tar.gz	c2ecab62891de22228043815cb6211549a32272be3d5d052ff19847d3420bd10
bitcoin-30.2-x86_64-apple-darwin.tar.gz	99d5cee9b9c37be506396c30837a4b98e320bfea71c474d6120a7e8eb6075c7b
bitcoin-30.2-win64.zip	0d7e1f16f8823aa26d29b44855ff6dbac11c03d75631a6c1d2ea5fab3a84fdf8

Binary hashes

Platform	Binary	SHA-256
linux-arm64	bitcoind	ef420fad3db5e8769acbf7a179d4a4122b558d62939a425d34b07e45f64e6997
linux-arm64	bitcoin-cli	84f49c0d3ddc2b763e9d2fa32e52f6816cc2159f0779bdfb4f6df7f6c3d00ab9
linux-x64	bitcoind	87fc011683f72ce1113add2d2c67085ac7acbba1266a538cccbadb08b6926785
linux-x64	bitcoin-cli	2f4a391973d399d47de0c103ea99ed59355f597f6d32884200c00b40a1b8829c
darwin-arm64	bitcoind	3c40be552d92887107f68d7e534aa553b6f94b0b6bfe8a7cd18bc053988a67c9
darwin-arm64	bitcoin-cli	6c8024645f1f5eeb6f1f93f9f790771c322eb077eed4d5b3ff76e5a7be8bf1c2
darwin-x64	bitcoind	8a872ebf4878d4b26c98fb936c72d1f5dcfe6206cc9e398fbaa3d927f2814ba2
darwin-x64	bitcoin-cli	48ce393e484de2fc43fe39cb32df61957fce46d5865574f8f6b6521dee2f0168
win32-x64	bitcoind.exe	4fddd47cb33560109b826f3d5b8a8332480db7a1c13d91676375cdae20c240b3
win32-x64	bitcoin-cli.exe	45eb95ec60dccb242770bcc19c4a5a1ad3ee9dc53841f5a710b35d127d80e21b

Critical Clarifications

• Installing with --omit=optional makes this package unusable because the platform binaries will not be installed.
• Running a platform package binary directly, such as ./node_modules/@cogcoin/bitcoin-linux-x64/bitcoind, bypasses the loader-side verification step.
• Linux support is glibc-only on linux-x64 and linux-arm64. musl-based distributions such as Alpine Linux are not supported.
• Unsupported platforms throw an error when the loader is called.

License

The wrapper package is distributed under the MIT license.

The binaries are distributed in separate platform packages under Bitcoin Core's MIT license.