Repository: bitcoin/bitcoin
File: contrib/verify-binaries/verify.py (Python)

Code before:
        hosts, remote_sigs_path, SIGNATUREFILENAME, args.require_all_hosts)
    if got_sig_status != ReturnCode.SUCCESS:
        return got_sig_status

    # Multi-sig verification is available after 22.0.
    if version_tuple[0] < 22:
        log.error("Version too old - single sig not supported. Use a previous "
                  "version of this script from the repo.")
        return ReturnCode.BAD_VERSION

    got_sums_status = get_files_from_hosts_and_compare(
        hosts, remote_sums_path, SUMS_FILENAME, args.require_all_hosts)
    if got_sums_status != ReturnCode.SUCCESS:
        return got_sums_status

    # Verify the signature on the SHA256SUMS file
    sigs_status, good_trusted, good_untrusted, unknown, bad = verify_shasums_signature(SIGNATUREFILENAME, SUMS_FILENAME, args)
    if sigs_status != ReturnCode.SUCCESS:
        if sigs_status == ReturnCode.INTEGRITY_FAILURE:
            cleanup()
        return sigs_status

    # Extract hashes and filenames
    hashes_to_verify = parse_sums_file(SUMS_FILENAME, [os_filter])
    if not hashes_to_verify:
        log.error("no files matched the platform specified. check available versions on bitcoincore.org/bin")
        return ReturnCode.NO_BINARIES_MATCH

    # remove binaries that are known not to be hosted by bitcoincore.org
    fragments_to_remove = ['-unsigned', '-debug', '-codesignatures']
    for fragment in fragments_to_remove:
        nobinaries = [i for i in hashes_to_verify if fragment in i[1]]
        if nobinaries:
            remove_str = ', '.join(i[1] for i in nobinaries)
            log.info(
                f"removing *{fragment} binaries ({remove_str}) from verification "
                f"since {HOST1} does not host *{fragment} binaries")
            hashes_to_verify = [i for i in hashes_to_verify if fragment not in i[1]]

    # download binaries
    for _, binary_filename in hashes_to_verify:
        log.info(f"downloading {binary_filename} to {WORKINGDIR}")
        success, output = download_with_wget(
            HOST1 + remote_dir + binary_filename, binary_filename)

        if not success:
            log.error(
                f"failed to download {binary_filename}\n"
                f"wget output:\n{indent(output)}")
            return ReturnCode.BINARY_DOWNLOAD_FAILED


Review comment (suggestion):
Not sure if we want this to specify bitcoincore.org, `bitcoin.org` does host some binaries too (and recently even added a few which aren't totally out of date!), and we do try both hosts. On the other hand, this advice is actually more useful, accurate and likely to be correct, so 🤷🏼‍♂️ 

Code after:
    if got_sig_status != ReturnCode.SUCCESS:
        return got_sig_status

    # Multi-sig verification is available after 22.0.
    if version_tuple[0] < 22:
        log.error("Version too old - single sig not supported. Use a previous "
                  "version of this script from the repo.")
        return ReturnCode.BAD_VERSION

    got_sums_status = get_files_from_hosts_and_compare(
        hosts, remote_sums_path, SUMS_FILENAME, args.require_all_hosts)
    if got_sums_status != ReturnCode.SUCCESS:
        return got_sums_status

    # Verify the signature on the SHA256SUMS file
    sigs_status, good_trusted, good_untrusted, unknown, bad = verify_shasums_signature(SIGNATUREFILENAME, SUMS_FILENAME, args)
    if sigs_status != ReturnCode.SUCCESS:
        if sigs_status == ReturnCode.INTEGRITY_FAILURE:
            cleanup()
        return sigs_status

    # Extract hashes and filenames
    hashes_to_verify = parse_sums_file(SUMS_FILENAME, [os_filter])
    if not hashes_to_verify:
        available_versions = ["-".join(line[1].split("-")[2:]) for line in parse_sums_file(SUMS_FILENAME, [])]
        closest_match = difflib.get_close_matches(os_filter, available_versions, cutoff=0, n=1)[0]
        log.error(f"No files matched the platform specified. Did you mean: {closest_match}")
        return ReturnCode.NO_BINARIES_MATCH

    # remove binaries that are known not to be hosted by bitcoincore.org
    fragments_to_remove = ['-unsigned', '-debug', '-codesignatures']
    for fragment in fragments_to_remove:
        nobinaries = [i for i in hashes_to_verify if fragment in i[1]]
        if nobinaries:
            remove_str = ', '.join(i[1] for i in nobinaries)
            log.info(
                f"removing *{fragment} binaries ({remove_str}) from verification "
                f"since {HOST1} does not host *{fragment} binaries")
            hashes_to_verify = [i for i in hashes_to_verify if fragment not in i[1]]

    # download binaries
    for _, binary_filename in hashes_to_verify:
        log.info(f"downloading {binary_filename} to {WORKINGDIR}")
        success, output = download_with_wget(
            HOST1 + remote_dir + binary_filename, binary_filename)

        if not success:
            log.error(
                f"failed to download {binary_filename}\n"
                f"wget output:\n{indent(output)}")
            return ReturnCode.BINARY_DOWNLOAD_FAILED