GitHub-generated source archives
Summary
Section titled “Summary”This page separates current GitHub-generated source-archive paths for BitcoinII Core v31.1.0 from the independently fingerprinted historical v29.1.0 source archives.
GitHub-generated source archives are snapshots produced from a Git ref. They are separate from uploaded release binary assets and do not prove that release binaries were built from that source.
Current v31.1.0 source archives
Section titled “Current v31.1.0 source archives”The current v31.1.0 release metadata exposes GitHub-generated tarball and zipball endpoints for the tag.
Stable browser-style archive paths are:
| Type | Archive path |
|---|---|
| GitHub-generated tarball | https://github.com/Bitcoin-II/BitcoinII-Core/archive/refs/tags/v31.1.0.tar.gz |
| GitHub-generated zipball | https://github.com/Bitcoin-II/BitcoinII-Core/archive/refs/tags/v31.1.0.zip |
The release API also reports tag-based tarball/zipball endpoints.
At the time of this review, refs/tags/v31.1.0 resolves directly to commit:
8daaf7b12e71d3646eed787f040bf2899a69dc1c
Because the tag points directly to a commit, it is currently a lightweight tag rather than a separately annotated tag object.
Current v31 fingerprint status
Section titled “Current v31 fingerprint status”MoreBC2 has not yet committed an independent download/size/SHA-256 fingerprint record for the current v31.1.0 GitHub-generated source tarball and zipball.
That is distinct from the current Windows Qt binary-archive result: BitcoinII-v31.1-Win64-Qt.zip was independently hashed during the September 11 runtime test, but that is an uploaded release binary archive, not a GitHub-generated source archive.
See:
Why the tag target should be recorded
Section titled “Why the tag target should be recorded”A generated source archive is based on the ref supplied to GitHub. A verifier who wants a durable audit record should therefore preserve the exact target commit observed at the same time as the archive download.
For the current v31 snapshot, record both:
Tag: v31.1.0Commit: 8daaf7b12e71d3646eed787f040bf2899a69dc1cA human-readable tag name by itself is weaker evidence than a tag plus an exact object/commit target.
Historical v29.1.0 archive links
Section titled “Historical v29.1.0 archive links”The following links were recorded for v29.1.0 during the 2026-08-27 audit:
| Type | Browser URL | Final URL |
|---|---|---|
| GitHub-generated tarball | https://github.com/Bitcoin-II/BitcoinII-Core/archive/refs/tags/v29.1.0.tar.gz |
https://codeload.github.com/Bitcoin-II/BitcoinII-Core/tar.gz/refs/tags/v29.1.0 |
| GitHub-generated zipball | https://github.com/Bitcoin-II/BitcoinII-Core/archive/refs/tags/v29.1.0.zip |
https://codeload.github.com/Bitcoin-II/BitcoinII-Core/zip/refs/tags/v29.1.0 |
These archives are generated by GitHub from the tag and are separate from uploaded release assets.
Historical v29.1.0 count reconciliation
Section titled “Historical v29.1.0 count reconciliation”During the v29.1.0 audit:
- an earlier rendered release-page observation showed 12 items;
- GitHub API metadata reported 10 uploaded release assets;
- two GitHub-generated source archives accounted for the remaining two items.
This was a v29.1.0 release-page accounting result and should not be reused as an assumed asset count for v31.1.0.
The current v31.1.0 uploaded binary inventory is six assets, plus GitHub-generated source archive links that are not release attachments.
Historical v29.1.0 local fingerprints
Section titled “Historical v29.1.0 local fingerprints”MoreBC2 downloaded and independently hashed both v29.1.0 source archives on 2026-08-27:
| Archive | Bytes | Local SHA-256 |
|---|---|---|
BitcoinII-Core-29.1.0-source.tar.gz |
12,233,693 | 3ff391329b90ebfc4851de870e5e621e0347f7ab362c2173f90f4da539000f1f |
BitcoinII-Core-29.1.0-source.zip |
13,745,614 | c64dba331f8a3a4adde2ee1eeac3ae0ac79dbb50f687ce6c4aa57340306c309b |
These values are retrieval fingerprints, not publisher-authenticated expected hashes.
Boundaries
Section titled “Boundaries”GitHub-generated source archives are not, by themselves:
- uploaded release binaries;
- checksum manifests;
- detached signatures;
- signed source artifacts;
- proof that release binaries match source;
- proof that a release tag will never move.
Likewise:
- historical
v29.1.0archive fingerprints do not authenticatev31.1.0source archives or binaries; - a verified target commit does not prove binary reproducibility;
- a local archive hash needs an independently trusted expected value or attestation before it becomes publisher-authentication evidence.
Current follow-up
Section titled “Current follow-up”For v31.1.0, remaining source-archive work is:
- download the current GitHub-generated tarball and zipball;
- record resolved URLs, byte sizes, and SHA-256 fingerprints;
- record the observed tag target commit alongside those fingerprints;
- keep the result separate from uploaded binary-asset verification;
- revisit if BitcoinII publishes project-controlled signed source/build attestations.
Verification
Section titled “Verification”Status: Reviewed / Current plus historical evidence
Primary sources checked: Current v31.1.0 release/tag metadata and the existing 2026-08-27 MoreBC2 release-authentication record
Notes: Current v31 source archive paths and tag target are recorded, but current generated source archives have not yet been independently fingerprinted by MoreBC2.