Skip to content
MoreBC2

BitcoinII Core v31.1.0 release assets

CategoryReleasesStatusReviewed / Current bounded evidenceLast reviewed2026-09-12

Summary

Section titled “Summary”

This page records the current GitHub release inventory and bounded local-integrity evidence for BitcoinII Core v31.1.0.

The release currently contains six uploaded binary archives. GitHub reports a SHA-256 digest for each uploaded asset. MoreBC2 has independently calculated and matched the SHA-256 of the Windows Qt archive used in the September 11 Windows runtime test.

That is stronger than hosting metadata alone for that one retrieved archive, but it is still not publisher authentication. MoreBC2 has not established a BitcoinII-signed checksum manifest, detached asset signatures, a trusted BitcoinII release-signing-key procedure, or reproducible-build proof for v31.1.0.

Release metadata

Section titled “Release metadata”
Field Current observed value
Repository Bitcoin-II/BitcoinII-Core
Release title BitcoinII v31.1.0
Tag v31.1.0
Published 2026-08-29T02:39:30Z
Release updated 2026-09-06T16:31:26Z
GitHub immutable flag false
Uploaded asset count 6

Canonical release page:

https://github.com/Bitcoin-II/BitcoinII-Core/releases/tag/v31.1.0

The release was updated after first publication. The two macOS archives were uploaded on 2026-09-06, while the Linux and Windows archives were uploaded on 2026-08-29. For that reason, any release inventory should be treated as a dated snapshot rather than assuming the original publication-time asset set is permanent.

Uploaded assets observed

Section titled “Uploaded assets observed”
Asset Size bytes GitHub-reported SHA-256 digest MoreBC2 local hash status
BitcoinII-Core-v31.1-arm64.zip 17,118,150 e41f5dc4fc16277883aa12b9f92dc2043cb38fc355eed01da619ba5f7bf43acc Not independently hashed in a current MoreBC2 record
BitcoinII-Core-v31.1-x86_64-apple.zip 18,248,715 ec44c2472c3501b2f853393a797cf5a8bdfa2292f375630c772723218ce3b7a8 Not independently hashed in a current MoreBC2 record
BitcoinII-v31.1-Linux-CLI.tar.gz 8,839,080 78a88df783c2e15d09ea73c05065f7477cad34086b6e995991f7adeae781603f Not independently hashed in a current MoreBC2 record
BitcoinII-v31.1-Linux-Qt.tar.gz 20,629,261 745f6fc1cf7132357ca1ee09ea9c02873aac98cae92a6067ee3a26e8e5fd09ac Not independently hashed in a current MoreBC2 record
BitcoinII-v31.1-Win64-CLI.zip 9,116,723 74e052791cbd5183b1876693e5d99f474fb4165b795ba45d8f3c966bd5a7d687 Not independently hashed in a current MoreBC2 record
BitcoinII-v31.1-Win64-Qt.zip 20,557,870 f7b1d16423859bd2392b1bd4f62c16ba855a034c6ffb6693af667f2ec97b375d Matched locally on 2026-09-11

The Windows Qt archive was independently hashed during the isolated Windows node/RPC validation. The locally calculated SHA-256 exactly matched GitHub’s reported digest.

The extracted bitcoinII-qt.exe used in that test was also fingerprinted:

  • executable size: 42,903,572 bytes;
  • executable SHA-256: 8b918df903377565a9d7fa59d2d2dc087ed77155c858b2a0abcdee03f0423db5;
  • Windows Authenticode result: NotSigned.

See Windows v31.1.0 node and RPC validation — 2026-09-11.

Release-note scope

Section titled “Release-note scope”

The GitHub release notes identify these changes:

  • ShockWave per-block difficulty adjustment;
  • consensus-level Ordinals, inscriptions, and Runes mitigation;
  • BC2 transaction replay protection;
  • fork-aware header synchronization;
  • associated wallet, mining, mempool, RPC, validation, and PSBT updates.

Those are release-note claims. MoreBC2 separately reviews source/runtime behavior where verification matters.

Tag and commit state

Section titled “Tag and commit state”

The Git ref refs/tags/v31.1.0 currently points directly to a commit, rather than to an annotated tag object:

8daaf7b12e71d3646eed787f040bf2899a69dc1c

That makes v31.1.0 a lightweight tag at the time of this review.

GitHub reports the target commit verification as:

  • verified: true;
  • reason: valid;
  • a PGP signature is present in the commit verification payload;
  • the commit is shown as committed by GitHub/web-flow.

This is useful commit-level provenance evidence. It is not the same thing as a separately signed release tag, a BitcoinII release-signing key, or signatures over the six binary archives.

Because the release is not marked immutable and the tag is lightweight, a careful verifier should record both the release-asset digests and the exact tag target commit at the time of verification.

Checksum and signature publication status

Section titled “Checksum and signature publication status”

The current six release attachments contain no SHA256SUMS, SHA256SUMS.asc, detached-signature file, or release-key file.

A repository search for v31.1.0 SHA256SUMS returned no current release-specific result. The source tree does contain inherited Bitcoin Core-style Guix/release-process documentation and verification utilities that mention checksum manifests and signatures. Their presence does not establish that BitcoinII used that process for v31.1.0 or published the corresponding attestations.

Authentication boundary

Section titled “Authentication boundary”

Current evidence supports these statements:

  • the release, six uploaded assets, sizes, and GitHub-reported digests were observed;
  • the current tag target was recorded;
  • GitHub reports the target commit as cryptographically verified;
  • the Windows Qt archive was independently downloaded/hashed by MoreBC2 and matched GitHub’s digest;
  • the extracted Windows Qt executable used in the test was not Authenticode-signed.

Current evidence does not establish:

  • a maintainer-signed checksum manifest;
  • detached signatures over the release assets;
  • a documented BitcoinII release-signing-key trust path;
  • independent hashes of the other five uploaded assets;
  • binary-to-source equivalence;
  • reproducible-build verification;
  • platform code-signing status for every archive/executable.

Next verification work

Section titled “Next verification work”
  1. Independently hash the other five uploaded assets.
  2. Independently fingerprint the current GitHub-generated v31.1.0 source archives if they are used in release verification.
  3. Establish whether BitcoinII publishes any project-controlled checksum/signature trust path outside the release attachments.
  4. Document platform code-signing status for the remaining binaries where applicable.
  5. Attempt reproducible-build or otherwise documented binary-to-source verification if feasible.

Sources

Section titled “Sources”
  • BitcoinII Core v31.1.0 GitHub release/API metadata, checked 2026-09-12.
  • Git ref refs/tags/v31.1.0, checked 2026-09-12.
  • Target commit 8daaf7b12e71d3646eed787f040bf2899a69dc1c verification metadata, checked 2026-09-12.
  • Windows v31.1.0 node and RPC validation — 2026-09-11.

Verification

Section titled “Verification”

Status: Reviewed / Current bounded evidence
Primary sources checked: Current GitHub release/API metadata, tag/commit metadata, repository search, and dated MoreBC2 Windows runtime evidence
Notes: One of six uploaded archives has an independent MoreBC2 hash match. Publisher-authenticated release artifacts and reproducible binary-to-source provenance remain unestablished.