Build the vault.
Verify every layer.

sudoRuns the following program with administrator privileges, which are required for system-level changes. aptUbuntu’s package-management program; it finds, verifies, installs and updates software. updateTells apt to refresh its catalogue of available packages; it does not install upgrades itself.

sudoRuns the following program with administrator privileges, which are required for system-level changes. aptUbuntu’s package-management program; it finds, verifies, installs and updates software. -yAutomatically answers “yes” to apt confirmation prompts. full-upgradeTells apt to install all available upgrades, including changes that add or remove dependencies.

cdChanges Terminal’s current working directory to the location that follows. ~/DownloadsThe Downloads folder inside the current user’s home directory; subsequent downloads will be saved here.

wgetDownloads a file from a web address to the current directory. https://bitcoincore.org/bin/bitcoin-core-31.1/bitcoin-31.1-x86_64-linux-gnu.tar.gzThe remote HTTPS address from which the named file is downloaded.
wgetDownloads a file from a web address to the current directory. https://bitcoincore.org/bin/bitcoin-core-31.1/SHA256SUMSThe remote HTTPS address from which the named file is downloaded.
wgetDownloads a file from a web address to the current directory. https://bitcoincore.org/bin/bitcoin-core-31.1/SHA256SUMS.ascThe remote HTTPS address from which the named file is downloaded.

sha256sumRuns Linux’s SHA-256 checksum program to compare the downloaded ISO with Ubuntu’s authenticated checksum list. --ignore-missingSkips checksum entries for files that are not present locally. --checkReads published checksums and reports whether each downloaded file matches. SHA256SUMSThis is Bitcoin Core’s downloaded checksum list. sha256sum reads it to find the expected SHA-256 fingerprint for the archive being checked.

wgetDownloads a file from a web address to the current directory. -OTells wget to save the download under the filename that follows. guix.sigs.tar.gzguix.sigs.tar.gz is the local filename wget will use for the downloaded file. The preceding -O option assigns this name instead of retaining the filename from the web address. https://github.com/bitcoin-core/guix.sigs/archive/refs/heads/main.tar.gzThe remote HTTPS address from which the named file is downloaded.
tarReads or creates archive files. Here it is used to unpack downloaded archives. -xzfCombines three tar options: extract files, decompress gzip data, and read the following archive filename. guix.sigs.tar.gzguix.sigs.tar.gz is the gzip-compressed tar archive that tar will decompress and extract. The preceding -xzf options tell tar how to process this file.
gpgThe GNU Privacy Guard program used to import public keys and verify digital signatures. --importAdds the listed public signing keys to the local GPG keyring. guix.sigs-main/builder-keys/*This wildcard selects every builder public-key file inside the extracted guix.sigs directory so gpg can import all of them.
gpgThe GNU Privacy Guard program used to import public keys and verify digital signatures. --verifyChecks that a signature was made by a recognised key and that the signed file has not changed. SHA256SUMS.ascThis is the downloaded GPG signature for SHA256SUMS. gpg verifies it against the imported Bitcoin Core builder public keys.

tarReads or creates archive files. Here it is used to unpack downloaded archives. -xzfCombines three tar options: extract files, decompress gzip data, and read the following archive filename. bitcoin-31.1-x86_64-linux-gnu.tar.gzbitcoin-31.1-x86_64-linux-gnu.tar.gz is the gzip-compressed tar archive that tar will decompress and extract. The preceding -xzf options tell tar how to process this file. -CTells tar to change to the following destination directory before extracting. ~~ is the extraction destination. Here ~ means the current user’s home folder, so tar places the unpacked Bitcoin Core folder there.

prune=5500A Bitcoin Core setting that keeps roughly 5,500 MiB of recent block data instead of retaining the entire blockchain.

./bitcoindRuns the Bitcoin Core daemon located in the current directory; “./” explicitly means this directory. -daemonStarts Bitcoin Core in the background so the terminal can be used for other commands.

./bitcoin-cliRuns Bitcoin Core’s command-line client from the current directory and sends the following instruction to bitcoind. stopAsks Bitcoin Core to shut down cleanly before the computer is powered off.

sudoRuns the following program with administrator privileges, which are required for system-level changes. aptUbuntu’s package-management program; it finds, verifies, installs and updates software. updateTells apt to refresh its catalogue of available packages; it does not install upgrades itself.
sudoRuns the following program with administrator privileges, which are required for system-level changes. aptUbuntu’s package-management program; it finds, verifies, installs and updates software. -yAutomatically answers “yes” to apt confirmation prompts. installTells apt to install the named package. braseroNames the Brasero disc-writing package that apt should install.

nmcliThe command-line controller for Ubuntu’s NetworkManager service. networkingSelects NetworkManager’s overall networking state as the setting nmcli should change. offTells nmcli to switch NetworkManager networking off, disabling its managed network connections.
rfkillControls the operating system’s radio-frequency devices, such as Bluetooth adapters. blockTells rfkill to disable the radio device type named next. bluetoothSelects Bluetooth as the radio technology rfkill should block.

sudoRuns the following program with administrator privileges, which are required for system-level changes. swapoffDisables swap so memory contents are not written to storage. -aApplies swapoff to every active swap area.

cdChanges Terminal’s current working directory to the location that follows. ~/bitcoin-31.1/binThe folder containing the verified Bitcoin Core executable programs unpacked earlier in the guide.
./bitcoindRuns the Bitcoin Core daemon located in the current directory; “./” explicitly means this directory. -daemonStarts Bitcoin Core in the background so the terminal can be used for other commands.

forStarts a shell loop. Together with the condition that follows, it repeats the enclosed commands for the required numbered wallets. ((n=1;n<=7;n++))Controls the loop: start n at 1, continue while n is at most 7, and increase n by one after each pass.
doBegins the body of the for loop. The following commands run once for each value selected by the loop above.
 ./bitcoin-cliRuns Bitcoin Core’s command-line client from the current directory and sends the following instruction to bitcoind. createwalletCreates a new Bitcoin Core wallet using the name that follows. "key_${n}"Creates the wallet name key_ followed by the current loop number, producing key_1 through key_7 across the seven iterations.
doneEnds the for loop after all iterations have completed.

declareUses Bash’s declare builtin to create the variable described by the following option and name. -AMakes the declared variable an associative array, whose entries can be addressed by text keys rather than only numeric positions. xpubsNames the new associative array xpubs. The loop below stores each wallet’s extracted public descriptor in this array.

forStarts a shell loop. Together with the condition that follows, it repeats the enclosed commands for the required numbered wallets. ((n=1;n<=7;n++))Controls the loop: start n at 1, continue while n is at most 7, and increase n by one after each pass.
doBegins the body of the for loop. The following commands run once for each value selected by the loop above.
 xpubs["xpub_${n}"]=$(./bitcoin-cliSelects the xpubs array entry numbered by the current loop value, runs bitcoin-cli inside $(...), and stores the processed descriptor output in that entry. -rpcwallet="key_${n}"Directs the Bitcoin Core instruction to the named wallet rather than another loaded wallet. listdescriptorsReturns the descriptors belonging to the selected wallet. |Pipes the output produced on the left into the program on the right, allowing the next part of this command to process it. jqReads JSON output and selects or reformats the requested fields. '.descriptors | [.[] | select(.desc | startswith("wpkh") and contains("/0/*") )][0] | .desc'This jq filter examines the wallet’s descriptor list, selects the first wpkh receiving descriptor whose path contains /0/*, and outputs its desc field. |Pipes the output produced on the left into the program on the right, allowing the next part of this command to process it. grepFinds text matching the supplied pattern. -PoCombines grep’s -P and -o options: use a Perl-compatible regular expression and output only the matching text. '(?<=\().*(?=\))'This grep pattern returns only the text inside the descriptor’s outer parentheses, removing the surrounding descriptor function. |Pipes the output produced on the left into the program on the right, allowing the next part of this command to process it. sedTransforms text according to the supplied substitution expression. 's /0/\* /<0;1>/* ')This sed substitution changes the descriptor’s single receive branch /0/* into the combined external-and-change branch /<0;1>/*.
doneEnds the for loop after all iterations have completed.

desc="wsh(sortedmulti(3,${xpubs["xpub_1"]},${xpubs["xpub_2"]},${xpubs["xpub_3"]},${xpubs["xpub_4"]},${xpubs["xpub_5"]},${xpubs["xpub_6"]},${xpubs["xpub_7"]}))"Creates the shell variable desc and stores the complete wsh(sortedmulti(...)) descriptor in it. The descriptor requires any three of the seven xpubs collected in B3, and sortedmulti orders the public keys deterministically.

checksum=$(./bitcoin-cliCreates the shell variable checksum and begins a command substitution: the output produced inside $(...) becomes the variable’s value. ./bitcoin-cli calls the local Bitcoin Core command-line client. getdescriptorinfoAsks Bitcoin Core to inspect the descriptor supplied by the next element and calculate metadata including its checksum. $descExpands the desc variable created above, supplying the complete 3-of-7 descriptor to getdescriptorinfo. |Pipes Bitcoin Core’s JSON output into jq so only the required checksum is retained. jqRuns jq, a command-line JSON processor. -rTells jq to output the selected value as raw text rather than as a quoted JSON string. '.checksum')Selects the checksum property from Bitcoin Core’s JSON response, then closes the command substitution assigned to checksum.

multisig_desc="[{\"desc\": \"${desc}#${checksum}\", \"active\": true, \"timestamp\": \"now\"}]"Creates the multisig_desc shell variable containing the JSON import request. It combines the descriptor and checksum, marks the descriptor active, and uses “now” as its scan timestamp because this is a newly constructed wallet.

./bitcoin-cliRuns bitcoin-cli from the current ~/bitcoin-31.1/bin directory to send the following wallet-creation request to the local Bitcoin Core daemon. -namedEnables bitcoin-cli’s named-parameter mode for the createwallet RPC. The following values correspond to createwallet’s wallet_name, disable_private_keys, and blank parameters. createwalletCalls Bitcoin Core’s createwallet RPC to create the watch-only wallet container used by this guide. "multisig_watch_wallet"Sets the new wallet’s name to multisig_watch_wallet. The quotation marks keep the name together as one shell argument. trueSets disable_private_keys to true. This makes the wallet watch-only: it will contain no private signing keys. trueSets blank to true. Bitcoin Core creates an empty wallet so the multisig descriptor prepared above can be imported explicitly on the next line.
./bitcoin-cliRuns the local Bitcoin Core command-line client. -rpcwallet="multisig_watch_wallet"Directs this RPC call specifically to multisig_watch_wallet, the blank watch-only wallet created on the preceding line. importdescriptorsCalls importdescriptors, which adds the prepared multisig descriptor to the selected wallet. "$multisig_desc"Expands the multisig_desc variable and passes its JSON import request as one quoted argument.

./bitcoin-cliRuns the local Bitcoin Core command-line client. -rpcwallet="multisig_watch_wallet"Selects multisig_watch_wallet for this check. getwalletinfoRequests the wallet’s information so you can confirm the watch-only wallet was created and configured as expected.

./bitcoin-cliRuns Bitcoin Core’s command-line client from the current directory and sends the following instruction to bitcoind. loadwalletLoads the named wallet directory so Bitcoin Core can use it. "multisig_watch_wallet"Supplies the literal wallet name multisig_watch_wallet as one argument to the preceding wallet command.

./bitcoin-cliRuns Bitcoin Core’s command-line client from the current directory and sends the following instruction to bitcoind. stopAsks Bitcoin Core to shut down cleanly before the computer is powered off.

./bitcoindRuns the Bitcoin Core daemon located in the current directory; “./” explicitly means this directory. -daemonStarts Bitcoin Core in the background so the terminal can be used for other commands.

./bitcoin-cliRuns Bitcoin Core’s command-line client from the current directory and sends the following instruction to bitcoind. -rpcwallet="multisig_watch_wallet"Directs the Bitcoin Core instruction to the named wallet rather than another loaded wallet. getnewaddressGenerates the next receive address from the watch-only wallet.

./bitcoin-cliRuns Bitcoin Core’s command-line client from the current directory and sends the following instruction to bitcoind. -rpcwallet="multisig_watch_wallet"Directs the Bitcoin Core instruction to the named wallet rather than another loaded wallet. getbalancesReports confirmed and pending balances known to the selected wallet.

funded_psbt=$(./bitcoin-cliStarts bitcoin-cli inside a command substitution and assigns the PSBT text ultimately selected by jq to the shell variable funded_psbt. -rpcwallet="multisig_watch_wallet"Directs the Bitcoin Core instruction to the named wallet rather than another loaded wallet. -namedAllows Bitcoin Core arguments to be supplied by name rather than only by position. \Continues this same command onto the next displayed line. Press Enter only after the complete multi-line command has been pasted.
 walletcreatefundedpsbtSelects wallet coins and creates a funded but unsigned Partially Signed Bitcoin Transaction. \Continues this same command onto the next displayed line. Press Enter only after the complete multi-line command has been pasted.
 outputs="{\"$destination_address\": $amount}"Supplies the named outputs argument to walletcreatefundedpsbt. Its JSON maps the destination address you set to the BTC amount you set. \Continues this same command onto the next displayed line. Press Enter only after the complete multi-line command has been pasted.
 options='{"subtractFeeFromOutputs":[0]}'Supplies walletcreatefundedpsbt’s named options argument. subtractFeeFromOutputs:[0] deducts the transaction fee from output index 0. |Pipes the output produced on the left into the program on the right, allowing the next part of this command to process it. jqReads JSON output and selects or reformats the requested fields. -rTells jq to output the selected value as raw text instead of a JSON-quoted string. '.psbt')Selects the psbt field from jq’s JSON input as raw text, then closes the surrounding command substitution.

echoWrites the following value as text. "$funded_psbt"Expands the shell variable funded_psbt and preserves its complete value as one argument by surrounding it with quotes. >Redirects the preceding command’s output into the file named next, replacing that file if it already exists. ~/Desktop/unsigned.psbtNames the Desktop file that receives the newly created unsigned PSBT through the preceding > redirection.

./bitcoin-cliRuns Bitcoin Core’s command-line client from the current directory and sends the following instruction to bitcoind. decodepsbtConverts a PSBT into readable structured information so its inputs, outputs, amount and destination can be inspected. "$(cat ~/Desktop/unsigned.psbt)"Runs cat to read the PSBT file from the Desktop and passes the complete file contents to decodepsbt as one quoted argument.

./bitcoin-cliRuns Bitcoin Core’s command-line client from the current directory and sends the following instruction to bitcoind. loadwalletLoads the named wallet directory so Bitcoin Core can use it. "key_#"This is a placeholder wallet name. Replace # with the number of the recovered key wallet you intend to load, such as key_3.
./bitcoin-cliRuns Bitcoin Core’s command-line client from the current directory and sends the following instruction to bitcoind. loadwalletLoads the named wallet directory so Bitcoin Core can use it. "key_#"This is a placeholder wallet name. Replace # with the number of the recovered key wallet you intend to load, such as key_3.
./bitcoin-cliRuns Bitcoin Core’s command-line client from the current directory and sends the following instruction to bitcoind. loadwalletLoads the named wallet directory so Bitcoin Core can use it. "key_#"This is a placeholder wallet name. Replace # with the number of the recovered key wallet you intend to load, such as key_3.

psbt=$(catRuns cat inside a command substitution to read the signed or unsigned PSBT file, then assigns that file’s contents to the shell variable psbt. ~/Desktop/unsigned.psbt)Names the PSBT file that cat reads from the Desktop; the closing parenthesis ends the command substitution whose output is stored in the variable at the start of this line.

wallet1=$(./bitcoin-cliRuns bitcoin-cli to obtain the loaded-wallet list and assigns the selected wallet name to wallet1. listwalletsReturns the names of wallets currently loaded in Bitcoin Core. |Pipes the output produced on the left into the program on the right, allowing the next part of this command to process it.jqReads JSON output and selects or reformats the requested fields. -rTells jq to output the selected value as raw text instead of a JSON-quoted string. '.[0]')Selects loaded-wallet array entry 0 in jq, outputs that wallet name, and closes the surrounding command substitution.
wallet2=$(./bitcoin-cliRuns bitcoin-cli to obtain the loaded-wallet list and assigns the selected wallet name to wallet2. listwalletsReturns the names of wallets currently loaded in Bitcoin Core. |Pipes the output produced on the left into the program on the right, allowing the next part of this command to process it.jqReads JSON output and selects or reformats the requested fields. -rTells jq to output the selected value as raw text instead of a JSON-quoted string. '.[1]')Selects loaded-wallet array entry 1 in jq, outputs that wallet name, and closes the surrounding command substitution.
wallet3=$(./bitcoin-cliRuns bitcoin-cli to obtain the loaded-wallet list and assigns the selected wallet name to wallet3. listwalletsReturns the names of wallets currently loaded in Bitcoin Core. |Pipes the output produced on the left into the program on the right, allowing the next part of this command to process it.jqReads JSON output and selects or reformats the requested fields. -rTells jq to output the selected value as raw text instead of a JSON-quoted string. '.[2]')Selects loaded-wallet array entry 2 in jq, outputs that wallet name, and closes the surrounding command substitution.

psbt_1=$(./bitcoin-cliStarts a Bitcoin Core signing call and assigns its returned PSBT to psbt_1, ready for the next signing wallet. -rpcwallet="$wallet1"Directs the Bitcoin Core instruction to the named wallet rather than another loaded wallet. walletprocesspsbtLets the selected wallet inspect and, when it has the required private key, add its signature to the PSBT. "$psbt"Expands the shell variable psbt and preserves its complete value as one argument by surrounding it with quotes. |Pipes the output produced on the left into the program on the right, allowing the next part of this command to process it. jqReads JSON output and selects or reformats the requested fields. -rTells jq to output the selected value as raw text instead of a JSON-quoted string. '.psbt')Selects the psbt field from jq’s JSON input as raw text, then closes the surrounding command substitution.
psbt_2=$(./bitcoin-cliStarts a Bitcoin Core signing call and assigns its returned PSBT to psbt_2, ready for the next signing wallet. -rpcwallet="$wallet2"Directs the Bitcoin Core instruction to the named wallet rather than another loaded wallet. walletprocesspsbtLets the selected wallet inspect and, when it has the required private key, add its signature to the PSBT. "$psbt_1"Expands the shell variable psbt_1 and preserves its complete value as one argument by surrounding it with quotes. |Pipes the output produced on the left into the program on the right, allowing the next part of this command to process it. jqReads JSON output and selects or reformats the requested fields. -rTells jq to output the selected value as raw text instead of a JSON-quoted string. '.psbt')Selects the psbt field from jq’s JSON input as raw text, then closes the surrounding command substitution.
psbt_3=$(./bitcoin-cliStarts a Bitcoin Core signing call and assigns its returned PSBT to psbt_3, ready for the next signing wallet. -rpcwallet="$wallet3"Directs the Bitcoin Core instruction to the named wallet rather than another loaded wallet. walletprocesspsbtLets the selected wallet inspect and, when it has the required private key, add its signature to the PSBT. "$psbt_2"Expands the shell variable psbt_2 and preserves its complete value as one argument by surrounding it with quotes. |Pipes the output produced on the left into the program on the right, allowing the next part of this command to process it. jqReads JSON output and selects or reformats the requested fields. -rTells jq to output the selected value as raw text instead of a JSON-quoted string. '.psbt')Selects the psbt field from jq’s JSON input as raw text, then closes the surrounding command substitution.

echoWrites the following value as text. "$psbt_3"Expands the shell variable psbt_3 and preserves its complete value as one argument by surrounding it with quotes. >Redirects the preceding command’s output into the file named next, replacing that file if it already exists. ~/Desktop/signed.psbtNames the Desktop file that receives the three-signature PSBT through the preceding > redirection.

./bitcoin-cliRuns Bitcoin Core’s command-line client from the current directory and sends the following instruction to bitcoind. decodepsbtConverts a PSBT into readable structured information so its inputs, outputs, amount and destination can be inspected. "$(cat ~/Desktop/signed.psbt)"Runs cat to read the PSBT file from the Desktop and passes the complete file contents to decodepsbt as one quoted argument.

psbt=$(catRuns cat inside a command substitution to read the signed or unsigned PSBT file, then assigns that file’s contents to the shell variable psbt. ~/Desktop/signed.psbt)Names the PSBT file that cat reads from the Desktop; the closing parenthesis ends the command substitution whose output is stored in the variable at the start of this line.
hex=$(./bitcoin-cliRuns Bitcoin Core’s finalisation call inside a command substitution and assigns the extracted raw transaction hexadecimal to the shell variable hex. finalizepsbtCombines the completed PSBT data and produces the raw transaction hexadecimal needed for broadcast. "$psbt"Expands the shell variable psbt and preserves its complete value as one argument by surrounding it with quotes. |Pipes the output produced on the left into the program on the right, allowing the next part of this command to process it. jqReads JSON output and selects or reformats the requested fields. -rTells jq to output the selected value as raw text instead of a JSON-quoted string. '.hex')Selects the final transaction hex field from jq’s JSON input as raw text, then closes the surrounding command substitution.
./bitcoin-cliRuns Bitcoin Core’s command-line client from the current directory and sends the following instruction to bitcoind. sendrawtransactionSubmits the final raw transaction to the Bitcoin network through the online node. "$hex"Expands the shell variable hex and preserves its complete value as one argument by surrounding it with quotes.

nmcliThe command-line controller for Ubuntu’s NetworkManager service. networkingSelects NetworkManager’s overall networking state as the setting nmcli should change. offTells nmcli to switch NetworkManager networking off, disabling its managed network connections.
rfkillControls the operating system’s radio-frequency devices, such as Bluetooth adapters. blockTells rfkill to disable the radio device type named next. bluetoothSelects Bluetooth as the radio technology rfkill should block.

sudoRuns the following program with administrator privileges, which are required for system-level changes. swapoffDisables swap so memory contents are not written to storage. -aApplies swapoff to every active swap area.