guix: use glibc 2.31

Set minimum required glibc to 2.31.
The glibc 2.31 branch is still maintained:
https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.31/master.

Remove the stack-protector check from test-security-check, as the test
no-longer fails, and given the control we have of the end, the actual
security-check test seems sufficient (this might also be applied to some
of the other checks).

Drops runtime support for Ubuntu Bionic 18.04 and RHEL-8 from the release binaries.

10 files changed, 50 insertions, 462 deletions

diff --git a/contrib/devtools/symbol-check.py b/contrib/devtools/symbol-check.py
index 6613874ce3..b4e1ce64ae 100755
--- a/contrib/devtools/symbol-check.py
+++ b/contrib/devtools/symbol-check.py
@@ -14,31 +14,31 @@ import sys
 
 import lief
 
-# Debian 10 (Buster) EOL: 2024. https://wiki.debian.org/LTS
+# Debian 11 (Bullseye) EOL: 2026. https://wiki.debian.org/LTS
 #
-# - libgcc version 8.3.0 (https://packages.debian.org/search?suite=buster&arch=any&searchon=names&keywords=libgcc1)
-# - libc version 2.28 (https://packages.debian.org/search?suite=buster&arch=any&searchon=names&keywords=libc6)
+# - libgcc version 10.2.1 (https://packages.debian.org/bullseye/libgcc-s1)
+# - libc version 2.31 (https://packages.debian.org/source/bullseye/glibc)
 #
-# Ubuntu 18.04 (Bionic) EOL: 2028. https://wiki.ubuntu.com/ReleaseTeam
+# Ubuntu 20.04 (Focal) EOL: 2030. https://wiki.ubuntu.com/ReleaseTeam
 #
-# - libgcc version 8.4.0 (https://packages.ubuntu.com/bionic/libgcc1)
-# - libc version 2.27 (https://packages.ubuntu.com/bionic/libc6)
+# - libgcc version 10.5.0 (https://packages.ubuntu.com/focal/libgcc1)
+# - libc version 2.31 (https://packages.ubuntu.com/focal/libc6)
 #
-# CentOS Stream 8 EOL: 2024. https://wiki.centos.org/About/Product
+# CentOS Stream 9 EOL: 2027. https://www.centos.org/cl-vs-cs/#end-of-life
 #
-# - libgcc version 8.5.0 (http://mirror.centos.org/centos/8-stream/AppStream/x86_64/os/Packages/)
-# - libc version 2.28 (http://mirror.centos.org/centos/8-stream/AppStream/x86_64/os/Packages/)
+# - libgcc version 12.2.1 (https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os/Packages/)
+# - libc version 2.34 (https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os/Packages/)
 #
 # See https://gcc.gnu.org/onlinedocs/libstdc++/manual/abi.html for more info.
 
 MAX_VERSIONS = {
 'GCC':       (4,3,0),
 'GLIBC': {
-    lief.ELF.ARCH.x86_64: (2,27),
-    lief.ELF.ARCH.ARM:    (2,27),
-    lief.ELF.ARCH.AARCH64:(2,27),
-    lief.ELF.ARCH.PPC64:  (2,27),
-    lief.ELF.ARCH.RISCV:  (2,27),
+    lief.ELF.ARCH.x86_64: (2,31),
+    lief.ELF.ARCH.ARM:    (2,31),
+    lief.ELF.ARCH.AARCH64:(2,31),
+    lief.ELF.ARCH.PPC64:  (2,31),
+    lief.ELF.ARCH.RISCV:  (2,31),
 },
 'LIBATOMIC': (1,0),
 'V':         (0,5,0),  # xkb (bitcoin-qt only)
diff --git a/contrib/devtools/test-security-check.py b/contrib/devtools/test-security-check.py
index dd0cf7030a..7bfd4d98da 100755
--- a/contrib/devtools/test-security-check.py
+++ b/contrib/devtools/test-security-check.py
@@ -59,32 +59,32 @@ class TestSecurityChecks(unittest.TestCase):
         arch = get_arch(cc, source, executable)
 
         if arch == lief.ARCHITECTURES.X86:
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
-                    (1, executable+': failed PIE NX RELRO Canary CONTROL_FLOW'))
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
-                    (1, executable+': failed PIE RELRO Canary CONTROL_FLOW'))
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
+                    (1, executable+': failed PIE NX RELRO CONTROL_FLOW'))
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
                     (1, executable+': failed PIE RELRO CONTROL_FLOW'))
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-pie','-fPIE', '-Wl,-z,separate-code']),
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
+                    (1, executable+': failed PIE RELRO CONTROL_FLOW'))
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-znorelro','-pie','-fPIE', '-Wl,-z,separate-code']),
                     (1, executable+': failed RELRO CONTROL_FLOW'))
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,noseparate-code']),
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,noseparate-code']),
                     (1, executable+': failed separate_code CONTROL_FLOW'))
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code']),
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code']),
                     (1, executable+': failed CONTROL_FLOW'))
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code', '-fcf-protection=full']),
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code', '-fcf-protection=full']),
                     (0, ''))
         else:
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
-                    (1, executable+': failed PIE NX RELRO Canary'))
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
-                    (1, executable+': failed PIE RELRO Canary'))
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
+                    (1, executable+': failed PIE NX RELRO'))
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
+                    (1, executable+': failed PIE RELRO'))
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
                     (1, executable+': failed PIE RELRO'))
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-pie','-fPIE', '-Wl,-z,separate-code']),
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-znorelro','-pie','-fPIE', '-Wl,-z,separate-code']),
                     (1, executable+': failed RELRO'))
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,noseparate-code']),
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,noseparate-code']),
                     (1, executable+': failed separate_code'))
-            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code']),
+            self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code']),
                     (0, ''))
 
         clean_files(source, executable)
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index 53569d7f7d..44fbfa1c0b 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -98,7 +98,7 @@ chain for " target " development."))
                                        #:key
                                        (base-gcc-for-libc linux-base-gcc)
                                        (base-kernel-headers base-linux-kernel-headers)
-                                       (base-libc glibc-2.27)
+                                       (base-libc glibc-2.31)
                                        (base-gcc linux-base-gcc))
   "Convenience wrapper around MAKE-CROSS-TOOLCHAIN with default values
 desirable for building Bitcoin Core release binaries."
@@ -440,24 +440,21 @@ inspecting signatures in Mach-O binaries.")
                  (("-rpath=") "-rpath-link="))
                #t))))))))
 
-(define-public glibc-2.27
+(define-public glibc-2.31
+  (let ((commit "8e30f03744837a85e33d84ccd34ed3abe30d37c3"))
   (package
-    (inherit glibc-2.31)
-    (version "2.27")
+    (inherit glibc) ;; 2.35
+    (version "2.31")
     (source (origin
               (method git-fetch)
               (uri (git-reference
                     (url "https://sourceware.org/git/glibc.git")
-                    (commit "73886db6218e613bd6d4edf529f11e008a6c2fa6")))
-              (file-name (git-file-name "glibc" "73886db6218e613bd6d4edf529f11e008a6c2fa6"))
+                    (commit commit)))
+              (file-name (git-file-name "glibc" commit))
               (sha256
                (base32
-                "0azpb9cvnbv25zg8019rqz48h8i2257ngyjg566dlnp74ivrs9vq"))
-              (patches (search-our-patches "glibc-2.27-riscv64-Use-__has_include-to-include-asm-syscalls.h.patch"
-                                           "glibc-2.27-fcommon.patch"
-                                           "glibc-2.27-guix-prefix.patch"
-                                           "glibc-2.27-no-librt.patch"
-                                           "glibc-2.27-powerpc-ldbrx.patch"))))
+                "1zi0s9yy5zkisw823vivn7zlj8w6g9p3mm7lmlqiixcxdkz4dbn6"))
+              (patches (search-our-patches "glibc-guix-prefix.patch"))))
     (arguments
       (substitute-keyword-arguments (package-arguments glibc)
         ((#:configure-flags flags)
@@ -473,12 +470,13 @@ inspecting signatures in Mach-O binaries.")
              (lambda* (#:key outputs #:allow-other-keys)
                ;; Install the rpc data base file under `$out/etc/rpc'.
                ;; Otherwise build will fail with "Permission denied."
+               ;; Can be removed when we are building 2.32 or later.
                (let ((out (assoc-ref outputs "out")))
                  (substitute* "sunrpc/Makefile"
                    (("^\\$\\(inst_sysconfdir\\)/rpc(.*)$" _ suffix)
                     (string-append out "/etc/rpc" suffix "\n"))
                    (("^install-others =.*$")
-                    (string-append "install-others = " out "/etc/rpc\n"))))))))))))
+                    (string-append "install-others = " out "/etc/rpc\n")))))))))))))
 
 (packages->manifest
  (append
diff --git a/contrib/guix/patches/glibc-2.27-fcommon.patch b/contrib/guix/patches/glibc-2.27-fcommon.patch
deleted file mode 100644
index f8d14837fc..0000000000
--- a/contrib/guix/patches/glibc-2.27-fcommon.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-commit 264a4a0dbe1f4369db315080034b500bed66016c
-Author: fanquake <fanquake@gmail.com>
-Date:   Fri May 6 11:03:04 2022 +0100
-
-    build: use -fcommon to retain legacy behaviour with GCC 10
-    
-    GCC 10 started using -fno-common by default, which causes issues with
-    the powerpc builds using gibc 2.27. A patch was committed to glibc to fix
-    the issue, 18363b4f010da9ba459b13310b113ac0647c2fcc but is non-trvial
-    to backport, and was broken in at least one way, see the followup in
-    commit 7650321ce037302bfc2f026aa19e0213b8d02fe6.
-    
-    For now, retain the legacy GCC behaviour by passing -fcommon when
-    building glibc.
-    
-    https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html.
-    https://sourceware.org/git/?p=glibc.git;a=commit;h=18363b4f010da9ba459b13310b113ac0647c2fcc
-    https://sourceware.org/git/?p=glibc.git;a=commit;h=7650321ce037302bfc2f026aa19e0213b8d02fe6
-
-    This patch can be dropped when we are building with glibc 2.31+.
-
-diff --git a/Makeconfig b/Makeconfig
-index 86a71e5802..aa2166be60 100644
---- a/Makeconfig
-+++ b/Makeconfig
-@@ -896,7 +896,7 @@ ifeq	"$(strip $(+cflags))" ""
- endif	# $(+cflags) == ""
- 
- +cflags += $(cflags-cpu) $(+gccwarn) $(+merge-constants) $(+math-flags) \
--	   $(+stack-protector)
-+	   $(+stack-protector) -fcommon
- +gcc-nowarn := -w
- 
- # Don't duplicate options if we inherited variables from the parent.
diff --git a/contrib/guix/patches/glibc-2.27-no-librt.patch b/contrib/guix/patches/glibc-2.27-no-librt.patch
deleted file mode 100644
index 4f2092ba7e..0000000000
--- a/contrib/guix/patches/glibc-2.27-no-librt.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-This patch can be dropped when we are building with glibc 2.30+.
-
-commit 6e41ef56c9baab719a02f1377b1e7ce7bff61e73
-Author: Florian Weimer <fweimer@redhat.com>
-Date:   Fri Feb 8 10:21:56 2019 +0100
-
-    rt: Turn forwards from librt to libc into compat symbols [BZ #24194]
-    
-    As the  result of commit 6e6249d0b461b952d0f544792372663feb6d792a
-    ("BZ#14743: Move clock_* symbols from librt to libc."), in glibc 2.17,
-    clock_gettime, clock_getres, clock_settime, clock_getcpuclockid,
-    clock_nanosleep were added to libc, and the file rt/clock-compat.c
-    was added with forwarders to the actual implementations in libc.
-    These forwarders were wrapped in
-
-    #if SHLIB_COMPAT (librt, GLIBC_2_2, GLIBC_2_17)
-    
-    so that they are not present for newer architectures (such as
-    powerpc64le) with a 2.17 or later ABI baseline.  But the forwarders
-    were not marked as compatibility symbols.  As a result, on older
-    architectures, historic configure checks such as
-    
-    AC_CHECK_LIB(rt, clock_gettime)
-    
-    still cause linking against librt, even though this is completely
-    unnecessary.  It also creates a needless porting hazard because
-    architectures behave differently when it comes to symbol availability.
-    
-    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
-
-diff --git a/rt/clock-compat.c b/rt/clock-compat.c
-index f816973c05..11e71aa890 100644
---- a/rt/clock-compat.c
-+++ b/rt/clock-compat.c
-@@ -30,14 +30,16 @@
- #if HAVE_IFUNC
- # undef INIT_ARCH
- # define INIT_ARCH()
--# define COMPAT_REDIRECT(name, proto, arglist) libc_ifunc (name, &__##name)
-+# define COMPAT_REDIRECT(name, proto, arglist) libc_ifunc (name, &__##name) \
-+    compat_symbol (librt, name, name, GLIBC_2_2);
- #else
- # define COMPAT_REDIRECT(name, proto, arglist)				      \
-   int									      \
-   name proto								      \
-   {									      \
-     return __##name arglist;						      \
--  }
-+  }									      \
-+  compat_symbol (librt, name, name, GLIBC_2_2);
- #endif
- 
- COMPAT_REDIRECT (clock_getres,
diff --git a/contrib/guix/patches/glibc-2.27-powerpc-ldbrx.patch b/contrib/guix/patches/glibc-2.27-powerpc-ldbrx.patch
deleted file mode 100644
index 26716054c8..0000000000
--- a/contrib/guix/patches/glibc-2.27-powerpc-ldbrx.patch
+++ /dev/null
@@ -1,245 +0,0 @@
-From 50b0b3c9ff71ffd7ebbd74ae46844c3566478123 Mon Sep 17 00:00:00 2001
-From: "Gabriel F. T. Gomes" <gabrielftg@linux.ibm.com>
-Date: Mon, 27 May 2019 15:21:22 -0300
-Subject: [PATCH] powerpc: Fix build failures with current GCC
-
-Since GCC commit 271500 (svn), also known as the following commit on the
-git mirror:
-
-commit e154242724b084380e3221df7c08fcdbd8460674
-Author: amodra <amodra@138bc75d-0d04-0410-961f-82ee72b054a4>
-Date:   Wed May 22 04:34:26 2019 +0000
-
-    [RS6000] Don't pass -many to the assembler
-
-glibc builds are failing when an assembly implementation does not
-declare the correct '.machine' directive, or when no such directive is
-declared at all.  For example, when a POWER6 instruction is used, but
-'.machine power6' is not declared, the assembler will fail with an error
-similar to the following:
-
-    ../sysdeps/powerpc/powerpc64/power8/strcmp.S: Assembler messages:
-     24 ../sysdeps/powerpc/powerpc64/power8/strcmp.S:55: Error: unrecognized opcode: `cmpb'
-
-This patch adds '.machine powerN' directives where none existed, as well
-as it updates '.machine power7' directives on POWER8 files, because the
-minimum binutils version required to build glibc (binutils 2.25) now
-provides this machine version.  It also adds '-many' to the assembler
-command used to build tst-set_ppr.c.
-
-Tested for powerpc, powerpc64, and powerpc64le, as well as with
-build-many-glibcs.py for powerpc targets.
-
-Reviewed-by: Tulio Magno Quites Machado Filho <tuliom@linux.ibm.com>
----
- sysdeps/powerpc/Makefile                      |  5 +++
- sysdeps/powerpc/powerpc64/power4/memcmp.S     |  7 ++++
- sysdeps/powerpc/powerpc64/power7/strncmp.S    |  1 +
- .../powerpc/powerpc64/power8/fpu/s_llround.S  |  1 +
- sysdeps/powerpc/powerpc64/power8/strcasecmp.S | 36 ++++++-------------
- sysdeps/powerpc/powerpc64/power8/strcasestr.S | 14 ++------
- sysdeps/powerpc/powerpc64/power8/strcmp.S     |  1 +
- 7 files changed, 28 insertions(+), 37 deletions(-)
-
-diff --git a/sysdeps/powerpc/Makefile b/sysdeps/powerpc/Makefile
-index 6aa683b03f..23126147df 100644
---- a/sysdeps/powerpc/Makefile
-+++ b/sysdeps/powerpc/Makefile
-@@ -45,6 +45,11 @@ ifeq ($(subdir),misc)
- sysdep_headers += sys/platform/ppc.h
- tests += test-gettimebase
- tests += tst-set_ppr
-+
-+# This test is expected to run and exit with EXIT_UNSUPPORTED on
-+# processors that do not implement the Power ISA 2.06 or greater.
-+# But the test makes use of instructions from Power ISA 2.06 and 2.07.
-+CFLAGS-tst-set_ppr.c += -Wa,-many
- endif
- 
- ifneq (,$(filter %le,$(config-machine)))
-diff --git a/sysdeps/powerpc/powerpc64/power4/memcmp.S b/sysdeps/powerpc/powerpc64/power4/memcmp.S
-index e5319f101f..38dcf4c9a1 100644
---- a/sysdeps/powerpc/powerpc64/power4/memcmp.S
-+++ b/sysdeps/powerpc/powerpc64/power4/memcmp.S
-@@ -26,7 +26,14 @@
- # define MEMCMP memcmp
- #endif
- 
-+#ifndef __LITTLE_ENDIAN__
- 	.machine power4
-+#else
-+/* Little endian is only available since POWER8, so it's safe to
-+   specify .machine as power8 (or older), even though this is a POWER4
-+   file.  Since the little-endian code uses 'ldbrx', power7 is enough. */
-+	.machine power7
-+#endif
- ENTRY_TOCLESS (MEMCMP, 4)
- 	CALL_MCOUNT 3
- 
-diff --git a/sysdeps/powerpc/powerpc64/power7/strncmp.S b/sysdeps/powerpc/powerpc64/power7/strncmp.S
-index 0c7429d19f..10f898c5a3 100644
---- a/sysdeps/powerpc/powerpc64/power7/strncmp.S
-+++ b/sysdeps/powerpc/powerpc64/power7/strncmp.S
-@@ -28,6 +28,7 @@
- 		     const char *s2 [r4],
- 		     size_t size [r5])  */
- 
-+	.machine power7
- ENTRY_TOCLESS (STRNCMP, 5)
- 	CALL_MCOUNT 3
- 
-diff --git a/sysdeps/powerpc/powerpc64/power8/fpu/s_llround.S b/sysdeps/powerpc/powerpc64/power8/fpu/s_llround.S
-index a22fc63bb3..84c76ba0f9 100644
---- a/sysdeps/powerpc/powerpc64/power8/fpu/s_llround.S
-+++ b/sysdeps/powerpc/powerpc64/power8/fpu/s_llround.S
-@@ -26,6 +26,7 @@
- 
- /* long long [r3] llround (float x [fp1])  */
- 
-+	.machine power8
- ENTRY_TOCLESS (__llround)
- 	CALL_MCOUNT 0
- 	frin	fp1,fp1	/* Round to nearest +-0.5.  */
-diff --git a/sysdeps/powerpc/powerpc64/power8/strcasecmp.S b/sysdeps/powerpc/powerpc64/power8/strcasecmp.S
-index 3a2efe2a64..eeacd40c7f 100644
---- a/sysdeps/powerpc/powerpc64/power8/strcasecmp.S
-+++ b/sysdeps/powerpc/powerpc64/power8/strcasecmp.S
-@@ -91,21 +91,7 @@
- 3: \
- 	TOLOWER()
- 
--#ifdef _ARCH_PWR8
--#  define VCLZD_V8_v7	vclzd	v8, v7;
--#  define MFVRD_R3_V1	mfvrd	r3, v1;
--#  define VSUBUDM_V9_V8	vsubudm	v9, v9, v8;
--#  define VPOPCNTD_V8_V8	vpopcntd v8, v8;
--#  define VADDUQM_V7_V8	vadduqm	v9, v7, v8;
--#else
--#  define VCLZD_V8_v7	.long	0x11003fc2
--#  define MFVRD_R3_V1	.long	0x7c230067
--#  define VSUBUDM_V9_V8	.long	0x112944c0
--#  define VPOPCNTD_V8_V8	.long	0x110047c3
--#  define VADDUQM_V7_V8	.long	0x11274100
--#endif
--
--	.machine  power7
-+	.machine  power8
- 
- ENTRY (__STRCASECMP)
- #ifdef USE_AS_STRNCASECMP
-@@ -265,15 +251,15 @@ L(different):
- #ifdef __LITTLE_ENDIAN__
- 	/* Count trailing zero.  */
- 	vspltisb	v8, -1
--	VADDUQM_V7_V8
-+	vadduqm	v9, v7, v8
- 	vandc	v8, v9, v7
--	VPOPCNTD_V8_V8
-+	vpopcntd	v8, v8
- 	vspltb	v6, v8, 15
- 	vcmpequb.	v6, v6, v1
- 	blt	cr6, L(shift8)
- #else
- 	/* Count leading zero.  */
--	VCLZD_V8_v7
-+	vclzd	v8, v7
- 	vspltb	v6, v8, 7
- 	vcmpequb.	v6, v6, v1
- 	blt	cr6, L(shift8)
-@@ -291,7 +277,7 @@ L(skipsum):
- 	/* Merge and move to GPR.  */
- 	vmrglb	v6, v6, v7
- 	vslo	v1, v6, v1
--	MFVRD_R3_V1
-+	mfvrd	r3, v1
- 	/* Place the characters that are different in first position.  */
- 	sldi	rSTR2, rRTN, 56
- 	srdi	rSTR2, rSTR2, 56
-@@ -301,7 +287,7 @@ L(skipsum):
- 	vslo	v6, v5, v8
- 	vslo	v7, v4, v8
- 	vmrghb	v1, v6, v7
--	MFVRD_R3_V1
-+	mfvrd	r3, v1
- 	srdi	rSTR2, rRTN, 48
- 	sldi	rSTR2, rSTR2, 56
- 	srdi	rSTR2, rSTR2, 56
-@@ -320,15 +306,15 @@ L(null_found):
- #ifdef __LITTLE_ENDIAN__
- 	/* Count trailing zero.  */
- 	vspltisb	v8, -1
--	VADDUQM_V7_V8
-+	vadduqm	v9, v7, v8
- 	vandc	v8, v9, v7
--	VPOPCNTD_V8_V8
-+	vpopcntd	v8, v8
- 	vspltb	v6, v8, 15
- 	vcmpequb.	v6, v6, v10
- 	blt	cr6, L(shift_8)
- #else
- 	/* Count leading zero.  */
--	VCLZD_V8_v7
-+	vclzd	v8, v7
- 	vspltb	v6, v8, 7
- 	vcmpequb.	v6, v6, v10
- 	blt	cr6, L(shift_8)
-@@ -343,10 +329,10 @@ L(skipsum1):
- 	vspltisb	v10, 7
- 	vslb	v10, v10, v10
- 	vsldoi	v9, v0, v10, 1
--	VSUBUDM_V9_V8
-+	vsubudm	v9, v9, v8
- 	vspltisb	v8, 8
- 	vsldoi	v8, v0, v8, 1
--	VSUBUDM_V9_V8
-+	vsubudm	v9, v9, v8
- 	/* Shift and remove junk after null character.  */
- #ifdef __LITTLE_ENDIAN__
- 	vslo	v5, v5, v9
-diff --git a/sysdeps/powerpc/powerpc64/power8/strcasestr.S b/sysdeps/powerpc/powerpc64/power8/strcasestr.S
-index 9fc24c29f9..e10f06fd86 100644
---- a/sysdeps/powerpc/powerpc64/power8/strcasestr.S
-+++ b/sysdeps/powerpc/powerpc64/power8/strcasestr.S
-@@ -73,18 +73,8 @@
- 	vor	reg, v8, reg; \
- 	vcmpequb.	v6, reg, v4;
- 
--/* TODO: change these to the actual instructions when the minimum required
--   binutils allows it.  */
--#ifdef _ARCH_PWR8
--#define VCLZD_V8_v7	vclzd	v8, v7;
--#else
--#define VCLZD_V8_v7	.long	0x11003fc2
--#endif
--
- #define	FRAMESIZE	(FRAME_MIN_SIZE+48)
--/* TODO: change this to .machine power8 when the minimum required binutils
--   allows it.  */
--	.machine  power7
-+	.machine  power8
- ENTRY (STRCASESTR, 4)
- 	CALL_MCOUNT 2
- 	mflr	r0			/* Load link register LR to r0.  */
-@@ -291,7 +281,7 @@ L(nullchk1):
- 	vcmpequb.	v6, v0, v7
- 	/* Shift r3 by 16 bytes and proceed.  */
- 	blt	cr6, L(shift16)
--	VCLZD_V8_v7
-+	vclzd	v8, v7
- #ifdef __LITTLE_ENDIAN__
- 	vspltb	v6, v8, 15
- #else
-diff --git a/sysdeps/powerpc/powerpc64/power8/strcmp.S b/sysdeps/powerpc/powerpc64/power8/strcmp.S
-index 15e7351d1b..d592266d1d 100644
---- a/sysdeps/powerpc/powerpc64/power8/strcmp.S
-+++ b/sysdeps/powerpc/powerpc64/power8/strcmp.S
-@@ -31,6 +31,7 @@
-    64K as default, the page cross handling assumes minimum page size of
-    4k.  */
- 
-+	.machine power8
- ENTRY_TOCLESS (STRCMP, 4)
- 	li	r0,0
- 
--- 
-2.41.0
diff --git a/contrib/guix/patches/glibc-2.27-riscv64-Use-__has_include-to-include-asm-syscalls.h.patch b/contrib/guix/patches/glibc-2.27-riscv64-Use-__has_include-to-include-asm-syscalls.h.patch
deleted file mode 100644
index ab8ae9c023..0000000000
--- a/contrib/guix/patches/glibc-2.27-riscv64-Use-__has_include-to-include-asm-syscalls.h.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-Note that this has been modified from the original commit, to use __has_include
-instead of __has_include__, as the later was causing build failures with GCC 10.
-See also: http://lists.busybox.net/pipermail/buildroot/2020-July/590376.html.
-
-https://sourceware.org/git/?p=glibc.git;a=commit;h=0b9c84906f653978fb8768c7ebd0ee14a47e662e
-
-This patch can be dropped when we are building with glibc 2.28+.
-
-From 562c52cc81a4e456a62e6455feb32732049e9070 Mon Sep 17 00:00:00 2001
-From: "H.J. Lu" <hjl.tools@gmail.com>
-Date: Mon, 31 Dec 2018 09:26:42 -0800
-Subject: [PATCH] riscv: Use __has_include__ to include <asm/syscalls.h> [BZ
- #24022]
-
-<asm/syscalls.h> has been removed by
-
-commit 27f8899d6002e11a6e2d995e29b8deab5aa9cc25
-Author: David Abdurachmanov <david.abdurachmanov@gmail.com>
-Date:   Thu Nov 8 20:02:39 2018 +0100
-
-    riscv: add asm/unistd.h UAPI header
-
-    Marcin Juszkiewicz reported issues while generating syscall table for riscv
-    using 4.20-rc1. The patch refactors our unistd.h files to match some other
-    architectures.
-
-    - Add asm/unistd.h UAPI header, which has __ARCH_WANT_NEW_STAT only for 64-bit
-    - Remove asm/syscalls.h UAPI header and merge to asm/unistd.h
-    - Adjust kernel asm/unistd.h
-
-    So now asm/unistd.h UAPI header should show all syscalls for riscv.
-
-<asm/syscalls.h> may be restored by
-
-Subject: [PATCH] riscv: restore asm/syscalls.h UAPI header
-Date: Tue, 11 Dec 2018 09:09:35 +0100
-
-UAPI header asm/syscalls.h was merged into UAPI asm/unistd.h header,
-which did resolve issue with missing syscalls macros resulting in
-glibc (2.28) build failure. It also broke glibc in a different way:
-asm/syscalls.h is being used by glibc. I noticed this while doing
-Fedora 30/Rawhide mass rebuild.
-
-The patch returns asm/syscalls.h header and incl. it into asm/unistd.h.
-I plan to send a patch to glibc to use asm/unistd.h instead of
-asm/syscalls.h
-
-In the meantime, we use __has_include__, which was added to GCC 5, to
-check if <asm/syscalls.h> exists before including it.  Tested with
-build-many-glibcs.py for riscv against kernel 4.19.12 and 4.20-rc7.
-
-	[BZ #24022]
-	* sysdeps/unix/sysv/linux/riscv/flush-icache.c: Check if
-	<asm/syscalls.h> exists with __has_include__ before including it.
----
- sysdeps/unix/sysv/linux/riscv/flush-icache.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/sysdeps/unix/sysv/linux/riscv/flush-icache.c b/sysdeps/unix/sysv/linux/riscv/flush-icache.c
-index d612ef4c6c..0b2042620b 100644
---- a/sysdeps/unix/sysv/linux/riscv/flush-icache.c
-+++ b/sysdeps/unix/sysv/linux/riscv/flush-icache.c
-@@ -21,7 +21,11 @@
- #include <stdlib.h>
- #include <atomic.h>
- #include <sys/cachectl.h>
--#include <asm/syscalls.h>
-+#if __has_include (<asm/syscalls.h>)
-+# include <asm/syscalls.h>
-+#else
-+# include <asm/unistd.h>
-+#endif
- 
- typedef int (*func_type) (void *, void *, unsigned long int);
- 
--- 
-2.31.1
-
diff --git a/contrib/guix/patches/glibc-2.27-guix-prefix.patch b/contrib/guix/patches/glibc-guix-prefix.patch
index dc515907ff..60e12ca525 100644
--- a/contrib/guix/patches/glibc-2.27-guix-prefix.patch
+++ b/contrib/guix/patches/glibc-guix-prefix.patch
@@ -4,19 +4,13 @@ hash for the same package will differ when on different architectures.
 In order to be reproducible regardless of the architecture used to build
 the package, map all guix store prefixes to something fixed, e.g. /usr.
 
-We might be able to drop this in favour of using --with-nonshared-cflags
-when we begin using newer versions of glibc.
-
 --- a/Makeconfig
 +++ b/Makeconfig
-@@ -992,6 +992,10 @@ object-suffixes :=
+@@ -1007,6 +1007,7 @@ object-suffixes :=
  CPPFLAGS-.o = $(pic-default)
  # libc.a must be compiled with -fPIE/-fpie for static PIE.
  CFLAGS-.o = $(filter %frame-pointer,$(+cflags)) $(pie-default)
-+
-+# Map Guix store paths to /usr
 +CFLAGS-.o += `find /gnu/store -maxdepth 1 -mindepth 1 -type d -exec echo -n " -ffile-prefix-map={}=/usr" \;`
-+
  libtype.o := lib%.a
  object-suffixes += .o
  ifeq (yes,$(build-shared))
diff --git a/doc/dependencies.md b/doc/dependencies.md
index fc574b6164..63c505c9cb 100644
--- a/doc/dependencies.md
+++ b/doc/dependencies.md
@@ -19,7 +19,7 @@ You can find installation instructions in the `build-*.md` file for your platfor
 | --- | --- | --- | --- | --- |
 | [Boost](../depends/packages/boost.mk) | [link](https://www.boost.org/users/download/) | [1.81.0](https://github.com/bitcoin/bitcoin/pull/26557) | [1.73.0](https://github.com/bitcoin/bitcoin/pull/29066) | No |
 | [libevent](../depends/packages/libevent.mk) | [link](https://github.com/libevent/libevent/releases) | [2.1.12-stable](https://github.com/bitcoin/bitcoin/pull/21991) | [2.1.8](https://github.com/bitcoin/bitcoin/pull/24681) | No |
-| glibc | [link](https://www.gnu.org/software/libc/) | N/A | [2.27](https://github.com/bitcoin/bitcoin/pull/27029) | Yes |
+| glibc | [link](https://www.gnu.org/software/libc/) | N/A | [2.31](https://github.com/bitcoin/bitcoin/pull/29987) | Yes |
 | Linux Kernel | [link](https://www.kernel.org/) | N/A | [3.17.0](https://github.com/bitcoin/bitcoin/pull/27699) | Yes |
 
 ## Optional
diff --git a/doc/release-notes-29987.md b/doc/release-notes-29987.md
new file mode 100644
index 0000000000..4d4c2358d1
--- /dev/null
+++ b/doc/release-notes-29987.md
@@ -0,0 +1,6 @@
+Compatibility
+=============
+
+The minimum required glibc to run Bitcoin Core is now
+2.31. This means that RHEL 8 and Ubuntu 18.04 (Bionic)
+are no-longer supported. (#29987)
\ No newline at end of file