Merge bitcoin/bitcoin#23778: release: Guix 1.4.0 & GCC 10.3

84f9931cb44932751415f2ca48501ba01eed39a6 guix: use upstream python-requests (2.26.0) (fanquake)
187dc1ec0c867ffcf44f607bbb928909d86a81ca build: use python-asn1crypto from upstream (fanquake)
b1e8f0b96edf87b0ee68e85ea50c62e459ed8cb8 guix: use uptream nsis-x86_64 (fanquake)
3ccfba1c7f0515997b502103c515f9856d21c3c4 guix: use GCC 10 (over GCC 8) to build releases (fanquake)

Pull request description:

  Guix's `core-updates-frozen` branch has been merged back into `master`, and a [`version-1.4.0`](https://git.savannah.gnu.org/cgit/guix.git/log/?h=version-1.4.0) branch has been created. This is great, as it means the next Guix release is on the horizon, and it contains a number of changes I'd like to take advantage of. In particular, is migrating the version of GCC we use for releases from GCC 8 to GCC 10.3.0 (which is also the new Guix default GCC). This is my preferred method of unblocking progress in #20744, which is currently stalled due to support for `std::filesystem` for Windows not arriving in GCC until version 9, whereas it's usable on Linux starting with GCC 8. The current set of changes in that PR [attempt to backport support](https://github.com/bitcoin/bitcoin/pull/20744/commits/9604eda1abe6ffc02c97e3434c3c2c4ce1250794) for `std::filesystem`, for Windows, to GCC 8, similar to what is currently done by Debian, however that is somewhat convoluted, and using GCC 10 with our current Guix version would require updating at least one Guix patch to GCC, so is not completely straightforward either.

  Other changes included here:
  * Dropping our `--no-*` patch for mingw binutils ld, as we can take advantage of the `--disable-*` flags that are now available in binutlils 2.37. The security check tests are updated accordingly.
  * Dropping our current patch for NSIS, as it's been integrated upstream, however given we are building v3.05, we need a different one (https://github.com/kichik/nsis/commit/229b6136c41ba5caba25936f4927476d20aa283f) for compiling against GCC 10.
  * Removing our `python-asn1crypto` package definition, as an identical package is available in Guix. Over time we should look at trying to get the rest of the python packages we define here upstreamed.
  * Adding a patch for `python-elfsteem` to fix an issue in the example code when using Python 3.9+.
  * Our base glibc (`2.24`) now inherits from glibc-2.31. Guix has removed packages of glibc < 2.29, and the current version of glibc is `2.33`. However glibc-2.31 is the newest version that still contains a workaround for installing sunrpc data, which we need, so inheriting from that version seemed like the most straightforward solution.
  * As mentioned, Guix has removed glibcs < 2.29, so we add our own package definition for glibc 2.27, which we use for our RISC-V toolchain (also inheriting from 2.31).

  The guix commit hash currently points to the head of the `version-1.4.0` branch. This can be updated to an official release tag when one is available.

  Looking for Concept ACKs on migrating to using GCC 10.3 for building releases. Keeping in mind issues like #20005, however that particular bug should be fixed in GCC 10.3.0+, according to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189.

  Guix Builds:
  ```bash
  bash-5.1# find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
  ea56ef38bd94dbcb11b9d10e2f10c205109daad03fea4313f79892fc497ba68d  guix-build-84f9931cb449/output/aarch64-linux-gnu/SHA256SUMS.part
  01123ab23e5a09dc06a897837389e859d302ba2b18fbe827936ec8983765e7df  guix-build-84f9931cb449/output/aarch64-linux-gnu/bitcoin-84f9931cb449-aarch64-linux-gnu-debug.tar.gz
  7a24e25c2237e5aeb14508b91c5c6954572814e1767e892c164494f32d73b0c0  guix-build-84f9931cb449/output/aarch64-linux-gnu/bitcoin-84f9931cb449-aarch64-linux-gnu.tar.gz
  0e1dba0233da1f487222b128964980d50393e61a6971bcf4c71951c29fdf3993  guix-build-84f9931cb449/output/arm-linux-gnueabihf/SHA256SUMS.part
  8cd4c6f42abc81427f1d2500f86daced2a4ee78882dd9d03b5a0211a1d96306e  guix-build-84f9931cb449/output/arm-linux-gnueabihf/bitcoin-84f9931cb449-arm-linux-gnueabihf-debug.tar.gz
  c180db6bffb1a54b6dc65929d86d5eba9adf876a28ad320590ed230233e57299  guix-build-84f9931cb449/output/arm-linux-gnueabihf/bitcoin-84f9931cb449-arm-linux-gnueabihf.tar.gz
  4efcda7b63646eb46dabea7122fb026f2c063d2919a9dcbbffbc0929b9c56ced  guix-build-84f9931cb449/output/dist-archive/bitcoin-84f9931cb449.tar.gz
  1e35e96034fed00674f362d6471fb402dd2758cec2860ded4fd7e37c38935a44  guix-build-84f9931cb449/output/powerpc64-linux-gnu/SHA256SUMS.part
  96a0b7f54d3b3935c134f8c2aaaf11a314b54c9d7924ba751503caa16bd1c840  guix-build-84f9931cb449/output/powerpc64-linux-gnu/bitcoin-84f9931cb449-powerpc64-linux-gnu-debug.tar.gz
  ae05137b6fb3494120f5413bf8a94ca3c1b0c047e1f512e6c2c5a0b1f122f075  guix-build-84f9931cb449/output/powerpc64-linux-gnu/bitcoin-84f9931cb449-powerpc64-linux-gnu.tar.gz
  c22e5fbcdcdbfa5d385537e2c1dab55004d9e94396ebccef0bc3d216edfacbbe  guix-build-84f9931cb449/output/powerpc64le-linux-gnu/SHA256SUMS.part
  52602b41e81a921435d93f2a3ae29549aa65a4147cdbf1ed7d9e4a44c4dc902a  guix-build-84f9931cb449/output/powerpc64le-linux-gnu/bitcoin-84f9931cb449-powerpc64le-linux-gnu-debug.tar.gz
  a2cc7e9385452163a7bda99f6f9aa630fd35d4ba13d4fd9a4dd7e8062206650d  guix-build-84f9931cb449/output/powerpc64le-linux-gnu/bitcoin-84f9931cb449-powerpc64le-linux-gnu.tar.gz
  e75fadf1b1c7e4ae3d52e7a8051a881de17bd4d9d32c1ca29ca0ddbb8028ee51  guix-build-84f9931cb449/output/riscv64-linux-gnu/SHA256SUMS.part
  3b643c33842a15befb5d36d13b598a5e628c11b95671336c8dea51b5eed9c79a  guix-build-84f9931cb449/output/riscv64-linux-gnu/bitcoin-84f9931cb449-riscv64-linux-gnu-debug.tar.gz
  e9a1ee7451502508cde73dc300aca8a421e379ac08c3f4adaf8c768fbfa942ac  guix-build-84f9931cb449/output/riscv64-linux-gnu/bitcoin-84f9931cb449-riscv64-linux-gnu.tar.gz
  c0508a0872cf1415a47983d2ebbc9e5a46282ce7b6453afac544e0d1315b7bf9  guix-build-84f9931cb449/output/x86_64-apple-darwin/SHA256SUMS.part
  7c02267cb91e2649088af5e96f81142beaad67f6a1a0588355174a4157b31458  guix-build-84f9931cb449/output/x86_64-apple-darwin/bitcoin-84f9931cb449-osx-unsigned.dmg
  46dbf5a911abfa63e3c5aa8440289da5fdea89da013253c08768ce58b798a99d  guix-build-84f9931cb449/output/x86_64-apple-darwin/bitcoin-84f9931cb449-osx-unsigned.tar.gz
  ab2e2360f18cb1b80bfd37f1a9508a938e89237767120472f932402cc809f0eb  guix-build-84f9931cb449/output/x86_64-apple-darwin/bitcoin-84f9931cb449-osx64.tar.gz
  f58aa000692f7ea09ab8e7ec159a806d3a665f0f70558e62a53d56afb361eb02  guix-build-84f9931cb449/output/x86_64-linux-gnu/SHA256SUMS.part
  78a76aef8469b07a41588e019a6dfa890c36fd5becf2c8d73a71c9e72bcabde6  guix-build-84f9931cb449/output/x86_64-linux-gnu/bitcoin-84f9931cb449-x86_64-linux-gnu-debug.tar.gz
  5e6e0040b37ff035de41c8fcfee5d498bd19fa489024704dd4caa0ab9f566450  guix-build-84f9931cb449/output/x86_64-linux-gnu/bitcoin-84f9931cb449-x86_64-linux-gnu.tar.gz
  d6e6af70f277d9c9ef9b4773ec05920355ac07ebec71ff3e179676047329964b  guix-build-84f9931cb449/output/x86_64-w64-mingw32/SHA256SUMS.part
  37f24f6899e7803ed07bd0f5eb3f0fb6237ac1254dd72f446e9e4e488a927c8e  guix-build-84f9931cb449/output/x86_64-w64-mingw32/bitcoin-84f9931cb449-win-unsigned.tar.gz
  14f7d1c14a5fc3b4c336d301f936c5578d6e31d61ec720dfc9d4129445d1e2a2  guix-build-84f9931cb449/output/x86_64-w64-mingw32/bitcoin-84f9931cb449-win64-debug.zip
  c8049dcc0308a76f21dd781e8561ebbafa84034fbf8e3afa7d4017866d7fd195  guix-build-84f9931cb449/output/x86_64-w64-mingw32/bitcoin-84f9931cb449-win64-setup-unsigned.exe
  fb1e6580c25b073118f121aabaa04aa09643bc97cfeaea7c9a24bbe65c33cbb6  guix-build-84f9931cb449/output/x86_64-w64-mingw32/bitcoin-84f9931cb449-win64.zip
  ```

ACKs for top commit:
  hebasto:
    re-ACK 84f9931cb44932751415f2ca48501ba01eed39a6

Tree-SHA512: 2f5f4f6bb1f55a048dba88523f235320e51c4af963355abf6a86b7035623b2100ae3dc44396c76fbeea89ae9cfbc5342abd3e2c41760ede8b689d7757d6e7f25

9 files changed, 71 insertions, 654 deletions

diff --git a/contrib/devtools/test-security-check.py b/contrib/devtools/test-security-check.py
index 4a862531a1..6b748e8743 100755
--- a/contrib/devtools/test-security-check.py
+++ b/contrib/devtools/test-security-check.py
@@ -69,15 +69,15 @@ class TestSecurityChecks(unittest.TestCase):
         cc = determine_wellknown_cmd('CC', 'x86_64-w64-mingw32-gcc')
         write_testcode(source)
 
-        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--no-nxcompat','-Wl,--disable-reloc-section','-Wl,--no-dynamicbase','-Wl,--no-high-entropy-va','-no-pie','-fno-PIE']),
+        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--disable-nxcompat','-Wl,--disable-reloc-section','-Wl,--disable-dynamicbase','-Wl,--disable-high-entropy-va','-no-pie','-fno-PIE']),
             (1, executable+': failed PIE DYNAMIC_BASE HIGH_ENTROPY_VA NX RELOC_SECTION CONTROL_FLOW'))
-        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--disable-reloc-section','-Wl,--no-dynamicbase','-Wl,--no-high-entropy-va','-no-pie','-fno-PIE']),
+        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--disable-reloc-section','-Wl,--disable-dynamicbase','-Wl,--disable-high-entropy-va','-no-pie','-fno-PIE']),
             (1, executable+': failed PIE DYNAMIC_BASE HIGH_ENTROPY_VA RELOC_SECTION CONTROL_FLOW'))
-        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--no-dynamicbase','-Wl,--no-high-entropy-va','-no-pie','-fno-PIE']),
+        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--disable-dynamicbase','-Wl,--disable-high-entropy-va','-no-pie','-fno-PIE']),
             (1, executable+': failed PIE DYNAMIC_BASE HIGH_ENTROPY_VA CONTROL_FLOW'))
-        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--no-dynamicbase','-Wl,--no-high-entropy-va','-pie','-fPIE']),
+        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--disable-dynamicbase','-Wl,--disable-high-entropy-va','-pie','-fPIE']),
             (1, executable+': failed PIE DYNAMIC_BASE HIGH_ENTROPY_VA CONTROL_FLOW'))  # -pie -fPIE does nothing unless --dynamicbase is also supplied
-        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--dynamicbase','-Wl,--no-high-entropy-va','-pie','-fPIE']),
+        self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--dynamicbase','-Wl,--disable-high-entropy-va','-pie','-fPIE']),
             (1, executable+': failed HIGH_ENTROPY_VA CONTROL_FLOW'))
         self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--dynamicbase','-Wl,--high-entropy-va','-pie','-fPIE']),
             (1, executable+': failed CONTROL_FLOW'))
diff --git a/contrib/guix/guix-build b/contrib/guix/guix-build
index a6579d6b8b..694f2ff1fa 100755
--- a/contrib/guix/guix-build
+++ b/contrib/guix/guix-build
@@ -239,7 +239,7 @@ SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(git -c log.showSignature=false log --f
 time-machine() {
     # shellcheck disable=SC2086
     guix time-machine --url=https://git.savannah.gnu.org/git/guix.git \
-                      --commit=aa34d4d28dfe25ba47d5800d05000fb7221788c0 \
+                      --commit=fa17abf1af09570708daa28dd40ffbc932ebe25c \
                       --cores="$JOBS" \
                       --keep-failed \
                       --fallback \
diff --git a/contrib/guix/libexec/build.sh b/contrib/guix/libexec/build.sh
index c375dc9716..79a3e77f40 100755
--- a/contrib/guix/libexec/build.sh
+++ b/contrib/guix/libexec/build.sh
@@ -109,7 +109,7 @@ case "$HOST" in
         #    2. kernel-header-related search paths (not applicable to mingw-w64 hosts)
         export CROSS_C_INCLUDE_PATH="${CROSS_GCC_LIB}/include:${CROSS_GCC_LIB}/include-fixed:${CROSS_GLIBC}/include"
         export CROSS_CPLUS_INCLUDE_PATH="${CROSS_GCC}/include/c++:${CROSS_GCC}/include/c++/${HOST}:${CROSS_GCC}/include/c++/backward:${CROSS_C_INCLUDE_PATH}"
-        export CROSS_LIBRARY_PATH="${CROSS_GCC_LIB_STORE}/lib:${CROSS_GCC}/${HOST}/lib:${CROSS_GCC_LIB}:${CROSS_GLIBC}/lib"
+        export CROSS_LIBRARY_PATH="${CROSS_GCC_LIB_STORE}/lib:${CROSS_GCC_LIB}:${CROSS_GLIBC}/lib"
         ;;
     *darwin*)
         # The CROSS toolchain for darwin uses the SDK and ignores environment variables.
@@ -126,7 +126,7 @@ case "$HOST" in
 
         export CROSS_C_INCLUDE_PATH="${CROSS_GCC_LIB}/include:${CROSS_GCC_LIB}/include-fixed:${CROSS_GLIBC}/include:${CROSS_KERNEL}/include"
         export CROSS_CPLUS_INCLUDE_PATH="${CROSS_GCC}/include/c++:${CROSS_GCC}/include/c++/${HOST}:${CROSS_GCC}/include/c++/backward:${CROSS_C_INCLUDE_PATH}"
-        export CROSS_LIBRARY_PATH="${CROSS_GCC_LIB_STORE}/lib:${CROSS_GCC}/${HOST}/lib:${CROSS_GCC_LIB}:${CROSS_GLIBC}/lib:${CROSS_GLIBC_STATIC}/lib"
+        export CROSS_LIBRARY_PATH="${CROSS_GCC_LIB_STORE}/lib:${CROSS_GCC_LIB}:${CROSS_GLIBC}/lib:${CROSS_GLIBC_STATIC}/lib"
         ;;
     *)
         exit 1 ;;
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index 6ecb324457..3528030bec 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -16,7 +16,6 @@
              (gnu packages gawk)
              (gnu packages gcc)
              (gnu packages gnome)
-             (gnu packages image)
              (gnu packages installers)
              (gnu packages linux)
              (gnu packages llvm)
@@ -25,11 +24,11 @@
              (gnu packages perl)
              (gnu packages pkg-config)
              (gnu packages python)
+             (gnu packages python-crypto)
              (gnu packages python-web)
              (gnu packages shells)
              (gnu packages tls)
              (gnu packages version-control)
-             (guix build-system font)
              (guix build-system gnu)
              (guix build-system python)
              (guix build-system trivial)
@@ -79,10 +78,6 @@ http://www.linuxfromscratch.org/hlfs/view/development/chapter05/gcc-pass1.html"
                  (("-rpath=") "-rpath-link="))
                #t))))))))
 
-(define (make-binutils-with-mingw-w64-disable-flags xbinutils)
-  (package-with-extra-patches xbinutils
-    (search-our-patches "binutils-mingw-w64-disable-flags.patch")))
-
 (define (make-cross-toolchain target
                               base-gcc-for-libc
                               base-kernel-headers
@@ -134,9 +129,7 @@ chain for " target " development."))
       (home-page (package-home-page xgcc))
       (license (package-license xgcc)))))
 
-(define base-gcc
-  (package-with-extra-patches gcc-8
-    (search-our-patches "gcc-8-sort-libtool-find-output.patch")))
+(define base-gcc gcc-10)
 
 ;; Building glibc with stack smashing protector first landed in glibc 2.25, use
 ;; this function to disable for older glibcs
@@ -171,7 +164,7 @@ desirable for building Bitcoin Core release binaries."
 
 (define (make-mingw-pthreads-cross-toolchain target)
   "Create a cross-compilation toolchain package for TARGET"
-  (let* ((xbinutils (make-binutils-with-mingw-w64-disable-flags (cross-binutils target)))
+  (let* ((xbinutils (cross-binutils target))
          (pthreads-xlibc mingw-w64-x86_64-winpthreads)
          (pthreads-xgcc (make-gcc-with-pthreads
                          (cross-gcc target
@@ -197,9 +190,9 @@ chain for " target " development."))
       (home-page (package-home-page pthreads-xgcc))
       (license (package-license pthreads-xgcc)))))
 
-(define (make-nsis-with-sde-support base-nsis)
+(define (make-nsis-for-gcc-10 base-nsis)
   (package-with-extra-patches base-nsis
-    (search-our-patches "nsis-SConstruct-sde-support.patch")))
+    (search-our-patches "nsis-gcc-10-memmove.patch")))
 
 (define-public lief
   (package
@@ -256,34 +249,6 @@ signing and timestamping. But osslsigncode is based on OpenSSL and cURL, and
 thus should be able to compile on most platforms where these exist.")
     (license license:gpl3+))) ; license is with openssl exception
 
-(define-public python-asn1crypto
-  (package
-    (name "python-asn1crypto")
-    (version "1.4.0")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/wbond/asn1crypto")
-             (commit version)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32
-         "19abibn6jw20mzi1ln4n9jjvpdka8ygm4m439hplyrdfqbvgm01r"))))
-    (build-system python-build-system)
-    (arguments
-     '(#:phases
-       (modify-phases %standard-phases
-         (replace 'check
-           (lambda _
-             (invoke "python" "run.py" "tests"))))))
-    (home-page "https://github.com/wbond/asn1crypto")
-    (synopsis "ASN.1 parser and serializer in Python")
-    (description "asn1crypto is an ASN.1 parser and serializer with definitions
-for private keys, public keys, certificates, CRL, OCSP, CMS, PKCS#3, PKCS#7,
-PKCS#8, PKCS#12, PKCS#5, X.509 and TSP.")
-    (license license:expat)))
-
 (define-public python-elfesteem
   (let ((commit "87bbd79ab7e361004c98cc8601d4e5f029fd8bd5"))
     (package
@@ -298,7 +263,8 @@ PKCS#8, PKCS#12, PKCS#5, X.509 and TSP.")
          (file-name (git-file-name name commit))
          (sha256
           (base32
-           "1nyvjisvyxyxnd0023xjf5846xd03lwawp5pfzr8vrky7wwm5maz"))))
+           "1nyvjisvyxyxnd0023xjf5846xd03lwawp5pfzr8vrky7wwm5maz"))
+      (patches (search-our-patches "elfsteem-value-error-python-39.patch"))))
       (build-system python-build-system)
       ;; There are no tests, but attempting to run python setup.py test leads to
       ;; PYTHONPATH problems, just disable the test
@@ -370,6 +336,8 @@ PKCS#8, PKCS#12, PKCS#5, X.509 and TSP.")
 (define-public python-oscryptotests
   (package (inherit python-oscrypto)
     (name "python-oscryptotests")
+    (propagated-inputs
+      `(("python-oscrypto" ,python-oscrypto)))
     (arguments
      `(#:tests? #f
        #:phases
@@ -441,16 +409,6 @@ certificates or paths. Supports various options, including: validation at a
 specific moment in time, whitelisting and revocation checks.")
       (license license:expat))))
 
-(define-public python-requests-2.25.1
-  (package (inherit python-requests)
-    (version "2.25.1")
-    (source (origin
-              (method url-fetch)
-              (uri (pypi-uri "requests" version))
-              (sha256
-               (base32
-                "015qflyqsgsz09gnar69s6ga74ivq5kch69s4qxz3904m7a3v5r7"))))))
-
 (define-public python-altgraph
   (package
     (name "python-altgraph")
@@ -543,7 +501,7 @@ and endian independent.")
          ("python-oscrypto" ,python-oscrypto)
          ("python-certvalidator" ,python-certvalidator)
          ("python-elfesteem" ,python-elfesteem)
-         ("python-requests" ,python-requests-2.25.1)
+         ("python-requests" ,python-requests)
          ("python-macholib" ,python-macholib)
          ("libcrypto" ,openssl)))
       ;; There are no tests, but attempting to run python setup.py test leads to
@@ -557,7 +515,7 @@ inspecting signatures in Mach-O binaries.")
 
 (define-public glibc-2.24
   (package
-    (inherit glibc)
+    (inherit glibc-2.31)
     (version "2.24")
     (source (origin
               (method git-fetch)
@@ -573,9 +531,21 @@ inspecting signatures in Mach-O binaries.")
                                            "glibc-2.24-elfm-loadaddr-dynamic-rewrite.patch"
                                            "glibc-2.24-no-build-time-cxx-header-run.patch"))))))
 
-(define glibc-2.27/bitcoin-patched
-  (package-with-extra-patches glibc-2.27
-    (search-our-patches "glibc-2.27-riscv64-Use-__has_include__-to-include-asm-syscalls.h.patch")))
+(define-public glibc-2.27/bitcoin-patched
+  (package
+    (inherit glibc-2.31)
+    (version "2.27")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://sourceware.org/git/glibc.git")
+                    (commit "23158b08a0908f381459f273a984c6fd328363cb")))
+              (file-name (git-file-name "glibc" "23158b08a0908f381459f273a984c6fd328363cb"))
+              (sha256
+               (base32
+                "1b2n1gxv9f4fd5yy68qjbnarhf8mf4vmlxk10i3328c1w5pmp0ca"))
+              (patches (search-our-patches "glibc-ldd-x86_64.patch"
+                                           "glibc-2.27-riscv64-Use-__has_include__-to-include-asm-syscalls.h.patch"))))))
 
 (packages->manifest
  (append
@@ -623,7 +593,7 @@ inspecting signatures in Mach-O binaries.")
            ;; Windows
            (list zip
                  (make-mingw-pthreads-cross-toolchain "x86_64-w64-mingw32")
-                 (make-nsis-with-sde-support nsis-x86_64)
+                 (make-nsis-for-gcc-10 nsis-x86_64)
                  osslsigncode))
           ((string-contains target "-linux-")
            (list (cond ((string-contains target "riscv64-")
diff --git a/contrib/guix/patches/binutils-mingw-w64-disable-flags.patch b/contrib/guix/patches/binutils-mingw-w64-disable-flags.patch
deleted file mode 100644
index 8f88eb9dfd..0000000000
--- a/contrib/guix/patches/binutils-mingw-w64-disable-flags.patch
+++ /dev/null
@@ -1,171 +0,0 @@
-Description: Add disable opposites to the security-related flags
-Author: Stephen Kitt <skitt@debian.org>
-
-This patch adds "no-" variants to disable the various security flags:
-"no-dynamicbase", "no-nxcompat", "no-high-entropy-va", "disable-reloc-section".
-
---- a/ld/emultempl/pe.em
-+++ b/ld/emultempl/pe.em
-@@ -259,9 +261,11 @@
- 					(OPTION_ENABLE_LONG_SECTION_NAMES + 1)
- /* DLLCharacteristics flags.  */
- #define OPTION_DYNAMIC_BASE		(OPTION_DISABLE_LONG_SECTION_NAMES + 1)
--#define OPTION_FORCE_INTEGRITY		(OPTION_DYNAMIC_BASE + 1)
-+#define OPTION_NO_DYNAMIC_BASE		(OPTION_DYNAMIC_BASE + 1)
-+#define OPTION_FORCE_INTEGRITY		(OPTION_NO_DYNAMIC_BASE + 1)
- #define OPTION_NX_COMPAT		(OPTION_FORCE_INTEGRITY + 1)
--#define OPTION_NO_ISOLATION		(OPTION_NX_COMPAT + 1)
-+#define OPTION_NO_NX_COMPAT		(OPTION_NX_COMPAT + 1)
-+#define OPTION_NO_ISOLATION		(OPTION_NO_NX_COMPAT + 1)
- #define OPTION_NO_SEH			(OPTION_NO_ISOLATION + 1)
- #define OPTION_NO_BIND			(OPTION_NO_SEH + 1)
- #define OPTION_WDM_DRIVER		(OPTION_NO_BIND + 1)
-@@ -271,6 +275,7 @@
- #define OPTION_NO_INSERT_TIMESTAMP	(OPTION_INSERT_TIMESTAMP + 1)
- #define OPTION_BUILD_ID			(OPTION_NO_INSERT_TIMESTAMP + 1)
- #define OPTION_ENABLE_RELOC_SECTION	(OPTION_BUILD_ID + 1)
-+#define OPTION_DISABLE_RELOC_SECTION	(OPTION_ENABLE_RELOC_SECTION + 1)
- 
- static void
- gld${EMULATION_NAME}_add_options
-@@ -342,8 +347,10 @@
-     {"enable-long-section-names", no_argument, NULL, OPTION_ENABLE_LONG_SECTION_NAMES},
-     {"disable-long-section-names", no_argument, NULL, OPTION_DISABLE_LONG_SECTION_NAMES},
-     {"dynamicbase",no_argument, NULL, OPTION_DYNAMIC_BASE},
-+    {"no-dynamicbase", no_argument, NULL, OPTION_NO_DYNAMIC_BASE},
-     {"forceinteg", no_argument, NULL, OPTION_FORCE_INTEGRITY},
-     {"nxcompat", no_argument, NULL, OPTION_NX_COMPAT},
-+    {"no-nxcompat", no_argument, NULL, OPTION_NO_NX_COMPAT},
-     {"no-isolation", no_argument, NULL, OPTION_NO_ISOLATION},
-     {"no-seh", no_argument, NULL, OPTION_NO_SEH},
-     {"no-bind", no_argument, NULL, OPTION_NO_BIND},
-@@ -351,6 +358,7 @@
-     {"tsaware", no_argument, NULL, OPTION_TERMINAL_SERVER_AWARE},
-     {"build-id", optional_argument, NULL, OPTION_BUILD_ID},
-     {"enable-reloc-section", no_argument, NULL, OPTION_ENABLE_RELOC_SECTION},
-+    {"disable-reloc-section", no_argument, NULL, OPTION_DISABLE_RELOC_SECTION},
-     {NULL, no_argument, NULL, 0}
-   };
- 
-@@ -485,9 +494,12 @@
-                                        in object files\n"));
-   fprintf (file, _("  --dynamicbase                      Image base address may be relocated using\n\
-                                        address space layout randomization (ASLR)\n"));
-+  fprintf (file, _("  --no-dynamicbase                   Image base address may not be relocated\n"));
-   fprintf (file, _("  --enable-reloc-section             Create the base relocation table\n"));
-+  fprintf (file, _("  --disable-reloc-section            Disable the base relocation table\n"));
-   fprintf (file, _("  --forceinteg               Code integrity checks are enforced\n"));
-   fprintf (file, _("  --nxcompat                 Image is compatible with data execution prevention\n"));
-+  fprintf (file, _("  --no-nxcompat              Image is not compatible with data execution prevention\n"));
-   fprintf (file, _("  --no-isolation             Image understands isolation but do not isolate the image\n"));
-   fprintf (file, _("  --no-seh                   Image does not use SEH. No SE handler may\n\
-                                        be called in this image\n"));
-@@ -862,12 +874,21 @@
-     case OPTION_ENABLE_RELOC_SECTION:
-       pe_dll_enable_reloc_section = 1;
-       break;
-+    case OPTION_DISABLE_RELOC_SECTION:
-+      pe_dll_enable_reloc_section = 0;
-+      /* fall through */
-+    case OPTION_NO_DYNAMIC_BASE:
-+      pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE;
-+      break;
-     case OPTION_FORCE_INTEGRITY:
-       pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY;
-       break;
-     case OPTION_NX_COMPAT:
-       pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
-       break;
-+    case OPTION_NO_NX_COMPAT:
-+      pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
-+      break;
-     case OPTION_NO_ISOLATION:
-       pe_dll_characteristics |= IMAGE_DLLCHARACTERISTICS_NO_ISOLATION;
-       break;
---- a/ld/emultempl/pep.em
-+++ b/ld/emultempl/pep.em
-@@ -237,9 +240,12 @@
-   OPTION_ENABLE_LONG_SECTION_NAMES,
-   OPTION_DISABLE_LONG_SECTION_NAMES,
-   OPTION_HIGH_ENTROPY_VA,
-+  OPTION_NO_HIGH_ENTROPY_VA,
-   OPTION_DYNAMIC_BASE,
-+  OPTION_NO_DYNAMIC_BASE,
-   OPTION_FORCE_INTEGRITY,
-   OPTION_NX_COMPAT,
-+  OPTION_NO_NX_COMPAT,
-   OPTION_NO_ISOLATION,
-   OPTION_NO_SEH,
-   OPTION_NO_BIND,
-@@ -248,7 +254,8 @@
-   OPTION_NO_INSERT_TIMESTAMP,
-   OPTION_TERMINAL_SERVER_AWARE,
-   OPTION_BUILD_ID,
--  OPTION_ENABLE_RELOC_SECTION
-+  OPTION_ENABLE_RELOC_SECTION,
-+  OPTION_DISABLE_RELOC_SECTION
- };
- 
- static void
-@@ -315,9 +322,12 @@
-     {"enable-long-section-names", no_argument, NULL, OPTION_ENABLE_LONG_SECTION_NAMES},
-     {"disable-long-section-names", no_argument, NULL, OPTION_DISABLE_LONG_SECTION_NAMES},
-     {"high-entropy-va", no_argument, NULL, OPTION_HIGH_ENTROPY_VA},
-+    {"no-high-entropy-va", no_argument, NULL, OPTION_NO_HIGH_ENTROPY_VA},
-     {"dynamicbase",no_argument, NULL, OPTION_DYNAMIC_BASE},
-+    {"no-dynamicbase", no_argument, NULL, OPTION_NO_DYNAMIC_BASE},
-     {"forceinteg", no_argument, NULL, OPTION_FORCE_INTEGRITY},
-     {"nxcompat", no_argument, NULL, OPTION_NX_COMPAT},
-+    {"no-nxcompat", no_argument, NULL, OPTION_NO_NX_COMPAT},
-     {"no-isolation", no_argument, NULL, OPTION_NO_ISOLATION},
-     {"no-seh", no_argument, NULL, OPTION_NO_SEH},
-     {"no-bind", no_argument, NULL, OPTION_NO_BIND},
-@@ -327,6 +337,7 @@
-     {"no-insert-timestamp", no_argument, NULL, OPTION_NO_INSERT_TIMESTAMP},
-     {"build-id", optional_argument, NULL, OPTION_BUILD_ID},
-     {"enable-reloc-section", no_argument, NULL, OPTION_ENABLE_RELOC_SECTION},
-+    {"disable-reloc-section", no_argument, NULL, OPTION_DISABLE_RELOC_SECTION},
-     {NULL, no_argument, NULL, 0}
-   };
- 
-@@ -448,11 +461,15 @@
-                                        in object files\n"));
-   fprintf (file, _("  --high-entropy-va                  Image is compatible with 64-bit address space\n\
-                                        layout randomization (ASLR)\n"));
-+  fprintf (file, _("  --no-high-entropy-va               Image is not compatible with 64-bit ASLR\n"));
-   fprintf (file, _("  --dynamicbase                      Image base address may be relocated using\n\
-                                        address space layout randomization (ASLR)\n"));
-+  fprintf (file, _("  --no-dynamicbase                   Image base address may not be relocated\n"));
-   fprintf (file, _("  --enable-reloc-section             Create the base relocation table\n"));
-+  fprintf (file, _("  --disable-reloc-section            Disable the base relocation table\n"));
-   fprintf (file, _("  --forceinteg               Code integrity checks are enforced\n"));
-   fprintf (file, _("  --nxcompat                 Image is compatible with data execution prevention\n"));
-+  fprintf (file, _("  --no-nxcompat              Image is not compatible with data execution prevention\n"));
-   fprintf (file, _("  --no-isolation             Image understands isolation but do not isolate the image\n"));
-   fprintf (file, _("  --no-seh                   Image does not use SEH; no SE handler may\n\
-                                        be called in this image\n"));
-@@ -809,12 +826,24 @@
-     case OPTION_ENABLE_RELOC_SECTION:
-       pep_dll_enable_reloc_section = 1;
-       break;
-+    case OPTION_DISABLE_RELOC_SECTION:
-+      pep_dll_enable_reloc_section = 0;
-+      /* fall through */
-+    case OPTION_NO_DYNAMIC_BASE:
-+      pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE;
-+      /* fall through */
-+    case OPTION_NO_HIGH_ENTROPY_VA:
-+      pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA;
-+      break;
-     case OPTION_FORCE_INTEGRITY:
-       pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY;
-       break;
-     case OPTION_NX_COMPAT:
-       pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
-       break;
-+    case OPTION_NO_NX_COMPAT:
-+      pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
-+      break;
-     case OPTION_NO_ISOLATION:
-       pe_dll_characteristics |= IMAGE_DLLCHARACTERISTICS_NO_ISOLATION;
-       break;
diff --git a/contrib/guix/patches/elfsteem-value-error-python-39.patch b/contrib/guix/patches/elfsteem-value-error-python-39.patch
new file mode 100644
index 0000000000..21e1228afd
--- /dev/null
+++ b/contrib/guix/patches/elfsteem-value-error-python-39.patch
@@ -0,0 +1,13 @@
+diff --git a/examples/otool.py b/examples/otool.py
+index 2b8efc0..d797b2e 100755
+--- a/examples/otool.py
++++ b/examples/otool.py
+@@ -342,7 +342,7 @@ if __name__ == '__main__':
+         try:
+             e = macho_init.MACHO(raw,
+                 parseSymbols = False)
+-        except ValueError, err:
++        except ValueError as err:
+             print("%s:" %file)
+             print("    %s" % err)
+             continue
diff --git a/contrib/guix/patches/gcc-8-sort-libtool-find-output.patch b/contrib/guix/patches/gcc-8-sort-libtool-find-output.patch
deleted file mode 100644
index f327c464f3..0000000000
--- a/contrib/guix/patches/gcc-8-sort-libtool-find-output.patch
+++ /dev/null
@@ -1,400 +0,0 @@
-guix: repro: Sort find output in libtool for gcc-8
-
-Otherwise the resulting .a static libraries (e.g. libstdc++.a) will not
-be reproducible and end up making the Bitcoin binaries non-reproducible
-as well.
-
-See: https://reproducible-builds.org/docs/archives/#gnu-libtool
-
-diff --git a/gcc/configure b/gcc/configure
-index 97ba7d7d69c..e37a96f0c0c 100755
---- a/gcc/configure
-+++ b/gcc/configure
-@@ -19720,20 +19720,20 @@ if test -z "$aix_libpath"; then aix_libpath="/usr/lib:/lib"; fi
- 	      prelink_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
--		compile_command="$compile_command `find $tpldir -name \*.o | $NL2SP`"'
-+		compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"'
- 	      old_archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
--		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | $NL2SP`~
-+		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~
- 		$RANLIB $oldlib'
- 	      archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
- 	      archive_expsym_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
- 	      ;;
- 	    *) # Version 6 and above use weak symbols
- 	      archive_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-diff --git a/libcc1/configure b/libcc1/configure
-index f53a121611c..5740ca90cab 100755
---- a/libcc1/configure
-+++ b/libcc1/configure
-@@ -12221,20 +12221,20 @@ if test -z "$aix_libpath"; then aix_libpath="/usr/lib:/lib"; fi
- 	      prelink_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
--		compile_command="$compile_command `find $tpldir -name \*.o | $NL2SP`"'
-+		compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"'
- 	      old_archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
--		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | $NL2SP`~
-+		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~
- 		$RANLIB $oldlib'
- 	      archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
- 	      archive_expsym_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
- 	      ;;
- 	    *) # Version 6 and above use weak symbols
- 	      archive_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-diff --git a/libffi/configure b/libffi/configure
-index 790a291011f..54b1ac18306 100755
---- a/libffi/configure
-+++ b/libffi/configure
-@@ -12661,20 +12661,20 @@ if test -z "$aix_libpath"; then aix_libpath="/usr/lib:/lib"; fi
- 	      prelink_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
--		compile_command="$compile_command `find $tpldir -name \*.o | $NL2SP`"'
-+		compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"'
- 	      old_archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
--		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | $NL2SP`~
-+		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~
- 		$RANLIB $oldlib'
- 	      archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
- 	      archive_expsym_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
- 	      ;;
- 	    *) # Version 6 and above use weak symbols
- 	      archive_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-diff --git a/libgo/config/libtool.m4 b/libgo/config/libtool.m4
-index f7005947454..8a84417b828 100644
---- a/libgo/config/libtool.m4
-+++ b/libgo/config/libtool.m4
-@@ -6010,20 +6010,20 @@ if test "$_lt_caught_CXX_error" != yes; then
- 	      _LT_TAGVAR(prelink_cmds, $1)='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
--		compile_command="$compile_command `find $tpldir -name \*.o | $NL2SP`"'
-+		compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"'
- 	      _LT_TAGVAR(old_archive_cmds, $1)='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
--		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | $NL2SP`~
-+		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~
- 		$RANLIB $oldlib'
- 	      _LT_TAGVAR(archive_cmds, $1)='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
- 	      _LT_TAGVAR(archive_expsym_cmds, $1)='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
- 	      ;;
- 	    *) # Version 6 and above use weak symbols
- 	      _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-diff --git a/libgo/config/ltmain.sh b/libgo/config/ltmain.sh
-index ce66b44906a..0f81c401407 100644
---- a/libgo/config/ltmain.sh
-+++ b/libgo/config/ltmain.sh
-@@ -2917,7 +2917,7 @@ func_extract_archives ()
- 	    darwin_file=
- 	    darwin_files=
- 	    for darwin_file in $darwin_filelist; do
--	      darwin_files=`find unfat-$$ -name $darwin_file -print | $NL2SP`
-+	      darwin_files=`find unfat-$$ -name $darwin_file -print | sort | $NL2SP`
- 	      $LIPO -create -output "$darwin_file" $darwin_files
- 	    done # $darwin_filelist
- 	    $RM -rf unfat-$$
-@@ -2932,7 +2932,7 @@ func_extract_archives ()
-         func_extract_an_archive "$my_xdir" "$my_xabs"
- 	;;
-       esac
--      my_oldobjs="$my_oldobjs "`find $my_xdir -name \*.$objext -print -o -name \*.lo -print | $NL2SP`
-+      my_oldobjs="$my_oldobjs "`find $my_xdir -name \*.$objext -print -o -name \*.lo -print | sort | $NL2SP`
-     done
- 
-     func_extract_archives_result="$my_oldobjs"
-diff --git a/libhsail-rt/configure b/libhsail-rt/configure
-index a4fcc10c1f9..8e671229fcd 100755
---- a/libhsail-rt/configure
-+++ b/libhsail-rt/configure
-@@ -12244,20 +12244,20 @@ if test -z "$aix_libpath"; then aix_libpath="/usr/lib:/lib"; fi
- 	      prelink_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
--		compile_command="$compile_command `find $tpldir -name \*.o | $NL2SP`"'
-+		compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"'
- 	      old_archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
--		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | $NL2SP`~
-+		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~
- 		$RANLIB $oldlib'
- 	      archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
- 	      archive_expsym_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
- 	      ;;
- 	    *) # Version 6 and above use weak symbols
- 	      archive_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-diff --git a/libitm/configure b/libitm/configure
-index dbf386db434..29d4f10611f 100644
---- a/libitm/configure
-+++ b/libitm/configure
-@@ -13067,20 +13067,20 @@ if test -z "$aix_libpath"; then aix_libpath="/usr/lib:/lib"; fi
- 	      prelink_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
--		compile_command="$compile_command `find $tpldir -name \*.o | $NL2SP`"'
-+		compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"'
- 	      old_archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
--		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | $NL2SP`~
-+		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~
- 		$RANLIB $oldlib'
- 	      archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
- 	      archive_expsym_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
- 	      ;;
- 	    *) # Version 6 and above use weak symbols
- 	      archive_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-diff --git a/liboffloadmic/configure b/liboffloadmic/configure
-index f873716991b..7aa9186b10e 100644
---- a/liboffloadmic/configure
-+++ b/liboffloadmic/configure
-@@ -12379,20 +12379,20 @@ if test -z "$aix_libpath"; then aix_libpath="/usr/lib:/lib"; fi
- 	      prelink_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
--		compile_command="$compile_command `find $tpldir -name \*.o | $NL2SP`"'
-+		compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"'
- 	      old_archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
--		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | $NL2SP`~
-+		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~
- 		$RANLIB $oldlib'
- 	      archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
- 	      archive_expsym_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
- 	      ;;
- 	    *) # Version 6 and above use weak symbols
- 	      archive_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-diff --git a/liboffloadmic/plugin/configure b/liboffloadmic/plugin/configure
-index c031eb3e7fa..67fc7368f21 100644
---- a/liboffloadmic/plugin/configure
-+++ b/liboffloadmic/plugin/configure
-@@ -12086,20 +12086,20 @@ if test -z "$aix_libpath"; then aix_libpath="/usr/lib:/lib"; fi
- 	      prelink_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
--		compile_command="$compile_command `find $tpldir -name \*.o | $NL2SP`"'
-+		compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"'
- 	      old_archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
--		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | $NL2SP`~
-+		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~
- 		$RANLIB $oldlib'
- 	      archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
- 	      archive_expsym_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
- 	      ;;
- 	    *) # Version 6 and above use weak symbols
- 	      archive_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-diff --git a/libsanitizer/configure b/libsanitizer/configure
-index 4695bc7d4f7..cb7d25c07e6 100755
---- a/libsanitizer/configure
-+++ b/libsanitizer/configure
-@@ -13308,20 +13308,20 @@ if test -z "$aix_libpath"; then aix_libpath="/usr/lib:/lib"; fi
- 	      prelink_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
--		compile_command="$compile_command `find $tpldir -name \*.o | $NL2SP`"'
-+		compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"'
- 	      old_archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
--		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | $NL2SP`~
-+		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~
- 		$RANLIB $oldlib'
- 	      archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
- 	      archive_expsym_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
- 	      ;;
- 	    *) # Version 6 and above use weak symbols
- 	      archive_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-diff --git a/libstdc++-v3/configure b/libstdc++-v3/configure
-index 61457e940ec..21ef1f61e41 100755
---- a/libstdc++-v3/configure
-+++ b/libstdc++-v3/configure
-@@ -13087,20 +13087,20 @@ if test -z "$aix_libpath"; then aix_libpath="/usr/lib:/lib"; fi
- 	      prelink_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
--		compile_command="$compile_command `find $tpldir -name \*.o | $NL2SP`"'
-+		compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"'
- 	      old_archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
--		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | $NL2SP`~
-+		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~
- 		$RANLIB $oldlib'
- 	      archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
- 	      archive_expsym_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
- 	      ;;
- 	    *) # Version 6 and above use weak symbols
- 	      archive_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-diff --git a/libtool.m4 b/libtool.m4
-index 24d13f34409..940faaa161d 100644
---- a/libtool.m4
-+++ b/libtool.m4
-@@ -6005,20 +6005,20 @@ if test "$_lt_caught_CXX_error" != yes; then
- 	      _LT_TAGVAR(prelink_cmds, $1)='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
--		compile_command="$compile_command `find $tpldir -name \*.o | $NL2SP`"'
-+		compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"'
- 	      _LT_TAGVAR(old_archive_cmds, $1)='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
--		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | $NL2SP`~
-+		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~
- 		$RANLIB $oldlib'
- 	      _LT_TAGVAR(archive_cmds, $1)='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
- 	      _LT_TAGVAR(archive_expsym_cmds, $1)='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
- 	      ;;
- 	    *) # Version 6 and above use weak symbols
- 	      _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-diff --git a/libvtv/configure b/libvtv/configure
-index a197f750453..31ab3a0637b 100755
---- a/libvtv/configure
-+++ b/libvtv/configure
-@@ -13339,20 +13339,20 @@ if test -z "$aix_libpath"; then aix_libpath="/usr/lib:/lib"; fi
- 	      prelink_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $objs $libobjs $compile_deplibs~
--		compile_command="$compile_command `find $tpldir -name \*.o | $NL2SP`"'
-+		compile_command="$compile_command `find $tpldir -name \*.o | sort | $NL2SP`"'
- 	      old_archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $oldobjs$old_deplibs~
--		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | $NL2SP`~
-+		$AR $AR_FLAGS $oldlib$oldobjs$old_deplibs `find $tpldir -name \*.o | sort | $NL2SP`~
- 		$RANLIB $oldlib'
- 	      archive_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
- 	      archive_expsym_cmds_CXX='tpldir=Template.dir~
- 		rm -rf $tpldir~
- 		$CC --prelink_objects --instantiation_dir $tpldir $predep_objects $libobjs $deplibs $convenience $postdep_objects~
--		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
-+		$CC -shared $pic_flag $predep_objects $libobjs $deplibs `find $tpldir -name \*.o | sort | $NL2SP` $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname ${wl}-retain-symbols-file ${wl}$export_symbols -o $lib'
- 	      ;;
- 	    *) # Version 6 and above use weak symbols
- 	      archive_cmds_CXX='$CC -shared $pic_flag $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags ${wl}-soname ${wl}$soname -o $lib'
-diff --git a/ltmain.sh b/ltmain.sh
-index 9503ec85d70..79f9ba89af5 100644
---- a/ltmain.sh
-+++ b/ltmain.sh
-@@ -2917,7 +2917,7 @@ func_extract_archives ()
- 	    darwin_file=
- 	    darwin_files=
- 	    for darwin_file in $darwin_filelist; do
--	      darwin_files=`find unfat-$$ -name $darwin_file -print | $NL2SP`
-+	      darwin_files=`find unfat-$$ -name $darwin_file -print | sort | $NL2SP`
- 	      $LIPO -create -output "$darwin_file" $darwin_files
- 	    done # $darwin_filelist
- 	    $RM -rf unfat-$$
-@@ -2932,7 +2932,7 @@ func_extract_archives ()
-         func_extract_an_archive "$my_xdir" "$my_xabs"
- 	;;
-       esac
--      my_oldobjs="$my_oldobjs "`find $my_xdir -name \*.$objext -print -o -name \*.lo -print | $NL2SP`
-+      my_oldobjs="$my_oldobjs "`find $my_xdir -name \*.$objext -print -o -name \*.lo -print | sort | $NL2SP`
-     done
- 
-     func_extract_archives_result="$my_oldobjs"
diff --git a/contrib/guix/patches/nsis-SConstruct-sde-support.patch b/contrib/guix/patches/nsis-SConstruct-sde-support.patch
deleted file mode 100644
index f58406a7a0..0000000000
--- a/contrib/guix/patches/nsis-SConstruct-sde-support.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-https://github.com/kichik/nsis/pull/13
-https://sourceforge.net/p/nsis/code/7248/
-
-diff --git a/SConstruct b/SConstruct
-index e8252c9..41786f2 100755
---- a/SConstruct
-+++ b/SConstruct
-@@ -95,8 +95,8 @@ default_doctype = 'html'
- if defenv.WhereIs('hhc', os.environ['PATH']):
- 	default_doctype = 'chm'
- 
--from time import strftime, gmtime
--cvs_version = strftime('%d-%b-%Y.cvs', gmtime())
-+import time
-+cvs_version = time.strftime('%d-%b-%Y.cvs', time.gmtime(int(os.environ.get('SOURCE_DATE_EPOCH', time.time()))))
- 
- opts = Variables()
- 
diff --git a/contrib/guix/patches/nsis-gcc-10-memmove.patch b/contrib/guix/patches/nsis-gcc-10-memmove.patch
new file mode 100644
index 0000000000..a1aadfd4f3
--- /dev/null
+++ b/contrib/guix/patches/nsis-gcc-10-memmove.patch
@@ -0,0 +1,23 @@
+commit f6df41524e703dc471e283e566a48e05a735b7f2
+Author: Anders <anders_k@users.sourceforge.net>
+Date:   Sat Jun 27 23:18:45 2020 +0000
+
+    Don't let GCC 10 generate memmove calls (bug #1248)
+    
+    git-svn-id: https://svn.code.sf.net/p/nsis/code/NSIS/trunk@7189 212acab6-be3b-0410-9dea-997c60f758d6
+
+diff --git a/SCons/Config/gnu b/SCons/Config/gnu
+index bfcb362d..21fa446b 100644
+--- a/SCons/Config/gnu
++++ b/SCons/Config/gnu
+@@ -103,6 +103,10 @@ stub_env.Append(LINKFLAGS = ['$NODEFLIBS_FLAG'])    # no standard libraries
+ stub_env.Append(LINKFLAGS = ['$ALIGN_FLAG'])        # 512 bytes align
+ stub_env.Append(LINKFLAGS = ['$MAP_FLAG'])          # generate map file
+ 
++conf = FlagsConfigure(stub_env)
++conf.CheckCompileFlag('-fno-tree-loop-distribute-patterns')  # GCC 10: Don't generate msvcrt!memmove calls (bug #1248)
++conf.Finish()
++
+ stub_uenv = stub_env.Clone()
+ stub_uenv.Append(CPPDEFINES = ['_UNICODE', 'UNICODE'])
+