aboutsummaryrefslogtreecommitdiff
path: root/contrib/guix/manifest.scm
AgeCommit message (Collapse)Author
2022-04-13guix: fix GCC 10.3.0 + mingw-w64 setjmp/longjmp issuesfanquake
This commit backports a patch to the GCC 10.3.0 we build for Windows cross-compilation in Guix. The commit has been backported to the GCC releases/gcc-10 branch, but hasn't yet made it into a release. The patch corrects a regression from an earlier GCC commit, see: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=357c4350680bf29f0c7a115424e3da11c53b5582 and https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=074226d5aa86cd3de517014acfe34c7f69a2ccc7, related to the way newer versions of mingw-w64 implement setjmp/longjmp. Ultimately this was causing a crash for us when Windows users were viewing the network traffic tab inside the GUI. After some period, long enough that a buffer would need reallocating, a call into FreeTypes gray_record_cell() would result in a call to ft_longjmp (longjmp), which would then trigger a crash. Fixes: https://github.com/bitcoin-core/gui/issues/582. See also: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=e8d1ca7d2c344a411779892616c423e157f4aea8. https://bugreports.qt.io/browse/QTBUG-93476.
2022-04-01guix: fix vmov alignment issues with gcc 10.3.0 & mingw-w64fanquake
This introduces a patch to our GCC (10.3.0) mingw-w64 compiler, in Guix, to make it avoid using aligned vmov instructions. This works around a longstanding issue in GCC, https://gcc.gnu.org/bugzilla/show_bug.cgi?id=54412, which was recently discovered to be causing issues, see #24726. Note that distros like Debian are also patching around this issue, and that is where this patch comes from. This would also explain why we haven't run into this problem earlier, in development builds. See: https://salsa.debian.org/mingw-w64-team/gcc-mingw-w64/-/blob/master/debian/patches/vmov-alignment.patch. Fixes #24726. Alternative to #24727. See also: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=939559
2022-03-28contrib: use LIEF 0.12.0 for symbol and security checksfanquake
2022-03-24Merge bitcoin/bitcoin#24599: guix: remove mingw-w64 std::filesystem workaroundfanquake
946b86cf573530f355707bcf6af10beae34a83b8 Revert "build: Fix gcc-cross-x86_64-w64-mingw32-10.3.0 in Guix" (fanquake) 682962d9f642d1ec5ed56cd7ffc5085d14d3e06b guix: point to latest upstream commit (fanquake) Pull request description: Now that https://issues.guix.gnu.org/54212 has been merged upstream, we can bump our time-machine, and then no-longer need to maintain a workaround to use `std::filesystem` for Windows builds. Guix build on `x86_64`: ```bash 8edd06c2dbd4533c9f1b0e445cda1c2692b7d5e28e9d4c9262100dc1b4160448 guix-build-946b86cf5735/output/aarch64-linux-gnu/SHA256SUMS.part aca0eb632d73d08272a76837a9d15ab6df602cc95fd8d67d459881c823531816 guix-build-946b86cf5735/output/aarch64-linux-gnu/bitcoin-946b86cf5735-aarch64-linux-gnu-debug.tar.gz 5795e2893a81d2a260e7290a9204e63f78e7994cae54277a0ae952fd977108b3 guix-build-946b86cf5735/output/aarch64-linux-gnu/bitcoin-946b86cf5735-aarch64-linux-gnu.tar.gz 90dc12f37f9b66a553be3251374da04f022fd98a871a8d0b122f69ff4fdc5a3d guix-build-946b86cf5735/output/arm-linux-gnueabihf/SHA256SUMS.part d03dbb12963328afe050c212dac6c42f5f34ce6f36d5a22f6b262ed17acd00fa guix-build-946b86cf5735/output/arm-linux-gnueabihf/bitcoin-946b86cf5735-arm-linux-gnueabihf-debug.tar.gz d02cac8b56285bec488d3f4ac92174ee1a25a3f75d069a9e54a872905fcab311 guix-build-946b86cf5735/output/arm-linux-gnueabihf/bitcoin-946b86cf5735-arm-linux-gnueabihf.tar.gz 14122032ce024eec843552d6fb6eefad4eb849a0bfac1f7679f0723e7aa69d7d guix-build-946b86cf5735/output/arm64-apple-darwin/SHA256SUMS.part a2392b37cde87f1a9db599197e7516f31024b88e86699a6bdc9bc0e95edcd450 guix-build-946b86cf5735/output/arm64-apple-darwin/bitcoin-946b86cf5735-arm64-apple-darwin-unsigned.dmg 8b3596ff5dda6f978f7d19ed33b29357226f17449db65058676b911d110b2fb8 guix-build-946b86cf5735/output/arm64-apple-darwin/bitcoin-946b86cf5735-arm64-apple-darwin-unsigned.tar.gz 94baa2dae8c7b920fdd3e78097084c4550cb9441769b851924671265b032724b guix-build-946b86cf5735/output/arm64-apple-darwin/bitcoin-946b86cf5735-arm64-apple-darwin.tar.gz ee13d5669928c2d09e1091871c3e1a4e4fe7e2aa76ef0cfb472cac26fe304372 guix-build-946b86cf5735/output/dist-archive/bitcoin-946b86cf5735.tar.gz b757ff56eb2b4b6c07ea1b784a5d72e2d6dce53a6b15068e6b10beb101068d9b guix-build-946b86cf5735/output/powerpc64-linux-gnu/SHA256SUMS.part b6f29f9a3d1e78e37a56da3a98fd74037a622070f8d5f3e677db3714f2f0ab90 guix-build-946b86cf5735/output/powerpc64-linux-gnu/bitcoin-946b86cf5735-powerpc64-linux-gnu-debug.tar.gz fa575269b25154ad9d258bfe4c89d9c083d199084229a9c2c44235d22e0499de guix-build-946b86cf5735/output/powerpc64-linux-gnu/bitcoin-946b86cf5735-powerpc64-linux-gnu.tar.gz ee73c68dfa2923da17553aee26e9c26c1e9b5ecfae0f032e6cac56f951ea7353 guix-build-946b86cf5735/output/powerpc64le-linux-gnu/SHA256SUMS.part 9eb4d47506765b7d2e93cdf1ef5e53a2f53e22a318cbd7d5d7a9f97de292e2e7 guix-build-946b86cf5735/output/powerpc64le-linux-gnu/bitcoin-946b86cf5735-powerpc64le-linux-gnu-debug.tar.gz 5541f70c5d5e935d5c71e2aef3995e0df76202782d296b81c692c05250d3ba6c guix-build-946b86cf5735/output/powerpc64le-linux-gnu/bitcoin-946b86cf5735-powerpc64le-linux-gnu.tar.gz 46dbe4710fbb962a8a8c8a2d60e3fd7a53fc0ea47096f776de9b2d865b6dcd99 guix-build-946b86cf5735/output/riscv64-linux-gnu/SHA256SUMS.part 3dbcb703d699e400a6d23082e545e52ac6d3100d54bf0f544216940c0f336e24 guix-build-946b86cf5735/output/riscv64-linux-gnu/bitcoin-946b86cf5735-riscv64-linux-gnu-debug.tar.gz b2dc20a418192478e9b892dcaec982bf23899a5742bb33791ed9e621d4b2bd87 guix-build-946b86cf5735/output/riscv64-linux-gnu/bitcoin-946b86cf5735-riscv64-linux-gnu.tar.gz a25c379f2c81be647491b10fa50486c780bf0096f437e4db351d32ccf235ad7d guix-build-946b86cf5735/output/x86_64-apple-darwin/SHA256SUMS.part c017523424767593daaf4037598683ffa360c4142df4986b9548e42b125587a5 guix-build-946b86cf5735/output/x86_64-apple-darwin/bitcoin-946b86cf5735-x86_64-apple-darwin-unsigned.dmg a6e1e5bb358ec7f8f4f5289225ea07f6d3bef417da90756c7eb748a2e9a9276d guix-build-946b86cf5735/output/x86_64-apple-darwin/bitcoin-946b86cf5735-x86_64-apple-darwin-unsigned.tar.gz 95283762bafa08106c841cb43a19b18a541fdae7cb759f13a2e9bf81ac24b176 guix-build-946b86cf5735/output/x86_64-apple-darwin/bitcoin-946b86cf5735-x86_64-apple-darwin.tar.gz 56876f95dc4ce82b35f1206ef4093962431887f5a0eac28abfbfdacab68b55f7 guix-build-946b86cf5735/output/x86_64-linux-gnu/SHA256SUMS.part 8305d7b92b30fd8a14ea44459d673c077ec8971aeaa79cb6331c4f9fccd51f0f guix-build-946b86cf5735/output/x86_64-linux-gnu/bitcoin-946b86cf5735-x86_64-linux-gnu-debug.tar.gz a6f1e12fd15e0eb6ef8e1182ecf564b587a0d2b77f799570bdcbad747617d202 guix-build-946b86cf5735/output/x86_64-linux-gnu/bitcoin-946b86cf5735-x86_64-linux-gnu.tar.gz 79cd3e1b9a6cbb06bb19f24cb03d02a5e87f1c96c42648d0397bf6edca912114 guix-build-946b86cf5735/output/x86_64-w64-mingw32/SHA256SUMS.part c119dd7bebfd76d9692c37efa150862feb98256a1ec6e2fcedf85dbaf185a47d guix-build-946b86cf5735/output/x86_64-w64-mingw32/bitcoin-946b86cf5735-win64-debug.zip a48af7b53c9c863ced4d7b9864f91f4f4a54cc63275858427fb7636f90f464fe guix-build-946b86cf5735/output/x86_64-w64-mingw32/bitcoin-946b86cf5735-win64-setup-unsigned.exe 2ebd813a39299a687f4cfd0e60b76808f9e8fee5a60a16e84148d3f0b3da6128 guix-build-946b86cf5735/output/x86_64-w64-mingw32/bitcoin-946b86cf5735-win64-unsigned.tar.gz c628444e07c18ff13db76cb5a51386d77be8135ca7fe80a4d1b97b07e4f34baf guix-build-946b86cf5735/output/x86_64-w64-mingw32/bitcoin-946b86cf5735-win64.zip ``` Guix build on `aarch64`: ```bash 83f7387975d043e29a994d4d8e9bbdd65c8ba2002a1ca97fe76a61ad2333d37e guix-build-946b86cf5735/output/arm-linux-gnueabihf/SHA256SUMS.part 8791579ecc7c0799bd53be7c0bdab18eb4bae2fb06ed41d0aa77e28ee0dde487 guix-build-946b86cf5735/output/arm-linux-gnueabihf/bitcoin-946b86cf5735-arm-linux-gnueabihf-debug.tar.gz 28d6a41d7ccb88197ef75e1e83d202a0a11caefde3a6f86ed9186d9e19c2c682 guix-build-946b86cf5735/output/arm-linux-gnueabihf/bitcoin-946b86cf5735-arm-linux-gnueabihf.tar.gz 0c34bfb74a3ff7b2f69967e00ac02af145b7af3f539e7b5f817e8453b49efdb8 guix-build-946b86cf5735/output/arm64-apple-darwin/SHA256SUMS.part 57357182b3630fa7b02cefab2b662944d2f226d8c739f934fd15e669b11de01a guix-build-946b86cf5735/output/arm64-apple-darwin/bitcoin-946b86cf5735-arm64-apple-darwin-unsigned.dmg f5d761f3b5d98c830ec7247ad2ec42e9d6fbe723539b0c47f4a91c2e8a7214c7 guix-build-946b86cf5735/output/arm64-apple-darwin/bitcoin-946b86cf5735-arm64-apple-darwin-unsigned.tar.gz fb2ab7cfc7a9f01b1507ec08775ac8f7267cfbeb28d13f4b62f15cbd81ef15fe guix-build-946b86cf5735/output/arm64-apple-darwin/bitcoin-946b86cf5735-arm64-apple-darwin.tar.gz ee13d5669928c2d09e1091871c3e1a4e4fe7e2aa76ef0cfb472cac26fe304372 guix-build-946b86cf5735/output/dist-archive/bitcoin-946b86cf5735.tar.gz a269e7ef2bac18e7bbdf8488023fa1dd202d5b7cd18f4127b122b9fa82cd9317 guix-build-946b86cf5735/output/powerpc64-linux-gnu/SHA256SUMS.part 9b5ad80352b9d211dd8e3b2d7ac5b304a83aaaa43e54a96f4ec6e130d37415e5 guix-build-946b86cf5735/output/powerpc64-linux-gnu/bitcoin-946b86cf5735-powerpc64-linux-gnu-debug.tar.gz 4b7c09ebe7b729957f345629acb8ce0c3966ed17d8a4cc3da6401100dd29c05b guix-build-946b86cf5735/output/powerpc64-linux-gnu/bitcoin-946b86cf5735-powerpc64-linux-gnu.tar.gz abc357d83966bf3f2dba201786b315cf673da197c1e3e2ee56e99e5e44df32a6 guix-build-946b86cf5735/output/powerpc64le-linux-gnu/SHA256SUMS.part d057eb88fb33363345026e2fe39881dff65c06cd1266427ef018befa4f21d5a7 guix-build-946b86cf5735/output/powerpc64le-linux-gnu/bitcoin-946b86cf5735-powerpc64le-linux-gnu-debug.tar.gz 9067057d983ed79acaf252fc7ca8cbe89dbad92280a95f079a417a20a7fe1f83 guix-build-946b86cf5735/output/powerpc64le-linux-gnu/bitcoin-946b86cf5735-powerpc64le-linux-gnu.tar.gz cd05ef28fbaad0512edc012a124f32079b8fe831d7c7882f0f8a754756712bc3 guix-build-946b86cf5735/output/riscv64-linux-gnu/SHA256SUMS.part 2dcdb32faa687ed14956338c4876ea2a4a113c52cdf835eb4e66cbcd98e6ebdc guix-build-946b86cf5735/output/riscv64-linux-gnu/bitcoin-946b86cf5735-riscv64-linux-gnu-debug.tar.gz 940c6404d506c353256018eea9b77560f618c75e1becae1ac262149b2f30d01a guix-build-946b86cf5735/output/riscv64-linux-gnu/bitcoin-946b86cf5735-riscv64-linux-gnu.tar.gz a980ef922b3af77ee7d9118b7db1d0893bdc1dbdf7c39d076f5dc4e368296447 guix-build-946b86cf5735/output/x86_64-apple-darwin/SHA256SUMS.part c017523424767593daaf4037598683ffa360c4142df4986b9548e42b125587a5 guix-build-946b86cf5735/output/x86_64-apple-darwin/bitcoin-946b86cf5735-x86_64-apple-darwin-unsigned.dmg 090479eecdd7169184f29009eb498dd498d504a4d642ae034ec82210cd08dca2 guix-build-946b86cf5735/output/x86_64-apple-darwin/bitcoin-946b86cf5735-x86_64-apple-darwin-unsigned.tar.gz 95283762bafa08106c841cb43a19b18a541fdae7cb759f13a2e9bf81ac24b176 guix-build-946b86cf5735/output/x86_64-apple-darwin/bitcoin-946b86cf5735-x86_64-apple-darwin.tar.gz a94a4ed02ff71ca6a5594cb3aed7f600cfacf40fa14ceb3dd8af6a251502bea4 guix-build-946b86cf5735/output/x86_64-linux-gnu/SHA256SUMS.part 04b1e08c5482b5fd37b360e2950775626838a7c2429bcceec3d082615b52c300 guix-build-946b86cf5735/output/x86_64-linux-gnu/bitcoin-946b86cf5735-x86_64-linux-gnu-debug.tar.gz 0e0d8260f3898a59e23878fc17f47e20af0b2e35f628196df3977ca53418ad19 guix-build-946b86cf5735/output/x86_64-linux-gnu/bitcoin-946b86cf5735-x86_64-linux-gnu.tar.gz 942aced6e2a6df3c0f31d2040db2a61b51b4014fc6530410eb5ece5a6b05f11d guix-build-946b86cf5735/output/x86_64-w64-mingw32/SHA256SUMS.part a8119d7db4dcde912dfff27d2690da0935e08a2996f0282715afd9ea7cde11f8 guix-build-946b86cf5735/output/x86_64-w64-mingw32/bitcoin-946b86cf5735-win64-debug.zip a48af7b53c9c863ced4d7b9864f91f4f4a54cc63275858427fb7636f90f464fe guix-build-946b86cf5735/output/x86_64-w64-mingw32/bitcoin-946b86cf5735-win64-setup-unsigned.exe 2ebd813a39299a687f4cfd0e60b76808f9e8fee5a60a16e84148d3f0b3da6128 guix-build-946b86cf5735/output/x86_64-w64-mingw32/bitcoin-946b86cf5735-win64-unsigned.tar.gz 7aa5627bb706654734525b7ef76736fe24b8f314e5a20f850ea6a0dca1559d1f guix-build-946b86cf5735/output/x86_64-w64-mingw32/bitcoin-946b86cf5735-win64.zip ``` ACKs for top commit: hebasto: ACK 946b86cf573530f355707bcf6af10beae34a83b8, I have reviewed the code and it looks OK, I agree it can be merged. Tree-SHA512: c0545440a61395eb2957c98da8d7987169e3b6a866279d56950e7ff19b7700a817937e0f66fea17aeb98e9092b7662bbd8a69446ae89b348e7b786e39951dba9
2022-03-24Merge bitcoin/bitcoin#24508: guix: Drop unneeded openssl dependency for ↵fanquake
signapple e857f0bb55b1cd119f1cface8476dcaddc7b6b2f guix: Drop unneeded openssl dependency for signapple (Hennadii Stepanov) Pull request description: `openssl` is not mentioned as a dependency in the https://github.com/achow101/signapple repo. #### GUIX builds on `x86_64`: ``` $ find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum 533f65e86f038ede9a665472279fc7569a3c9323c8c9c8f751ec1cb03d181638 guix-build-e857f0bb55b1/output/arm64-apple-darwin/SHA256SUMS.part 835b1b48d139f76213a7289d09bfa05e32d14a5351f8f9b6624059db5c621479 guix-build-e857f0bb55b1/output/arm64-apple-darwin/bitcoin-e857f0bb55b1-arm64-apple-darwin.tar.gz 076b385ec3aa21045a9d3269848ba20ec5e3150bf1e6a6a4f9cb940087588b72 guix-build-e857f0bb55b1/output/arm64-apple-darwin/bitcoin-e857f0bb55b1-osx-unsigned.dmg 9cd50f1fb66b817f76a7dda5db29cab1abe68a8eba5f0192c7e7350ebc160313 guix-build-e857f0bb55b1/output/arm64-apple-darwin/bitcoin-e857f0bb55b1-osx-unsigned.tar.gz af674d14f616526de8737cf79ab4f4dff81a9737bebf92fd45ebd17b99b560a1 guix-build-e857f0bb55b1/output/dist-archive/bitcoin-e857f0bb55b1.tar.gz ebea43c2fd7f7883055219c99c96bab5b77c82060d5e977de9be9639fe343cd8 guix-build-e857f0bb55b1/output/x86_64-apple-darwin/SHA256SUMS.part 9d4a93f1a82224b901fabe04081fa15e19692c91b5b53f17af5cab468b1185fe guix-build-e857f0bb55b1/output/x86_64-apple-darwin/bitcoin-e857f0bb55b1-osx-unsigned.dmg df3fc3644b4ce51a58b8f527594b5351af1b6f468d3dd929a901094bdec8adeb guix-build-e857f0bb55b1/output/x86_64-apple-darwin/bitcoin-e857f0bb55b1-osx-unsigned.tar.gz 7f665e8dcb485c71da70cfcff12547dfc801d09dae3133a5e79d5dba2e1b4048 guix-build-e857f0bb55b1/output/x86_64-apple-darwin/bitcoin-e857f0bb55b1-osx64.tar.gz ``` ACKs for top commit: laanwj: If only direct dependencies count, ACK e857f0bb55b1cd119f1cface8476dcaddc7b6b2f. achow101: ACK e857f0bb55b1cd119f1cface8476dcaddc7b6b2f Tree-SHA512: 333aab2d538a7e31ba057223f143810fe6f8f612cb3c36e80e78d51bcdad533918662f10909e215455b71ee8d87a18c623dfcf7763e2c6e55bd7f26ad510eaf4
2022-03-17Revert "build: Fix gcc-cross-x86_64-w64-mingw32-10.3.0 in Guix"fanquake
This reverts commit 7f2f35fe20c7706d547fa22a62521fe926f9c12b.
2022-03-16Update signapple for platform identifier fixAndrew Chow
2022-03-09guix: use latest signappleAndrew Chow
2022-03-09Merge bitcoin/bitcoin#24495: guix: only use native GCC 7 toolchain for Linux ↵fanquake
builds bb12870bac230960bbe2df35f579570e465d8ea4 guix: only use native GCC 7 toolchain for Linux builds (fanquake) Pull request description: The macOS and Windows builds do not require a GCC 7 toolchain, and this is actually causing build issues, i.e #24211. So switch to using a GCC 10 native toolchain for both. We can't switch to using a GCC 7+ native toolchain for Linux without patching around glibc build issues (something to look at for a future change). Fixes #24211. Guix Builds (on x86_64): ```bash bash-5.1# find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum 6fece1c8ed69bd724c76dfd768f03b1d43c9dfb1767f0fad743fb3e068ce8f7f guix-build-bb12870bac23/output/aarch64-linux-gnu/SHA256SUMS.part 555c1245581eff3013a2b56a3c7acb2923de9117dd5d108d4b7954e22f386dd1 guix-build-bb12870bac23/output/aarch64-linux-gnu/bitcoin-bb12870bac23-aarch64-linux-gnu-debug.tar.gz e8f10a3791a4245566dab8253b76dcac3354bdfad9b9575743e937b52e364494 guix-build-bb12870bac23/output/aarch64-linux-gnu/bitcoin-bb12870bac23-aarch64-linux-gnu.tar.gz c4339db89259e5a8e5666fc807c198a49162d500c2143f8a1dc86e6e7ca32bbc guix-build-bb12870bac23/output/arm-linux-gnueabihf/SHA256SUMS.part 6123682411cbb16bfa41d31cb4a9673744ad8c09b6f8586a4dfda08bc5f7a682 guix-build-bb12870bac23/output/arm-linux-gnueabihf/bitcoin-bb12870bac23-arm-linux-gnueabihf-debug.tar.gz 3dcd70f65dd3dfd7385ac6715244fb6c696257e622220310abae7279cbd2a3a4 guix-build-bb12870bac23/output/arm-linux-gnueabihf/bitcoin-bb12870bac23-arm-linux-gnueabihf.tar.gz 47c5235cce1e3e2e88a461e48e54a29dffb7ac0d8b57955f4e6977273af113f3 guix-build-bb12870bac23/output/arm64-apple-darwin/SHA256SUMS.part 3584eec693b82b1b4e81094132a9a5e3ebf4a72a3c3cfe9914f24da62c2e2014 guix-build-bb12870bac23/output/arm64-apple-darwin/bitcoin-bb12870bac23-arm64-apple-darwin.tar.gz 4a6e561abfc3f69e57a05fc278d75b6f58f82dec50b9b3acbf9745706be91d60 guix-build-bb12870bac23/output/arm64-apple-darwin/bitcoin-bb12870bac23-osx-unsigned.dmg 36a88bc090927493ed31635e1412dc01a81fb034d612c21ebb8b8602b7529ad2 guix-build-bb12870bac23/output/arm64-apple-darwin/bitcoin-bb12870bac23-osx-unsigned.tar.gz d77871d97198c521fc54cf4ea547c0ee723bfe94036bf40987837e529a59b4e9 guix-build-bb12870bac23/output/dist-archive/bitcoin-bb12870bac23.tar.gz b676ae5d37fdac267c82bcc57d76e25694f2ee2292f4d012648a0e496104f48d guix-build-bb12870bac23/output/powerpc64-linux-gnu/SHA256SUMS.part 00cad11e137030b1165437a91d4e9f2827b1abe54b5ff14709abeab0a33711b8 guix-build-bb12870bac23/output/powerpc64-linux-gnu/bitcoin-bb12870bac23-powerpc64-linux-gnu-debug.tar.gz e715686469924452e1d35b93a64aa1fe1a85f5592757e8c24feda03db821fc48 guix-build-bb12870bac23/output/powerpc64-linux-gnu/bitcoin-bb12870bac23-powerpc64-linux-gnu.tar.gz 20547e405ab88d84a228563ec7aaa965515b2714f65cc16f3288f8c885fe39db guix-build-bb12870bac23/output/powerpc64le-linux-gnu/SHA256SUMS.part 707d2f14a7b73cc73710297d4d8f1773864c27a5e44ef45a97c0437ce4b291e0 guix-build-bb12870bac23/output/powerpc64le-linux-gnu/bitcoin-bb12870bac23-powerpc64le-linux-gnu-debug.tar.gz 6930ddbb6d5aebfd901ec30ad68749338265d43b73ad11015a320af37620d6e9 guix-build-bb12870bac23/output/powerpc64le-linux-gnu/bitcoin-bb12870bac23-powerpc64le-linux-gnu.tar.gz 2af7a3a50622ed1b2b271b655b8319f1b34f605f97381a66ee4625c1864cc3e2 guix-build-bb12870bac23/output/riscv64-linux-gnu/SHA256SUMS.part 0e9e0878e446af7cd33782cf6d8a0cfb163b1ade7c87d5a6c6d7c315436bbb31 guix-build-bb12870bac23/output/riscv64-linux-gnu/bitcoin-bb12870bac23-riscv64-linux-gnu-debug.tar.gz 6c8994f11fadbfda8fc9c57deeaf67568b8368084c7959a56aabde89c99033d1 guix-build-bb12870bac23/output/riscv64-linux-gnu/bitcoin-bb12870bac23-riscv64-linux-gnu.tar.gz 5214d7276030ea9721b2f8ed715308d2e3bf46158ddc030c7aa6f40098e3bc9b guix-build-bb12870bac23/output/x86_64-apple-darwin/SHA256SUMS.part 5783948617c4b0f7b47642b0045d5c648318bfc454a5d93db1a7ccb066ed17e2 guix-build-bb12870bac23/output/x86_64-apple-darwin/bitcoin-bb12870bac23-osx-unsigned.dmg 3a26d5e127fd2a723601fe14855b49cdb39c6fe6f407ca0d84a833eac6e4f47d guix-build-bb12870bac23/output/x86_64-apple-darwin/bitcoin-bb12870bac23-osx-unsigned.tar.gz 92e341ec48c74a5a0a9b7af6665a400bb12f6b35b983f2c9f8fd1819e390b57e guix-build-bb12870bac23/output/x86_64-apple-darwin/bitcoin-bb12870bac23-osx64.tar.gz 056a78e9f0aaed10aa7d734746d3adb27bb8ea0856829e7fedd2cb02f1234c62 guix-build-bb12870bac23/output/x86_64-linux-gnu/SHA256SUMS.part 77a493b1e5409d422b2006d46bf9de1e151485fc65680e4d4dd07c28a0264c51 guix-build-bb12870bac23/output/x86_64-linux-gnu/bitcoin-bb12870bac23-x86_64-linux-gnu-debug.tar.gz ccef5699e8a6153dbf35deb35f9d63439a5ef19234b9923840fe23780d41a983 guix-build-bb12870bac23/output/x86_64-linux-gnu/bitcoin-bb12870bac23-x86_64-linux-gnu.tar.gz 0d64b0f1797f2b25eb7be65045f25b0297409250e8cc298a711a790b69534066 guix-build-bb12870bac23/output/x86_64-w64-mingw32/SHA256SUMS.part 471d48dd50c7f3a3ebffd68aceb7537613e581acc55ad5dd3c15e8095027c322 guix-build-bb12870bac23/output/x86_64-w64-mingw32/bitcoin-bb12870bac23-win-unsigned.tar.gz be7af6c54a52b58f696a9cabda21ec9c9748150b5874b21d4377199db7d70b7b guix-build-bb12870bac23/output/x86_64-w64-mingw32/bitcoin-bb12870bac23-win64-debug.zip d522c2b27638f99b6faacb7f478e4908cfc01ca86c71f17c34cbc395d47c4504 guix-build-bb12870bac23/output/x86_64-w64-mingw32/bitcoin-bb12870bac23-win64-setup-unsigned.exe 43a038525f2383fdb9ed7f0d0d709d7f353933f3bf066779bc27503282acc0c5 guix-build-bb12870bac23/output/x86_64-w64-mingw32/bitcoin-bb12870bac23-win64.zip ``` Guix Builds (on arm64 [skipping aarch64 HOST](https://github.com/bitcoin/bitcoin/issues/22458)): ```bash root@3b26b9608b88:/bitcoin# find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum 9da540efe1e32ea74c1da5b9d17436d4de75f5d2b370d09cfdb06b044b3c816a guix-build-bb12870bac23/output/arm-linux-gnueabihf/SHA256SUMS.part ade319778d571de3727600d2bbbccbdb35cdaa138f2a941e0be58d94899b2ce5 guix-build-bb12870bac23/output/arm-linux-gnueabihf/bitcoin-bb12870bac23-arm-linux-gnueabihf-debug.tar.gz 1bd1790c002a40b6db1378f5344e7e34df0cd0fd7f29dbe98db5397b52b9dde9 guix-build-bb12870bac23/output/arm-linux-gnueabihf/bitcoin-bb12870bac23-arm-linux-gnueabihf.tar.gz e457b5f6a30d713faa521969d2f8b56e3176f63c3e116c4d149b63f9fa0de80f guix-build-bb12870bac23/output/arm64-apple-darwin/SHA256SUMS.part 13f1b769c6af61ee4ef057f36715d63390c42ae29fae301f6cf65bdf644c6adf guix-build-bb12870bac23/output/arm64-apple-darwin/bitcoin-bb12870bac23-arm64-apple-darwin.tar.gz 278c0c1134aed42e575d8af2c328a26e88765f0b0686e06cea1c884bd821cd28 guix-build-bb12870bac23/output/arm64-apple-darwin/bitcoin-bb12870bac23-osx-unsigned.dmg 6b5602fe63b9fb546ba0897bf5563714fad83e4c3a0cb285ed4961ec1a5e488d guix-build-bb12870bac23/output/arm64-apple-darwin/bitcoin-bb12870bac23-osx-unsigned.tar.gz d77871d97198c521fc54cf4ea547c0ee723bfe94036bf40987837e529a59b4e9 guix-build-bb12870bac23/output/dist-archive/bitcoin-bb12870bac23.tar.gz 0292906278db266a67f5c780af12a2c91ec62007c6a72e6c8b37463701d838cb guix-build-bb12870bac23/output/powerpc64-linux-gnu/SHA256SUMS.part 83362d3d84b00674359df9300729e1a2b3cf14cf2b9b71b9bb46fe9610ab0e6d guix-build-bb12870bac23/output/powerpc64-linux-gnu/bitcoin-bb12870bac23-powerpc64-linux-gnu-debug.tar.gz 3d5a538d28ccb97a239da358d1390add1d20e4c4d89e873a29aed3f92728e532 guix-build-bb12870bac23/output/powerpc64-linux-gnu/bitcoin-bb12870bac23-powerpc64-linux-gnu.tar.gz 8eb7194b2019b5ddb12f88fee8a76d8923bd0883de817c3bf396ea16e5b0543e guix-build-bb12870bac23/output/powerpc64le-linux-gnu/SHA256SUMS.part 3ec4a6cff3c974a1603276e5d75bc398522d543b6f9770a74c9a7acf6dc79c82 guix-build-bb12870bac23/output/powerpc64le-linux-gnu/bitcoin-bb12870bac23-powerpc64le-linux-gnu-debug.tar.gz 5b5eeb539362d6664a007d4856b5779a55ab714a96134749b5cfe870a4b5a7f9 guix-build-bb12870bac23/output/powerpc64le-linux-gnu/bitcoin-bb12870bac23-powerpc64le-linux-gnu.tar.gz 3201f796777a9fc029dddc085489afcf14b68cf77b0511d3b52cc336fb58baad guix-build-bb12870bac23/output/riscv64-linux-gnu/SHA256SUMS.part a46286b4d94de7189c93682d37c8bd3910f5ca2f612fc939b6e8ff3e56a4feff guix-build-bb12870bac23/output/riscv64-linux-gnu/bitcoin-bb12870bac23-riscv64-linux-gnu-debug.tar.gz e88fd7b312879fd7dc254674532535a05efaeb7167145541440289d45ec9ba17 guix-build-bb12870bac23/output/riscv64-linux-gnu/bitcoin-bb12870bac23-riscv64-linux-gnu.tar.gz 31659aa39146ad25631cc2030b415bec6892fa9cffebfd8c6da2d9b0c552773b guix-build-bb12870bac23/output/x86_64-apple-darwin/SHA256SUMS.part 5783948617c4b0f7b47642b0045d5c648318bfc454a5d93db1a7ccb066ed17e2 guix-build-bb12870bac23/output/x86_64-apple-darwin/bitcoin-bb12870bac23-osx-unsigned.dmg 7a75daff1427fa8839f35ce84fda19c95a6c82365937dc67f988bc8853fc1948 guix-build-bb12870bac23/output/x86_64-apple-darwin/bitcoin-bb12870bac23-osx-unsigned.tar.gz 92e341ec48c74a5a0a9b7af6665a400bb12f6b35b983f2c9f8fd1819e390b57e guix-build-bb12870bac23/output/x86_64-apple-darwin/bitcoin-bb12870bac23-osx64.tar.gz bbc0c2fc3b142191ea5403095b9da1691073375b178e06eea68736c3a4b8477f guix-build-bb12870bac23/output/x86_64-linux-gnu/SHA256SUMS.part 121fc43297b045af7fbe3904a1df94ff55e4908344eb97d48e50091216ecfdc2 guix-build-bb12870bac23/output/x86_64-linux-gnu/bitcoin-bb12870bac23-x86_64-linux-gnu-debug.tar.gz b2fbab5153a52f82390c67e6a14187eb791a3f052cedca0183b81e939932618f guix-build-bb12870bac23/output/x86_64-linux-gnu/bitcoin-bb12870bac23-x86_64-linux-gnu.tar.gz 4ffca23b6d93ed888b7ac5a54eb1c06bd04f304f336361655033796f3117d145 guix-build-bb12870bac23/output/x86_64-w64-mingw32/SHA256SUMS.part 471d48dd50c7f3a3ebffd68aceb7537613e581acc55ad5dd3c15e8095027c322 guix-build-bb12870bac23/output/x86_64-w64-mingw32/bitcoin-bb12870bac23-win-unsigned.tar.gz b226fe0f139bc2c4773e67784fc928874cba2ec0322d5da9a60fe5e6fd440f95 guix-build-bb12870bac23/output/x86_64-w64-mingw32/bitcoin-bb12870bac23-win64-debug.zip d522c2b27638f99b6faacb7f478e4908cfc01ca86c71f17c34cbc395d47c4504 guix-build-bb12870bac23/output/x86_64-w64-mingw32/bitcoin-bb12870bac23-win64-setup-unsigned.exe a435f9e1637281a8c6b174ec5dbc729ae35cca64928a42e435d57fb3292b9f3f guix-build-bb12870bac23/output/x86_64-w64-mingw32/bitcoin-bb12870bac23-win64.zip ``` ACKs for top commit: dongcarl: Code Review ACK bb12870bac230960bbe2df35f579570e465d8ea4 hebasto: ACK bb12870bac230960bbe2df35f579570e465d8ea4, I have reviewed the code and it looks OK, I agree it can be merged. Tree-SHA512: 304d1e76b5e74e4f5a946ae29208d695f558891eca6e711c0cb528133896ceca2147f1cdc4c39e5155ef90652555c1e6de52efcb93f1124bf2dde8d9201b630d
2022-03-09guix: Drop unneeded openssl dependency for signappleHennadii Stepanov
2022-03-08guix: use latest upstream signapplefanquake
This should improve support for signing for M1 binaries.
2022-03-08guix: use latest upstream python-certvalidatorfanquake
This should also allow re-enabling previously failing tests.
2022-03-07guix: only use native GCC 7 toolchain for Linux buildsfanquake
The macOS and Windows builds do not require a GCC 7 toolchain, and this is actually causing build issues, i.e #24211. So switch to using a GCC 10 native toolchain for both.
2022-02-15build: Fix gcc-cross-x86_64-w64-mingw32-10.3.0 in GuixHennadii Stepanov
2022-01-26guix: use autoconf 2.71fanquake
This allows for building with newer targets, like arm64-apple-darwin, due to having a newer bundled config.guess and config.sub.
2022-01-20guix: ignore additioanl failing certvalidator testfanquake
====================================================================== ERROR: test_revocation_mode_soft (tests.test_validate.ValidateTests) ---------------------------------------------------------------------- Traceback (most recent call last): File "/tmp/guix-build-python-certvalidator-0.1-1.e5bdb4b.drv-0/source/tests/test_validate.py", line 85, in test_revocation_mode_soft validate_path(context, path) File "/tmp/guix-build-python-certvalidator-0.1-1.e5bdb4b.drv-0/source/tests/../certvalidator/validate.py", line 50, in validate_path return _validate_path(validation_context, path) File "/tmp/guix-build-python-certvalidator-0.1-1.e5bdb4b.drv-0/source/tests/../certvalidator/validate.py", line 358, in _validate_path raise PathValidationError(pretty_message( certvalidator.errors.PathValidationError: The path could not be validated because the end-entity certificate expired 2022-01-14 12:00:00Z
2022-01-05guix: use upstream python-requests (2.26.0)fanquake
Upstream python requests is now modern enough to be used as a dependency for signapple. Which requires requests>=2.25.1.
2022-01-05build: use python-asn1crypto from upstreamfanquake
It is the exact same package definition.
2022-01-05guix: use uptream nsis-x86_64fanquake
Our patch is now used upstream.
2022-01-05guix: use GCC 10 (over GCC 8) to build releasesfanquake
This currently points to the version-1.4.0 branch.
2022-01-02build: use a static .tiff for macOS .dmg over generatingfanquake
Co-authored-by: Pavol Rusnak <pavol@rusnak.io>
2021-07-15guix: Pin kernel header versionCarl Dong
- Use 4.19 for riscv64 (earliest LTS release w/ riscv64 support) - Use 4.9 for all others (second-oldest LTS release, released in combination with glibc glibc 2.24 in Debian stretch)
2021-07-07guix: Patch binutils to add security-related disable flagsCarl Dong
We use these flags in our test-security-check make target, but they are only available because debian patches them in. We can patch them in for our Guix builds so that we can check the sanity of our security/symbol checking suite before running them.
2021-07-01guix: Rebase toolchain on glibc 2.24 (2.27 for riscv64)Carl Dong
Support for riscv64 in glibc landed in 2.27 so it's unavoidable that we use 2.27. Running a Bitcoin build with toolchains based on 2.24 for platforms other than riscv64 seem to produce binaries which do not have 2.17 symbols. So use 2.24 since it's more recent and maintained by Debian Stretch.
2021-06-18Merge bitcoin/bitcoin#21871: scripts: add checks for minimum required OS ↵fanquake
versions aa80b5759dfa613780a99801641519dd78bb3eca scripts: check macOS SDK version is set (fanquake) c972345bacd0cb01371b3f00941e81dce16278e1 scripts: check minimum required Windows version is set (fanquake) 29615aef52d7f1a29a87a29dfe4d39bf0e9867f3 scripts: check minimum required macOS vesion is set (fanquake) 8732f7b6c92f9dcf37f3ab618e9daab0c52fc781 scripts: LIEF 0.11.5 (fanquake) Pull request description: macOS: We use a compile flag ([-mmacosx-version-min=10.14](https://github.com/bitcoin/bitcoin/blob/master/depends/hosts/darwin.mk#L96)) to set the minimum required version of macOS needed to run our binaries. This adds a sanity check that the version is being set as expected. Clangs Darwin driver should infer the SDK version used during compilation, and forward that through to the linker. Add a check that this has been done, and the expected SDK version is set. Should help prevent issues like #21771 in future. Windows: We use linker flags ([-Wl,--major/minor-subsystem-version](https://github.com/bitcoin/bitcoin/blob/master/configure.ac#L683)) to set the minimum required version of Windows needed to run our binaries. This adds a sanity check that the version is being set as expected. Gitian builds: ```bash # macOS: 8b6fcd61d75001c37b2af3fceb5ae09f5d2fe85e97d361f684214bd91c27954a bitcoin-f015e1c2cac9-osx-unsigned.dmg 3c1e412bc7f5a7a5d0f78e2cd84b7096831414e1304c1307211aa3e135d89bbf bitcoin-f015e1c2cac9-osx-unsigned.tar.gz 50b7b2804e8481f63c69c78e3e8a71c0d811bf2db8895dd6d3edae9c46a738ae bitcoin-f015e1c2cac9-osx64.tar.gz fe6b5c0a550096b76b6727efee30e85b60163a41c83f21868c849fdd9876b675 src/bitcoin-f015e1c2cac9.tar.gz 8a20f21b20673dfc8c23e22b20ae0839bcaf65bf0e02f62381cdf5e7922936f0 bitcoin-core-osx-22-res.yml # Windows: b01fcdc2a5673387050d6c6c4f96f1d350976a121155fde3f76c2af309111f9d bitcoin-f015e1c2cac9-win-unsigned.tar.gz b95bdcbef638804030671d2332d58011f8c4ed4c1db87d6ffd211515c32c9d02 bitcoin-f015e1c2cac9-win64-debug.zip 350bf180252d24a3d40f05e22398fec7bb00e06d812204eb5a421100a8e10638 bitcoin-f015e1c2cac9-win64-setup-unsigned.exe 2730ddabe246d99913c9a779e97edcadb2d55309933d46f1dffd0d23ecf9aae5 bitcoin-f015e1c2cac9-win64.zip fe6b5c0a550096b76b6727efee30e85b60163a41c83f21868c849fdd9876b675 src/bitcoin-f015e1c2cac9.tar.gz aa60d7a753e8cb2d4323cfbbf4d964ad3645e74c918cccd66862888f8646d80f bitcoin-core-win-22-res.yml ``` ACKs for top commit: hebasto: ACK aa80b5759dfa613780a99801641519dd78bb3eca, tested by breaking tests: Tree-SHA512: 10150219910e8131715fbfe20edaa15778387616ef3bfe1a5152c7acd3958fe8f88c74961c3d3641074eb72824680c22764bb1dc01a19e92e946c2d4962a8d2c
2021-06-17Merge bitcoin/bitcoin#22182: guix: Overhaul how guix-{attest,verify} works ↵fanquake
and hierarchy e2c40a4ed5272d72fea997bd936fba28bb753226 guix-attest: Error out if SHA256SUMS is unexpected (Carl Dong) 4cc35daed557f38b080360a89036b2e97a6f78c2 Rewrite guix-{attest,verify} for new hier (Carl Dong) 28a9c9b83924f585b397f0f3b8e9e73780ac0ad6 Make SHA256SUMS fragment right after build (Carl Dong) Pull request description: Based on: #22075 Code reviewers: I recommend reading the new `guix-{attest,verify}` files instead of trying to read the diff The following changes resolve many usability improvements which were pointed out to me: 1. Some maintainers like to extract their "uncodesigned tarball" inside the `output/` directory, resulting in the older `guix-attest` mistakenly attesting to the extracted contents 2. Maintainers whose GPG keys reside on an external smartcard often need to physically interact with the smartcard as a way to approve the signing operation, having one signature per platform means a lot of fidgeting 3. Maintainers wishing to sign on a separate machine now has the option of transferring only a subtree of `output/`, namely `output/*/SHA256SUMS.part`, in order to perform a signature (you may need to specify an `$OUTDIR_BASE` env var) 4. An `all.SHA256SUMS` file should be usable as the base `SHA256SUMS` in bitcoin core torrents and on the release server. For those who sign on an separate machine than the one you do builds on, the following steps will work: 1. `env GUIX_SIGS_REPO=/home/achow101/guix.sigs SIGNER=achow101 NO_SIGN=1 ./contrib/guix/guix-attest` 2. Copy `/home/achow101/guix.sigs/<tag>/achow101` (which does not yet have signatures) to signing machine 3. Sign the `SHA256SUMS` files: ```bash for i in "<path-to-achow101>/*.SHA256SUMS"; do gpg --detach-sign --local-user "<your-key-here>" --armor --output "$i"{.asc,} done ``` 5. Upload `<path-to-achow101>` (now with signatures) to `guix.sigs` ----- After this change, output directories will now include a `SHA256SUMS.part` fragment, created immediately after a successful build: ``` output └── x86_64-w64-mingw32 ├── bitcoin-4e069f7589da-win64-debug.zip ├── bitcoin-4e069f7589da-win64-setup-unsigned.exe ├── bitcoin-4e069f7589da-win64.zip ├── bitcoin-4e069f7589da-win-unsigned.tar.gz └── SHA256SUMS.part ``` These `SHA256SUMS.part` fragments look something like: ``` 3ebd7262b1a0a5bb757fef1f70e7e14033c70f98c059bc4dbfee5d1992b25825 dist-archive/bitcoin-4e069f7589da.tar.gz def2e7d3de5ab3e3f955344e75151df4f33713f9101f5295bd13c9375bdf633b x86_64-w64-mingw32/bitcoin-4e069f7589da-win64-debug.zip 643049fe3ee4a4e83a1739607e67b11b7c9b1a66208a6f35a9ff634ba795500e x86_64-w64-mingw32/bitcoin-4e069f7589da-win64-setup-unsigned.exe a247a1ccec0ccc2e138c648284bd01f6a761f2d8d6d07d91b5b4a6670ec3f288 x86_64-w64-mingw32/bitcoin-4e069f7589da-win-unsigned.tar.gz fab76a836dcc592e39c04fd2396696633fb6eb56e39ecbf6c909bd173ed4280c x86_64-w64-mingw32/bitcoin-4e069f7589da-win64.zip ``` Meaning that they are valid `SHA256SUMS` files when `sha256sum --check`'d at the `guix-build-*/output` directory level When `guix-attest` is invoked, these `SHA256SUMS.part` files are combined and sorted (by `-k2`, `LC_ALL=C`) to create: 1. `noncodesigned.SHA256SUMS` for a manifest of all non-codesigned outputs, and 3. `all.SHA256SUMS` for a manifest of all outputs including non-codesigned outputs Then both files are signed, resulting in the following `guix.sigs` hierarchy: ``` 4e069f7589da/ └── dongcarl ├── all.SHA256SUMS ├── all.SHA256SUMS.asc ├── noncodesigned.SHA256SUMS └── noncodesigned.SHA256SUMS.asc ``` ACKs for top commit: achow101: ACK e2c40a4ed5272d72fea997bd936fba28bb753226 hebasto: ACK e2c40a4ed5272d72fea997bd936fba28bb753226, tested on Linux Mint 20.1 (x86_64) with and w/o `NO_SIGN=1`. Changes in `contrib/guix/libexec/codesign.sh` and `contrib/guix/guix-verify` are reviewed only. Tree-SHA512: 618aacefb0eb6595735a9ab6a98ea6598fce65f9ccf33fa1e7ef93bf140c0f6cfc16e34870c6aa3e4777dd3f004b92a82a994141879870141742df948ec59c1f
2021-06-10scripts: LIEF 0.11.5fanquake
2021-06-09Make SHA256SUMS fragment right after buildCarl Dong
2021-06-08Use latest signapple commitAndrew Chow
Update gitian and guix to use the same latest signapple commit
2021-05-19guix: repro: Sort find output in libtool for gcc-8Carl Dong
Otherwise the resulting .a static libraries (e.g. libstdc++.a) will not be reproducible and end up making the Bitcoin binaries non-reproducible as well. See: https://reproducible-builds.org/docs/archives/#gnu-libtool
2021-05-13guix: Package codesigning toolsCarl Dong
2021-05-13guix: Reindent existing manifest.scmCarl Dong
2021-05-05Merge bitcoin/bitcoin#21664: contrib: use LIEF for macOS and Windows symbol ↵W. J. van der Laan
& security checks 7fc5e865b93af59364e9c8bf75ec68b4decc7e5d test: install lief in CI (fanquake) 955140b3265d3bcb9504c61d73fbfdadfff8a2b2 contrib: consolidate PIE and NX security checks (fanquake) 2aa1631822b2fdbc6cf7a3dcd99adaf4d2745ed4 contrib: use LIEF in PE symbol checks (fanquake) e93ac26b8563576345c13e83c777dd39e7616b1e contrib: use LIEF in macOS symbol checks (fanquake) a632cbcee5ae982f50aba625713b7686aef29168 contrib: use f strings in symbol-check.py (fanquake) 0f5d77c8e4db691733edb455dd9e31dabe933b8d contrib: add PE PIE check to security checks (fanquake) 8e1f40dd9a5135dbdec2c25961fbd0729a42254c contrib: use LIEF for PE security checks (fanquake) a25b2e965c93fe2a46a2f8f1e7bdf5642d453511 contrib: use LIEF for macOS security checks (fanquake) 7e7eae7aa86ab95c44eed601f8c993285a256bbc contrib: use f strings in security-check.py (fanquake) 2e7a9f7ade0c7b31e762c0ddb9e0944a0d9c798e guix: install LIEF in Guix container (fanquake) 465967b5ef4b4f02e9d6783a94eca012d4ebcdab gitian: install LIEF in gitian container (fanquake) Pull request description: This PR is a proof of concept for using [LIEF](https://github.com/lief-project/LIEF) for the PE and MACHO symbol and security checks. It replaces our current approach of manually parsing the output of `objdump` & `otool`. If the consensus is that using LIEF is ok, then I also plan on replacing [pixie.py](https://github.com/bitcoin/bitcoin/blob/master/contrib/devtools/pixie.py), and using LIEF for all checks. LIEF for Linux is also currently blocked (on the next release, unless we want to build master) on one change for RISC-V that I [sent upstream](https://github.com/lief-project/LIEF/pull/562). LIEF is seemingly well maintained, and is the basis for a number of other tools. It also has some very nice documentation; i.e the [Python API for ELF](https://lief.quarkslab.com/doc/latest/api/python/elf.html). It also has many builtins we can take advantage of. i.e [`is_pie`](https://lief.quarkslab.com/doc/latest/api/python/macho.html#lief.MachO.Binary.is_pie), [`has_nx`](https://lief.quarkslab.com/doc/latest/api/python/macho.html#lief.MachO.Binary.has_nx) etc. This means we can [consolidate some of our checks](https://github.com/bitcoin/bitcoin/commit/9c5eeb54848f428109ec24dff55f189a5358e9bc). If/when end up using LIEF for lightning then we can consolidate further, and cleanup these scripts. i.e to not parse the binary inside the checks, but once at the start of the script. Guix builds: ```bash # find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum 963a08638c46f9a3d75cd4b0c155d1ca091bbeba27167291adcd3dca03fd4c3d guix-build-f51237d94d98/output/aarch64-linux-gnu/bitcoin-f51237d94d98-aarch64-linux-gnu-debug.tar.gz a3ce927c46b103789a010c41a6ebfafe4548d90ee7d88f2a735c9183b775da5c guix-build-f51237d94d98/output/aarch64-linux-gnu/bitcoin-f51237d94d98-aarch64-linux-gnu.tar.gz 2503ac8901068805d5e7251fd5cfeb7c1f8ba3528bdfcf3aa1e0c40bfd5c1cbc guix-build-f51237d94d98/output/arm-linux-gnueabihf/bitcoin-f51237d94d98-arm-linux-gnueabihf-debug.tar.gz 5798697e58e1788df85aa9e2e4d33fef0456169fcbd2521f13b3b5806ac0d84d guix-build-f51237d94d98/output/arm-linux-gnueabihf/bitcoin-f51237d94d98-arm-linux-gnueabihf.tar.gz 4185adebc6a0abe7241a3cd409a6ab7be031c26f1c4245e30bb5f87eef0925d2 guix-build-f51237d94d98/output/dist-archive/bitcoin-f51237d94d98.tar.gz 9b4b8756c5c84295eb6b61b6b32a07a8d07723fb38aaa8f519b6133935061bda guix-build-f51237d94d98/output/powerpc64-linux-gnu/bitcoin-f51237d94d98-powerpc64-linux-gnu-debug.tar.gz cbd821aa464a9c16f7979dbec1a5e66939e777a567f55f7081499a8d528d42c5 guix-build-f51237d94d98/output/powerpc64-linux-gnu/bitcoin-f51237d94d98-powerpc64-linux-gnu.tar.gz abed530a82e97e3cf621c90a13c0881b0e39ccce2a6f42a3ff80de76e2abc5f7 guix-build-f51237d94d98/output/powerpc64le-linux-gnu/bitcoin-f51237d94d98-powerpc64le-linux-gnu-debug.tar.gz 8b6d2bdd8b58ff1f6072bf8693abe3ce773ff3a7d8d2b7218207e69945b9d31b guix-build-f51237d94d98/output/powerpc64le-linux-gnu/bitcoin-f51237d94d98-powerpc64le-linux-gnu.tar.gz d99cc705032d22ae819975992216899ed960ba25871a05c8789d00b80418511f guix-build-f51237d94d98/output/riscv64-linux-gnu/bitcoin-f51237d94d98-riscv64-linux-gnu-debug.tar.gz 5240ca4f4ef7c62088185224ac319ad9a4a9b40075df10af18d8a6355bca32fb guix-build-f51237d94d98/output/riscv64-linux-gnu/bitcoin-f51237d94d98-riscv64-linux-gnu.tar.gz adc16eaee4b51e8615ce8b3be9f6c018698237df4ad6e0886cf0d4ab6bc9e5c4 guix-build-f51237d94d98/output/x86_64-apple-darwin18/bitcoin-f51237d94d98-osx-unsigned.dmg b188af0572ee682d74cc82c7e6e464115205fc130a457cfe19d42ac9ddd267f8 guix-build-f51237d94d98/output/x86_64-apple-darwin18/bitcoin-f51237d94d98-osx-unsigned.tar.gz e764062fde144e6fb5d6dd776c10fc2daa8d775831f7e43247d17a6c6e060c97 guix-build-f51237d94d98/output/x86_64-apple-darwin18/bitcoin-f51237d94d98-osx64.tar.gz dab3d26ac94c669140f7329d14e57ef02b0fe92b8a8f9d96c32a416adea0da0f guix-build-f51237d94d98/output/x86_64-linux-gnu/bitcoin-f51237d94d98-x86_64-linux-gnu-debug.tar.gz ca59d4379fbe2b9a52deebeaf88508e0eda4215f28d319aff0781289dd159712 guix-build-f51237d94d98/output/x86_64-linux-gnu/bitcoin-f51237d94d98-x86_64-linux-gnu.tar.gz 52b7c35321a85c4f6c95bf0e687574454b71ede9bec1c9cf17f37c578c888a94 guix-build-f51237d94d98/output/x86_64-w64-mingw32/bitcoin-f51237d94d98-win-unsigned.tar.gz a543895a00f8ffb3ba50ca68396d52ad5a18dd8efe38730e0049dd70d283a092 guix-build-f51237d94d98/output/x86_64-w64-mingw32/bitcoin-f51237d94d98-win64-debug.zip aec050d03c65268a986148500f7341cceb8c5f85287e0e3cde8933ce4b4dee32 guix-build-f51237d94d98/output/x86_64-w64-mingw32/bitcoin-f51237d94d98-win64-setup-unsigned.exe 57ba33ed6ee8d3a885e342471359301473e83037d5442895beb686921a4c50e9 guix-build-f51237d94d98/output/x86_64-w64-mingw32/bitcoin-f51237d94d98-win64.zip ``` Gitian builds: ```bash # macOS: 2f066e852bdd30ac46e5ecdf7619d19d408035c318a3edf0f1893ec2e25efb69 bitcoin-41a1b3d1b130-osx-unsigned.dmg 8cf8ac4d21740f490262453c330b5f4a5c5b8139dfc1b322efefce3f3b93d1b2 bitcoin-41a1b3d1b130-osx-unsigned.tar.gz cf1b84efdd9d2588a1ce9513580fb56b38bfafe60e18f8adbeedf03521c6c2b2 bitcoin-41a1b3d1b130-osx64.tar.gz 14995244b0bb3e80e7b79975c9c70fdfb3ee3c04fda3efd5358ce1c4efa3a312 src/bitcoin-41a1b3d1b130.tar.gz 93881069d5e1dc385c08895a7b035a94eb010325afc2776c99b6aafa21096eb8 bitcoin-core-osx-22-res.yml # Windows: 4d56dd7713121684b7eaa448679c65df2fd0aa5319bf8d12fb6cfa9f0b005cf7 bitcoin-f51237d94d98-win-unsigned.tar.gz 4558f4173152b084bcba25aa1a53c605208a70fe20392141b63cefb476528c85 bitcoin-f51237d94d98-win64-debug.zip b63feaca010e86d514cfe38d716e3c8a8b8058e4f969b868aaaeb8a8a3d3dc81 bitcoin-f51237d94d98-win64-setup-unsigned.exe de7d8586cc91ba391fe911853a99d9fd15fc6f9a60f9b91a0447940173aac67a bitcoin-f51237d94d98-win64.zip 4185adebc6a0abe7241a3cd409a6ab7be031c26f1c4245e30bb5f87eef0925d2 src/bitcoin-f51237d94d98.tar.gz 45efaca35b5fad0a04dfd06e44f7c00b990aa91c7bf2faea57e020d3491a6cf0 bitcoin-core-win-22-res.yml # Linux: 055d646c5f8cf4708008374546176012ff758566a2645a3a01e1a33eab1002fe bitcoin-f51237d94d98-aarch64-linux-gnu-debug.tar.gz bfc8b0efc36b0474c88546b12d2723c04b4dc629ae311082025c7e0b8f0d1aa9 bitcoin-f51237d94d98-aarch64-linux-gnu.tar.gz 9dfaa5acfffadad8942b32996458013a155d12ed07be76601f232233627b5cb9 bitcoin-f51237d94d98-arm-linux-gnueabihf-debug.tar.gz 54eb57905ff8513b9f628707b61aa4659c362fb2f6d17e0ee240b4da3674907d bitcoin-f51237d94d98-arm-linux-gnueabihf.tar.gz ad98d876616eff578ad8cfd17dfbabe48ed14200823579687d66694bae3d2fe3 bitcoin-f51237d94d98-powerpc64-linux-gnu-debug.tar.gz fe1b421dd1cb6e04d5dc5d341459dc15fa6e15b80906e5d8e0405cf43495e0f7 bitcoin-f51237d94d98-powerpc64-linux-gnu.tar.gz 9001d95cc7d2722d9d7dd83d9da8e5adf575fddf91b615b76b9bcfece30ecf6f bitcoin-f51237d94d98-powerpc64le-linux-gnu-debug.tar.gz 9e0650ad2aba70c0fd1608a077e95f335dc1bb4a79eab9b0b56ac87427a4fd4f bitcoin-f51237d94d98-powerpc64le-linux-gnu.tar.gz fbfde0134944d3dbd32991455b0a8abdd334853ab8a4c1a1a4c060d9de071c50 bitcoin-f51237d94d98-riscv64-linux-gnu-debug.tar.gz 2fa2cfddce98c44c65305326fc623a7f065129208337503d813a08d51580cb8a bitcoin-f51237d94d98-riscv64-linux-gnu.tar.gz b2d6caeee0e3c350a43165c39876ebed8e588958007af0d06996e341c7060683 bitcoin-f51237d94d98-x86_64-linux-gnu-debug.tar.gz bfdb827e75d43d61462513c9a843620b93c9160d9d246cad13278baaa07f64ea bitcoin-f51237d94d98-x86_64-linux-gnu.tar.gz 4185adebc6a0abe7241a3cd409a6ab7be031c26f1c4245e30bb5f87eef0925d2 src/bitcoin-f51237d94d98.tar.gz 34820a093916fa35b0fd98806a50092f46b20271af7422f43e2a4223ef6f9bb7 bitcoin-core-linux-22-res.yml ``` ACKs for top commit: laanwj: re-ACK 7fc5e865b93af59364e9c8bf75ec68b4decc7e5d Tree-SHA512: 0c30838413448ecfcf55e6273f607fdb01cb1acafa1d2762afad59360fca7d8efa78ec55064f50cba56cb2c9e98741e13665cba8e9b4b8e5b62b8a53f9bf8990
2021-05-04guix: install LIEF in Guix containerfanquake
Co-authored-by: Carl Dong <contact@carldong.me>
2021-05-03guix: Consistently use gcc-8 for $HOSTCarl Dong
2021-05-01guix: use Clang 10 for the macOS cross compilefanquake
2021-04-05guix: Build dmg as a static binaryCarl Dong
This relatively easy change eliminates all runtime dependencies (except for the kernel) for dmg, which is the only native build tool that gets put in our output tarballs. This allows much more flexibility when constructing the codesigning environment, and is much more robust.
2021-04-05guix: Use clang-toolchain instead of clangCarl Dong
2021-03-10build: Add xkbcommon 0.8.4Hennadii Stepanov
Co-authored-by: fanquake <fanquake@gmail.com>
2021-03-03guix: Remove libcap from manifestHennadii Stepanov
2021-02-24guix: Bump glibc and linux-headersCarl Dong
Bump glibc and linux-headers to match those of our Gitian counterparts. We also require a glibc >= 2.28 for the test-symbol-check scripts to work properly. The default BASE-GCC-FOR-LIBC also has to be bumped since glibc 2.31 requires a gcc >= 6.2
2021-02-19guix: Add support for powerpc64{,le}Carl Dong
The new time-machine commit contains a few small changes that make the powerpc cross-toolchain work.
2021-02-18guix: Jump forwards in time-machine and adaptCarl Dong
The new time-machine commit is Guix v1.2.0 with a yet-unupstreamed patch for NSIS. A few important changes: 1. Guix switched back from using CPATH to C{,PLUS}_INCLUDE_PATH as the way to indicate #include search paths. 2. GCC's library is now split into a separate output, whereas before it was included in the default output. This means that our gcc toolchain packages need to propagate that output. 3. A few package versions were bumped
2021-01-21guix: Add support for darwin buildsCarl Dong
2021-01-17guix: Make nsis reproducible by respecting SOURCE-DATE-EPOCHCarl Dong
When building nsis, if VERSION is not specified, it defaults to cvs_version which is non-deterministic as it includes the current date. This patches nsis to default to SOURCE_DATE_EPOCH if it exists so that nsis is reproducible. Upstream change: https://github.com/kichik/nsis/pull/13
2020-04-28guix: Make source tarball using git-archiveCarl Dong
2020-04-07guix: Use gcc-9 for mingw-w64 instead of 8Carl Dong
The libtool unsorted 'find' determinism issue seemed to have been solved in gcc-9's git: d41cd173e23ebea7c758644d6ad6e0fde1c2e3a6 or SVN: r262451 Furthermore, it seems that Ubuntu Focal 20.04 LTS is going to ship with gcc 9 and mingw-w64 7, which will match what we have now. ----- A note on this: Careful observers will see that previously I stated that all released versions of gcc were bootstrapped with a libtool 2.2.7a, meaning that they all had the unsorted 'find' determinism issue first resolved in libtool 2.2.7b. However, I was mistaken, gcc's ltmain.sh CLAIMS it was generated by libtool 2.2.7a, but it was in fact edited manually. It seems that gcc maintains their own versions of ltmain.sh and libtool.m4, and only sometimes backports patches from upstream. Quite confusing.
2020-04-02guix: Check mingw symbols, improve SSP fix docsCarl Dong
2020-04-02guix: Reinstate make-ssp-fixed-gccCarl Dong
Unfortunately, gcc is still not smart enough to detect whether or not mingw-w64 provides ssp, so let's put it back just for mingw-w64.
2020-04-02guix: Use gcc-8 for mingw-w64 instead of 7Carl Dong
We're using mingw-w64 6.0.0, which is paired with gcc-8 in most distros.
generated by cgit v1.2.3 (git 2.26.2) at 2024-09-02 17:29:56 +0000