aboutsummaryrefslogtreecommitdiff
path: root/contrib/guix
AgeCommit message (Collapse)Author
2021-05-04guix: install LIEF in Guix containerfanquake
Co-authored-by: Carl Dong <contact@carldong.me>
2021-05-03guix-attest: Avoid incomplete sigdirs with ERR trapsCarl Dong
Sometimes GPG connects to the wrong agent... or you don't have your smartcard handy...
2021-05-03guix: Consistently use gcc-8 for $HOSTCarl Dong
2021-05-03guix: Skip attesting to dist-archiveCarl Dong
We already attest to the relevant dist-archive in inputs.SHA256SUMS, which is recorded at build-time. We use a SKIPATTEST.TAG file to indicate output directories which do not require attestation (much like the CACHEDIR.TAG specification). Generally, it's better to have build scripts declare properties of directories instead of introducing name-based special cases in attest scripts since build scripts have a more detailed context of what is going on.
2021-05-03guix: Attest to inputs in inputs.SHA256SUMSCarl Dong
At build/codesigning-time, hash build inputs and output the digest to ${OUTDIR}/inputs.SHA256SUMS, which gets included in the final SHA256SUMS constructed by guix-attest. Example final SHA256SUMS: ee832d2a35b7701bff581dea05a536118b118e3ad0a587a2855b6ee8cd6fba20 inputs/bitcoin-78199266af7b.tar.gz ca765e70a0c12866dd63c0be228b675278a26329e5f8f5b5c52fd09200fedf21 bitcoin-78199266af7b-powerpc64le-linux-gnu-debug.tar.gz dae95327d7f2c324e2728c4b73627be6cb2c0d2f2e5bea940d1d5e6463939327 bitcoin-78199266af7b-powerpc64le-linux-gnu.tar.gz
2021-05-03guix: Construct $OUTDIR in ${DISTSRC}/outputCarl Dong
While files are being output to $OUTDIR, it will be under ${DISTSRC}/output, and only when everything is done, will ${DISTSRC}/output be moved to the actual $OUTDIR. This makes it so that a Ctrl-C in the middle of a build is less likely to result in a partially-constructed $OUTDIR. In fact, if I understand correctly, if $OUTDIR and $DISTSRC reside on the same filesystem, the move (rename) is likely atomic. Also, since the "working $OUTDIR" is under ${DISTSRC}/output, it will be cleaned properly by the guix-clean script.
2021-05-03guix: Minor quoting fix in libexec/build.shCarl Dong
2021-05-03guix-attest: Allow skipping GPG signing with NO_SIGNCarl Dong
2021-05-03guix-attest: Use ascii-armor signaturesCarl Dong
2021-05-03guix-attest: Only use cross-platform flags for find+xargsCarl Dong
2021-05-03guix: Add guix-verify scriptCarl Dong
2021-05-03guix: Add guix-attest scriptCarl Dong
2021-05-01guix: use Clang 10 for the macOS cross compilefanquake
2021-05-01build: Xcode 12.1, macOS SDK 10.15.6fanquake
2021-04-23test: fix file permissions on various scriptswindsok
Updates permissions on files to comply with the new test added in the following commit
2021-04-21Merge #21655: build, qt: No longer need to set QT_RCC_TEST=1 for determinismfanquake
c799a19b4bb8d0cc5ffd9b49746b5b267745c9b5 build, qt: No longer need to set QT_RCC_TEST=1 for determinism (Hennadii Stepanov) Pull request description: The Qt Resource Compiler (rcc) output order relies on [`QHash`](https://doc.qt.io/qt-5/qhash.html): > This randomization of `QHash` is enabled by default. Even though programs should never depend on a particular `QHash` ordering, there may be situations where you temporarily need deterministic behavior, for example for debugging or regression testing. To disable the randomization, define the environment variable `QT_HASH_SEED` to have the value 0. Since #3620 we use `QT_RCC_TEST=1` to achieve a deterministic output. Since Qt 5.3.1 hash seeding is disabled for all of the bootstrapped tools, including rcc. Therefore, `QT_RCC_TEST=1` is no longer needed. See commit [5283a6c87beac5a43f612786fefd6e43f2c70bf6](https://github.com/qt/qtbase/commit/5283a6c87beac5a43f612786fefd6e43f2c70bf6). ACKs for top commit: fanquake: ACK c799a19b4bb8d0cc5ffd9b49746b5b267745c9b5 Tree-SHA512: 9d116ac1e8c605ee3e8ed7f618586f0de85d8b06bbbb70fe8c298939ce203d2a7e97264a9afac037179993ab54c5f69a65ebb9ab27ca7f45acb963011bd45743
2021-04-14doc: remove boostrap info from GUIX_COMMON_FLAGS docfanquake
Passing ADDITIONAL_GUIX_COMMON_FLAGS="--no-substitutes --bootstrap" as suggested doesn't work: ```bash ...outputting in: '/bitcoin/guix-build-a1f0b8b62eb8/output/x86_64-linux-gnu' ...bind-mounted in container to: '/outdir-base/x86_64-linux-gnu' guix time-machine: error: bootstrap: unrecognized option ``` and I think bootstrapping is more than covered in the preceding "Choose your security model" section.
2021-04-12doc: Fix name of script guix-buildStephan Oeste
2021-04-11build, qt: No longer need to set QT_RCC_TEST=1 for determinismHennadii Stepanov
Since Qt 5.3.1 hash seeding is disabled for rcc. See commit 5283a6c87beac5a43f612786fefd6e43f2c70bf6.
2021-04-08Merge #21304: guix: Add guix-clean script + establish gc-root for container ↵W. J. van der Laan
profiles 867a5e172a23899a4a70eca4a396c64f1951745e guix: Register garbage collector root for containers (Carl Dong) 8f8b96fb542701b7717683caa3848390b24f77ab guix: Update hint messages to mention guix-clean (Carl Dong) 44f6d4f56b16e1dc5e8a23318b8e7aad0665f178 guix: Record precious directories and add guix-clean (Carl Dong) 84912d4b24382ae022da3a863bd6caa2b8948d94 build: Remove spaces from variable-printing rules (Carl Dong) Pull request description: ``` guix: Record precious directories and add guix-clean Many users have reported problems that stem from having an unclean working tree. To that end, I've written a guix-clean script which should help reset the working tree while respecting user-specified precious directories. Precious directories, such as: - SOURCES_PATH - BASE_CACHE - SDK_PATH - OUTDIR Should be preserved when cleaning the working tree, and are thus recorded in ./contrib/guix/var/precious_dirs. The ./contrib/guix/guix-clean script is able to parse that file and make sure to avoid them when cleaning out the working tree. ``` ACKs for top commit: laanwj: ACK 867a5e172a23899a4a70eca4a396c64f1951745e Tree-SHA512: c498fad781ff5e6406639df2b91b687fc528273fdf266bcdba8f6eec3b3b37ecce544b6da0252f0b9c6717f9d88e844e4c7b72d1877bdbabfc6871ddd0172af5
2021-04-07guix: Register garbage collector root for containersCarl Dong
By registering the container profiles as garbage collector roots, it will prevent `guix gc` from garbage collecting derivations which our container needs and inconvieniencing the user with a rebuild.
2021-04-07guix: Update hint messages to mention guix-cleanCarl Dong
2021-04-07doc: Fix typos from codespell lintYerzhan Mazhkenov
2021-04-05Fix a typo in guix-build outputPieter Wuille
2021-04-05guix: Record precious directories and add guix-cleanCarl Dong
Many users have reported problems that stem from having an unclean working tree. To that end, I've written a guix-clean script which should help reset the working tree while respecting user-specified precious directories. Precious directories, such as: - SOURCES_PATH - BASE_CACHE - SDK_PATH - OUTDIR Should be preserved when cleaning the working tree, and are thus recorded in ./contrib/guix/var/precious_dirs. The ./contrib/guix/guix-clean script is able to parse that file and make sure to avoid them when cleaning out the working tree.
2021-04-05build: Remove spaces from variable-printing rulesCarl Dong
This simplifies parsing when using these rules from scripts.
2021-04-05guix: Build dmg as a static binaryCarl Dong
This relatively easy change eliminates all runtime dependencies (except for the kernel) for dmg, which is the only native build tool that gets put in our output tarballs. This allows much more flexibility when constructing the codesigning environment, and is much more robust.
2021-04-05guix: Remove codesign_allocate+pagestuff from unsigned tarballCarl Dong
2021-04-05guix: Use clang-toolchain instead of clangCarl Dong
2021-04-05guix: Fallback to local build for substitute-enabled Guix usersCarl Dong
2021-04-05guix: Add early health check for guix-daemonCarl Dong
2021-04-05guix: More thoroughly control native toolchainCarl Dong
2021-04-05guix: Supply --link-profileCarl Dong
2021-04-05guix: Add troubleshooting documentation entriesCarl Dong
2021-04-05guix: Adapt guix-build to prelude, restructure hierCarl Dong
2021-04-05guix: Remove guix-build.sh filename extensionCarl Dong
2021-04-05guix: Add source-able bash prelude and utilsCarl Dong
2021-04-01guix: Create windeploy inside distsrc-*Carl Dong
./windeploy is a "working directory", and therefore belongs inside distsrc-*. Many people have noticed their Guix builds failing after hours simply because they did not remove windeploy (but did remove the distsrc-* directories).
2021-04-01guix: Use --cores instead of --max-jobsCarl Dong
In Guix, there are two flags for controlling parallelism: Note: When I say "derivation," think "package" --cores=n - controls the number of CPU cores to build each derivation. This is the value passed to `make`'s `--jobs=` flag. - defaults to 0: as many cores as is available --max-jobs=n - controls how many derivations can be built in parallel - defaults to 1 Therefore, if set --max-jobs=$MAX_JOBS and don't set --cores, Guix could theoretically spin up $MAX_JOBS * $(nproc) number of threads, and that's no good. So we could either default to --cores=1, --max-jobs=$MAX_JOBS - Pro: --cores=1 means that `make` will be invoked with `-j1`, avoiding problems with package whose build systems and test suites break when running multi-threaded. - Con: There will be times when only 1 or 2 derivations can be built at a time, because the rest of the dependency graph all depend on those 1 or 2 derivations. During these times, the machine will be severely under-utilized. or --cores=$MAX_JOBS, --max-jobs=1 - Pro: We don't encounter prolonged periods of severe under-utilization mentioned above. - Con: Many packages' build systems and test suites break when running multi-threaded. or --cores=1, --max-jobs=1 and let the user override with $ADDITIONAL_GUIX_COMMON_FLAGS
2021-03-10build: Add xkbcommon 0.8.4Hennadii Stepanov
Co-authored-by: fanquake <fanquake@gmail.com>
2021-03-03guix: Remove libcap from manifestHennadii Stepanov
2021-03-03guix: Update darwin native packages dependenciesHennadii Stepanov
2021-03-02Merge #21325: lint: Fix spelling errors in commentsfanquake
fbbb2d4fc13971c98c83a51635166ac532e71a32 lint: Fix spelling errors in comments (fyquah) Pull request description: Found some spelling errors while running spelling linter https://github.com/bitcoin/bitcoin/pull/21245 This PR fixes them. ACKs for top commit: fanquake: ACK fbbb2d4fc13971c98c83a51635166ac532e71a32 - I thought we just fixed all of these. Tree-SHA512: 95525040001f94e899b778c616cb66ebafb679dff88835b66fccf6349d8eb942d6b7374c536a44e393f13156bce9a32ed57e6a82bb02074d2b3cddb2696addb2
2021-03-02Merge #21298: guix: Bump time-machine, glibc, and linux-headersfanquake
c33b199456e57d83c21eacd36d3c56d0a123b0d0 guix: Bump glibc and linux-headers (Carl Dong) 65363a1bd8b886f5aef5fbc97ca88c9c9b243b21 guix: Rebase on 95aca2991b (1.2.0-12.dffc918) (Carl Dong) Pull request description: On bumping the time-machine: ``` A few changes which are useful for us: 1. 'gnu: cross-gcc-arguments: Enable 128 bit long double for POWER9.' is now merged into master. 2. gnutls is bumped to 3.6.15 and the temporal test failure in status-request-revoked is fixed. Note that this does not fix the case where one has installed Guix v1.2.0 and is running a substitute-less bootstrap build, since the `guix time-machine` command itself has a dependency on gnutls v3.6.12 (the one with the broken test) and will thus try to build it before attempting to jump forwards in time. This does however, mean that those who build a version of Guix that also contains this fix will not go backwards in time to build the broken gnutls v3.6.12. ``` On bumping the rest: ``` Bump glibc and linux-headers to match those of our Gitian counterparts. We also require a glibc >= 2.28 for the test-symbol-check scripts to work properly. The default BASE-GCC-FOR-LIBC also has to be bumped since glibc 2.31 requires a gcc >= 6.2 ``` This is a prerequisite for #20980 ACKs for top commit: fanquake: ACK c33b199456e57d83c21eacd36d3c56d0a123b0d0 - I think going ahead with this now and to sycn back up to gitian is fine. It will also unblock #20980. Potential code signing related issues can be sorted out in #21239 and later PRs. Tree-SHA512: 31f022aadb93ba44813b0da005b1f2e5d67d76e8cdcdb53368924d1ea6cb076a21218c26831a6b0dcdcfe33507f54934330489ba557371d740f5587b7d727b95
2021-03-02Merge #21323: guix, doc: Update default HOSTS valuefanquake
a0a7a4337d06553ab625bbd66ed4198c4bf7f18c guix, doc: Update default HOSTS value (Hennadii Stepanov) Pull request description: This is a #21089 follow up. ACKs for top commit: fanquake: ACK a0a7a4337d06553ab625bbd66ed4198c4bf7f18c Tree-SHA512: c1813cc2b9212a79fd34d4e25cd0816b58264e1890daf777cd59411bd20fcc9affe312871d06fab1308b8f55c1a78ac1101e631882c18360a4709ecef4529f05
2021-03-01lint: Fix spelling errors in commentsfyquah
2021-03-01guix, doc: Update default HOSTS valueHennadii Stepanov
2021-03-01guix: Add curl to required tool listHennadii Stepanov
2021-02-26Merge #21272: guix: Passthrough SDK_PATH into containerWladimir J. van der Laan
13a9fd11a507fd3398bc2c0a0575bdc81579243f guix: Passthrough SDK_PATH into container (Carl Dong) Pull request description: This is a usability improvement for Guix builders so that they don't have to extract the Xcode tarball into `depends/SDKs` every time. Inspiration: https://github.com/bitcoin/bitcoin/pull/21089#issuecomment-778639698 ACKs for top commit: laanwj: Tested ACK 13a9fd11a507fd3398bc2c0a0575bdc81579243f Tree-SHA512: 63392d537e48a0da9f0ee04a929613b139bef1ac5643187871c9ea5376afd2a3d95df0f5e0950ae0eccd2813b166667be98401e5a248ae9c187fe4e84e54d427
2021-02-24guix: Bump glibc and linux-headersCarl Dong
Bump glibc and linux-headers to match those of our Gitian counterparts. We also require a glibc >= 2.28 for the test-symbol-check scripts to work properly. The default BASE-GCC-FOR-LIBC also has to be bumped since glibc 2.31 requires a gcc >= 6.2
generated by cgit v1.2.3 (git 2.26.2) at 2024-11-09 20:32:41 +0000