guix: add --no-same-owner to TAR_OPTIONS
What the developer wrote
Authored by fanquake
guix: add --no-same-owner to TAR_OPTIONS
So it's used to extract tarballs.
What changed, and why it matters
This commit changes the Bitcoin Core Guix build script to add '--no-same-owner' to the TAR_OPTIONS environment variable. This option tells tar not to restore the original file ownership when extracting archives, instead using the current user. The change is intended to make tarball extraction more deterministic and avoid relying on the user running the build being able to assume arbitrary file ownership. It is a hardening/determinism improvement rather than a fix for an active, exploitable vulnerability.
No immediate action required. Treat as a routine hardening/determinism improvement. Review whether other build scripts or CI pipelines that extract tarballs should apply the same option.
Security signals we found
Build-hardening change affecting tar extraction behavior
Prevents tar from restoring archive-recorded ownership during extraction
Improves reproducible-build determinism by normalizing file ownership
No explicit security claim in commit message or diff
Evidence from the diff
In contrib/guix/libexec/build.sh, TAR_OPTIONS is extended from ‘–owner=0 –group=0 –numeric-owner –mtime=… –sort=name’ to include ‘–no-same-owner’. This affects how tar extracts archives during the Guix reproducible build process. Without –no-same-owner, tar may attempt to chown extracted files to the UIDs/GIDs recorded in the archive; if run as root, this could lead to files being owned by unexpected system users. The patch ensures extracted files are owned by the extracting user, improving build determinism and reducing trust in archive metadata. The commit message frames this as a determinism/build-hardening change, not a security bug fix.
Changed components
contrib/guix/libexec/build.shGuix reproducible build pipelineTarball extraction step during release buildsInspect captured patch +1 / −1
diff --git a/contrib/guix/libexec/build.sh b/contrib/guix/libexec/build.sh
index 38f3958e..092f934c 100755
--- a/contrib/guix/libexec/build.sh
+++ b/contrib/guix/libexec/build.sh
@@ -6,7 +6,7 @@ export LC_ALL=C
set -e -o pipefail
# Environment variables for determinism
-export TAR_OPTIONS="--owner=0 --group=0 --numeric-owner --mtime='@${SOURCE_DATE_EPOCH}' --sort=name"
+export TAR_OPTIONS="--no-same-owner --owner=0 --group=0 --numeric-owner --mtime='@${SOURCE_DATE_EPOCH}' --sort=name"
export TZ=UTC
# Although Guix _does_ set umask when building its own packages (in our case,
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.