guix: patch store paths out of libunwind
What the developer wrote
Authored by fanquake
guix: patch store paths out of libunwind
Apply libgcc patches to Linux as well as Windows cross.
What changed, and why it matters
This commit changes Bitcoin Core's Guix build setup so that a reproducibility patch for the GCC compiler is also applied when building Linux binaries, not just Windows ones. The patch strips out architecture-specific Guix store paths from debug symbols and now also from libunwind, making the resulting binaries more deterministic across different build machines. It is a build-hygiene/reproducibility fix, not a runtime security patch.
No security response required. Treat as a normal build-system reproducibility improvement. Reviewers may verify that the new shell command in the patch correctly handles empty /gnu/store and does not break non-Guix builds, since it is scoped to the Guix patch file only.
Security signals we found
Build reproducibility improvement
No runtime code change in Bitcoin Core
No memory safety, cryptography, or consensus change
Patch only affects Guix deterministic build tooling
Evidence from the diff
The commit renames gcc-mingw-patches to gcc-libgcc-patches and applies the existing gcc-remap-guix-store.patch to the Linux cross-toolchain in addition to the MinGW (Windows) toolchain. The patch itself adds -ffile-prefix-map flags for every /gnu/store entry to libgcc and libunwind build flags, normalizing build paths to /usr. This removes architecture-dependent store hashes from debug info and unwind metadata, improving build reproducibility.
Changed components
contrib/guix/manifest.scmcontrib/guix/patches/gcc-remap-guix-store.patchGuix-based release build toolchainInspect captured patch +16 / −7
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index 3670fcec..011ba0de 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -99,10 +99,10 @@ chain for " target " development."))
(define* (make-bitcoin-cross-toolchain target
#:key
- (base-gcc-for-libc linux-base-gcc)
+ (base-gcc-for-libc (gcc-libgcc-patches linux-base-gcc))
(base-kernel-headers base-linux-kernel-headers)
(base-libc glibc-2.31)
- (base-gcc linux-base-gcc))
+ (base-gcc (gcc-libgcc-patches linux-base-gcc)))
"Convenience wrapper around MAKE-CROSS-TOOLCHAIN with default values
desirable for building Bitcoin Core release binaries."
(make-cross-toolchain target
@@ -111,7 +111,7 @@ desirable for building Bitcoin Core release binaries."
base-libc
base-gcc))
-(define (gcc-mingw-patches gcc)
+(define (gcc-libgcc-patches gcc)
(package-with-extra-patches gcc
(search-our-patches "gcc-remap-guix-store.patch")))
@@ -128,10 +128,10 @@ desirable for building Bitcoin Core release binaries."
(let* ((xbinutils (binutils-mingw-patches (cross-binutils target)))
(machine (substring target 0 (string-index target #\-)))
(pthreads-xlibc (winpthreads-patches (make-mingw-w64 machine
- #:xgcc (cross-gcc target #:xgcc (gcc-mingw-patches base-gcc))
+ #:xgcc (cross-gcc target #:xgcc (gcc-libgcc-patches base-gcc))
#:with-winpthreads? #t)))
(pthreads-xgcc (cross-gcc target
- #:xgcc (gcc-mingw-patches mingw-w64-base-gcc)
+ #:xgcc (gcc-libgcc-patches mingw-w64-base-gcc)
#:xbinutils xbinutils
#:libc pthreads-xlibc)))
;; Define a meta-package that propagates the resulting XBINUTILS, XLIBC, and
diff --git a/contrib/guix/patches/gcc-remap-guix-store.patch b/contrib/guix/patches/gcc-remap-guix-store.patch
index a8b41d48..4144bcd8 100644
--- a/contrib/guix/patches/gcc-remap-guix-store.patch
+++ b/contrib/guix/patches/gcc-remap-guix-store.patch
@@ -1,4 +1,4 @@
-Without ffile-prefix-map, the debug symbols will contain paths for the
+Without -ffile-prefix-map, the debug symbols will contain paths for the
guix store which will include the hashes of each package. However, the
hash for the same package will differ when on different architectures.
In order to be reproducible regardless of the architecture used to build
@@ -6,7 +6,7 @@ the package, map all guix store prefixes to something fixed, e.g. /usr.
--- a/libgcc/Makefile.in
+++ b/libgcc/Makefile.in
-@@ -854,7 +854,7 @@ endif
+@@ -857,7 +857,7 @@ endif
# libgcc_eh.a, only LIB2ADDEH matters. If we do, only LIB2ADDEHSTATIC and
# LIB2ADDEHSHARED matter. (Usually all three are identical.)
@@ -15,6 +15,15 @@ the package, map all guix store prefixes to something fixed, e.g. /usr.
ifeq ($(enable_shared),yes)
+@@ -880,7 +880,7 @@ endif
+ # Build LIBUNWIND. Use -fno-exceptions so that the unwind library does
+ # not generate calls to __gcc_personality_v0.
+
+-c_flags := -fno-exceptions
++c_flags := -fno-exceptions $(shell find /gnu/store -maxdepth 1 -mindepth 1 -type d -exec echo -n " -ffile-prefix-map={}=/usr" \;)
+
+ libunwind-objects += $(addsuffix $(objext),$(basename $(notdir $(LIBUNWIND))))
+
--
2.37.0
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.