guix: switch to upstream python-oscrypto package
What the developer wrote
Authored by fanquake
guix: switch to upstream python-oscrypto package
What changed, and why it matters
This commit changes how Bitcoin Core's Guix build system obtains a Python cryptography helper library called oscrypto. Previously, Bitcoin Core maintained its own custom package definition and a patch that forced oscrypto to use a specific OpenSSL library path. Now it uses the standard upstream package from the Guix distribution. This is primarily a build-maintenance simplification. It is not a direct fix for a known vulnerability, but it removes a local patch and custom package, which could slightly change what code is compiled into release builds.
Verify that the upstream Guix `python-oscrypto` package behaves equivalently to the removed custom definition for Bitcoin Core's build purposes, particularly regarding OpenSSL path resolution and test coverage. Review release build reproducibility and hashes after this change. No urgent runtime mitigation is needed.
Security signals we found
Removal of a local security-relevant patch that hard-coded OpenSSL paths
Dependency supply-chain change for release build environment
No direct vulnerability fix or CVE reference present in commit
Potential for build-time cryptographic behavior to differ between custom and upstream oscrypto packaging
Evidence from the diff
The patch removes the in-tree python-oscrypto package definition from contrib/guix/manifest.scm and deletes contrib/guix/patches/oscrypto-hard-code-openssl.patch. It switches the manifest to import python-oscrypto from (gnu packages python-crypto) and adjusts python-certvalidator’s propagated inputs to include openssl directly. The deleted patch had hard-coded OpenSSL library paths (libcrypto.so, libssl.so) into oscrypto at build time. Moving to the upstream Guix package means Bitcoin Core no longer controls that patching. The change affects deterministic release builds only; it does not alter consensus, networking, or wallet code.
Changed components
contrib/guix/manifest.scmcontrib/guix/patches/oscrypto-hard-code-openssl.patchGuix deterministic release build toolchainpython-oscrypto dependency packagingInspect captured patch +3 / −73
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index 048dc2de..25e87c57 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -16,7 +16,7 @@
(gnu packages pkg-config)
((gnu packages python) #:select (python-minimal))
((gnu packages python-build) #:select (python-poetry-core))
- ((gnu packages python-crypto) #:select (python-asn1crypto))
+ ((gnu packages python-crypto) #:select (python-asn1crypto python-oscrypto))
((gnu packages python-xyz) #:select (python-lief))
((gnu packages tls) #:select (openssl))
((gnu packages version-control) #:select (git-minimal))
@@ -176,64 +176,6 @@ chain for " target " development."))
(description "elfesteem parses ELF, PE and Mach-O files.")
(license license:lgpl2.1))))
-(define-public python-oscrypto
- (package
- (name "python-oscrypto")
- (version "1.3.0")
- (source
- (origin
- (method git-fetch)
- (uri (git-reference
- (url "https://github.com/wbond/oscrypto")
- (commit version)))
- (file-name (git-file-name name version))
- (sha256
- (base32
- "1v5wkmzcyiqy39db8j2dvkdrv2nlsc48556h73x4dzjwd6kg4q0a"))
- (patches (search-our-patches "oscrypto-hard-code-openssl.patch"))))
- (build-system python-build-system)
- (native-search-paths
- (list (search-path-specification
- (variable "SSL_CERT_FILE")
- (file-type 'regular)
- (separator #f) ;single entry
- (files '("etc/ssl/certs/ca-certificates.crt")))))
-
- (propagated-inputs
- (list python-asn1crypto openssl))
- (arguments
- `(#:phases
- (modify-phases %standard-phases
- (add-after 'unpack 'hard-code-path-to-libscrypt
- (lambda* (#:key inputs #:allow-other-keys)
- (let ((openssl (assoc-ref inputs "openssl")))
- (substitute* "oscrypto/__init__.py"
- (("@GUIX_OSCRYPTO_USE_OPENSSL@")
- (string-append openssl "/lib/libcrypto.so" "," openssl "/lib/libssl.so")))
- #t)))
- (add-after 'unpack 'disable-broken-tests
- (lambda _
- ;; This test is broken as there is no keyboard interrupt.
- (substitute* "tests/test_trust_list.py"
- (("^(.*)class TrustListTests" line indent)
- (string-append indent
- "@unittest.skip(\"Disabled by Guix\")\n"
- line)))
- (substitute* "tests/test_tls.py"
- (("^(.*)class TLSTests" line indent)
- (string-append indent
- "@unittest.skip(\"Disabled by Guix\")\n"
- line)))
- #t))
- (replace 'check
- (lambda _
- (invoke "python" "run.py" "tests")
- #t)))))
- (home-page "https://github.com/wbond/oscrypto")
- (synopsis "Compiler-free Python crypto library backed by the OS")
- (description "oscrypto is a compilation-free, always up-to-date encryption library for Python.")
- (license license:expat)))
-
(define-public python-oscryptotests
(package (inherit python-oscrypto)
(name "python-oscryptotests")
@@ -265,7 +207,8 @@ chain for " target " development."))
"1qw2k7xis53179lpqdqyylbcmp76lj7sagp883wmxg5i7chhc96k"))))
(build-system python-build-system)
(propagated-inputs
- (list python-asn1crypto
+ (list openssl
+ python-asn1crypto
python-oscrypto
python-oscryptotests)) ;; certvalidator tests import oscryptotests
(arguments
diff --git a/contrib/guix/patches/oscrypto-hard-code-openssl.patch b/contrib/guix/patches/oscrypto-hard-code-openssl.patch
deleted file mode 100644
index 32027f2d..00000000
--- a/contrib/guix/patches/oscrypto-hard-code-openssl.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/oscrypto/__init__.py b/oscrypto/__init__.py
-index eb27313..371ab24 100644
---- a/oscrypto/__init__.py
-+++ b/oscrypto/__init__.py
-@@ -302,3 +302,8 @@ def load_order():
- 'oscrypto._win.tls',
- 'oscrypto.tls',
- ]
-+
-+
-+paths = '@GUIX_OSCRYPTO_USE_OPENSSL@'.split(',')
-+assert len(paths) == 2, 'Value for OSCRYPTO_USE_OPENSSL env var must be two paths separated by a comma'
-+use_openssl(*paths)
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.