build: Remove CMAKE_SKIP_BUILD_RPATH and SKIP_BUILD_RPATH settings
What the developer wrote
Authored by Henry Romp
build: Remove CMAKE_SKIP_BUILD_RPATH and SKIP_BUILD_RPATH settings
Remove CMake settings that are no longer needed after reordering Guix build script to perform binary checks after installation.
Also removes unused CMake maintenance targets (check-security and check-symbols) and updates security checks to include libexec/ directory binaries (see PR #31679).
What changed, and why it matters
This commit is a build-system cleanup, not a fix for an active security flaw. It removes old CMake settings that forced build-time library paths to be stripped from binaries, because the release build script now runs its security checks after installing the software rather than before. It also removes two unused developer maintenance targets and makes the security checks cover one extra directory (libexec). The change is hygiene work that slightly hardens the build pipeline, but it does not by itself create or close a user-exploitable vulnerability.
No urgent action is required. Reviewers may verify that the Guix release build still passes security-check.py and symbol-check.py on installed binaries, and that installed binaries on NetBSD still resolve their shared libraries correctly without the explicit CMAKE_INSTALL_RPATH_USE_LINK_PATH setting.
Security signals we found
build-system hardening
release pipeline reordering
RPATH handling cleanup
symbol/security check coverage expanded to libexec
no vulnerability fix present in diff
Evidence from the diff
The patch deletes CMAKE_SKIP_BUILD_RPATH and per-target SKIP_BUILD_RPATH overrides in Bitcoin Core’s CMake build. Those settings were previously needed so that the Guix release script’s symbol/security checks (run on build-tree binaries) would not be confused by build-directory RPATH entries. The Guix script has been reordered to install first and then run contrib/guix/security-check.py and contrib/guix/symbol-check.py on installed binaries in bin/ and now also libexec/. The CMake maintenance targets check-security and check-symbols are removed because they are no longer invoked from the release script. NetBSD retains install-RPATH behavior implicitly via CMake defaults. The change is therefore a refactor of the build/release pipeline, not a runtime security patch.
Changed components
CMake build configurationGuix release build script (contrib/guix/libexec/build.sh)CMake Maintenance modulebitcoin-chainstate targettest_kernel targetInspect captured patch +7 / −55
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 3749cf7c..d509d8b3 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -621,18 +621,6 @@ if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.29)
set(CMAKE_SKIP_TEST_ALL_DEPENDENCY FALSE)
endif()
-# TODO: The `CMAKE_SKIP_BUILD_RPATH` variable setting can be deleted
-# in the future after reordering Guix script commands to
-# perform binary checks after the installation step.
-# Relevant discussions:
-# - https://github.com/hebasto/bitcoin/pull/236#issuecomment-2183120953
-# - https://github.com/bitcoin/bitcoin/pull/30312#issuecomment-2191235833
-# NetBSD always requires runtime paths to be set for executables.
-if(CMAKE_SYSTEM_NAME STREQUAL "NetBSD")
- set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)
-else()
- set(CMAKE_SKIP_BUILD_RPATH TRUE)
-endif()
add_subdirectory(test)
add_subdirectory(doc)
@@ -640,7 +628,6 @@ add_subdirectory(src)
include(Maintenance)
setup_split_debug_script()
-add_maintenance_targets()
add_windows_deploy_target()
add_macos_deploy_target()
diff --git a/cmake/module/Maintenance.cmake b/cmake/module/Maintenance.cmake
index 7f29bc94..15fbf2be 100644
--- a/cmake/module/Maintenance.cmake
+++ b/cmake/module/Maintenance.cmake
@@ -18,30 +18,6 @@ function(setup_split_debug_script)
endif()
endfunction()
-function(add_maintenance_targets)
- if(NOT TARGET Python3::Interpreter)
- return()
- endif()
-
- foreach(target IN ITEMS bitcoin bitcoind bitcoin-node bitcoin-qt bitcoin-gui bitcoin-cli bitcoin-tx bitcoin-util bitcoin-wallet test_bitcoin bench_bitcoin)
- if(TARGET ${target})
- list(APPEND executables $<TARGET_FILE:${target}>)
- endif()
- endforeach()
-
- add_custom_target(check-symbols
- COMMAND ${CMAKE_COMMAND} -E echo "Running symbol and dynamic library checks..."
- COMMAND Python3::Interpreter ${PROJECT_SOURCE_DIR}/contrib/guix/symbol-check.py ${executables}
- VERBATIM
- )
-
- add_custom_target(check-security
- COMMAND ${CMAKE_COMMAND} -E echo "Checking binary security..."
- COMMAND Python3::Interpreter ${PROJECT_SOURCE_DIR}/contrib/guix/security-check.py ${executables}
- VERBATIM
- )
-endfunction()
-
function(add_windows_deploy_target)
if(MINGW AND TARGET bitcoin AND TARGET bitcoin-qt AND TARGET bitcoind AND TARGET bitcoin-cli AND TARGET bitcoin-tx AND TARGET bitcoin-wallet AND TARGET bitcoin-util AND TARGET test_bitcoin)
find_program(MAKENSIS_EXECUTABLE makensis)
diff --git a/contrib/guix/libexec/build.sh b/contrib/guix/libexec/build.sh
index 16e12d56..44f6cf6f 100755
--- a/contrib/guix/libexec/build.sh
+++ b/contrib/guix/libexec/build.sh
@@ -248,11 +248,6 @@ mkdir -p "$DISTSRC"
# Build Bitcoin Core
cmake --build build -j "$JOBS" ${V:+--verbose}
- # Perform basic security checks on a series of executables.
- cmake --build build -j 1 --target check-security ${V:+--verbose}
- # Check that executables only contain allowed version symbols.
- cmake --build build -j 1 --target check-symbols ${V:+--verbose}
-
mkdir -p "$OUTDIR"
# Make the os-specific installers
@@ -282,6 +277,13 @@ mkdir -p "$DISTSRC"
;;
esac
+ # Perform basic security checks on installed executables.
+ echo "Checking binary security on installed executables..."
+ python3 "${DISTSRC}/contrib/guix/security-check.py" "${INSTALLPATH}/bin/"* "${INSTALLPATH}/libexec/"*
+ # Check that executables only contain allowed version symbols.
+ echo "Running symbol and dynamic library checks on installed executables..."
+ python3 "${DISTSRC}/contrib/guix/symbol-check.py" "${INSTALLPATH}/bin/"* "${INSTALLPATH}/libexec/"*
+
(
cd installed
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index aed40610..9df51eb9 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -412,15 +412,6 @@ if(BUILD_KERNEL_LIB)
bitcoin-chainstate.cpp
)
add_windows_application_manifest(bitcoin-chainstate)
- # TODO: The `SKIP_BUILD_RPATH` property setting can be deleted
- # in the future after reordering Guix script commands to
- # perform binary checks after the installation step.
- # Relevant discussions:
- # - https://github.com/hebasto/bitcoin/pull/236#issuecomment-2183120953
- # - https://github.com/bitcoin/bitcoin/pull/30312#issuecomment-2191235833
- set_target_properties(bitcoin-chainstate PROPERTIES
- SKIP_BUILD_RPATH OFF
- )
target_link_libraries(bitcoin-chainstate
PRIVATE
core_interface
diff --git a/src/test/kernel/CMakeLists.txt b/src/test/kernel/CMakeLists.txt
index 17900bdd..d2d42dc8 100644
--- a/src/test/kernel/CMakeLists.txt
+++ b/src/test/kernel/CMakeLists.txt
@@ -9,8 +9,4 @@ target_link_libraries(test_kernel
Boost::headers
)
-set_target_properties(test_kernel PROPERTIES
- SKIP_BUILD_RPATH OFF
-)
-
add_test(NAME test_kernel COMMAND test_kernel)
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.