guix: switch to upstream osslsigncode package
What the developer wrote
Authored by fanquake
guix: switch to upstream osslsigncode package
What changed, and why it matters
This change removes a custom Guix package definition for osslsigncode (a Windows code-signing tool) and instead uses the version already maintained in upstream Guix. It is a build-system maintenance cleanup, not a security fix. The old custom package had a workaround for tests that would fail after the year 2025, but that workaround is being removed because the upstream Guix package presumably handles it. There is no direct evidence in the commit of a vulnerability or attack.
No immediate security action required. Reviewers may want to confirm that the upstream Guix osslsigncode package is at a current, trusted version and that reproducible Windows release builds still produce identical signatures. This is ordinary build hygiene.
Security signals we found
No security-relevant code change in Bitcoin Core itself
Build dependency management only (Guix manifest)
Removal of a pinned third-party package in favor of upstream Guix package
No CVE, advisory, or vendor security disclosure referenced in commit
Evidence from the diff
The commit deletes an inline osslsigncode package definition from contrib/guix/manifest.scm and imports (gnu packages crypto)’s osslsigncode instead. The deleted definition pinned osslsigncode 2.5 from mtrojnar/osslsigncode and used libfaketime to force a fake date of 2025-01-01 during tests because the test suite would fail after 2025. The patch removes the libfaketime select and the inline package. No source code of Bitcoin Core is changed, and no cryptographic or consensus code is touched.
Changed components
contrib/guix/manifest.scmGuix reproducible build environment for Windows signing (osslsigncode)Inspect captured patch +1 / −33
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index dedfb118..4e029113 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -1,11 +1,11 @@
(use-modules (gnu packages)
((gnu packages bash) #:select (bash-minimal))
(gnu packages bison)
- ((gnu packages check) #:select (libfaketime))
((gnu packages cmake) #:select (cmake-minimal))
(gnu packages commencement)
(gnu packages compression)
(gnu packages cross-base)
+ ((gnu packages crypto) #:select (osslsigncode))
(gnu packages gawk)
(gnu packages gcc)
((gnu packages installers) #:select (nsis-x86_64))
@@ -195,38 +195,6 @@ chain for " target " development."))
and abstract ELF, PE and MachO formats.")
(license license:asl2.0)))
-(define osslsigncode
- (package
- (name "osslsigncode")
- (version "2.5")
- (source (origin
- (method git-fetch)
- (uri (git-reference
- (url "https://github.com/mtrojnar/osslsigncode")
- (commit version)))
- (sha256
- (base32
- "1j47vwq4caxfv0xw68kw5yh00qcpbd56d7rq6c483ma3y7s96yyz"))))
- (build-system cmake-build-system)
- (arguments
- (list
- #:phases
- #~(modify-phases %standard-phases
- (replace 'check
- (lambda* (#:key tests? #:allow-other-keys)
- (if tests?
- (invoke "faketime" "-f" "@2025-01-01 00:00:00" ;; Tests fail after 2025.
- "ctest" "--output-on-failure" "--no-tests=error")
- (format #t "test suite not run~%")))))))
- (inputs (list libfaketime openssl))
- (home-page "https://github.com/mtrojnar/osslsigncode")
- (synopsis "Authenticode signing and timestamping tool")
- (description "osslsigncode is a small tool that implements part of the
-functionality of the Microsoft tool signtool.exe - more exactly the Authenticode
-signing and timestamping. But osslsigncode is based on OpenSSL and cURL, and
-thus should be able to compile on most platforms where these exist.")
- (license license:gpl3+))) ; license is with openssl exception
-
(define-public python-elfesteem
(let ((commit "2eb1e5384ff7a220fd1afacd4a0170acff54fe56"))
(package
Why this scored 14/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.