Informational 16 Bitcoin Committed Mar 17, 2026 · 14:47 UTC

guix: update to c5eee3336cc1d10a3cc1c97fde2809c3451624d3

31eb46f0 View source ↗

Public commit record

What the developer wrote

Authored by fanquake

63/100 · Adequate

guix: update to c5eee3336cc1d10a3cc1c97fde2809c3451624d3

Package updates:
binutils 2.41 -> 2.44
diffutils 3.10 -> 3.12
file 5.45 -> 5.46
git-minimal 2.46.0 -> 2.52.0
(base) glibc 2.39 -> 2.41
gzip 1.13 -> 1.14
linux-headers 6.1.119 -> 6.1.166
LLVM/Clang 19.1.4 -> 19.1.7
mingw-w64 12.0.0 -> 13.0.0
nsis 3.10 -> 3.11
python-minimal 3.10 -> 3.11

CMake 4.x becomes available.
Clang/LLVM 20 & 21 become available.

✓ Specific, descriptive subject✓ Provides detailed explanatory context

The short version

What changed, and why it matters

This commit updates the Guix build environment used to create reproducible Bitcoin Core release binaries. It bumps many dependency versions (compiler toolchain, glibc, Python, etc.) and makes the build container's root filesystem writable. There is no direct evidence this fixes a specific security vulnerability in Bitcoin Core itself; it is routine build-system maintenance.

Recommended action

Treat as routine build-system maintenance. Monitor release notes for any follow-up security advisories tied to the upgraded toolchain components. No immediate action required for node operators.

Security signals we found

Dependency version bumps in reproducible build toolchain

Container root filesystem made writable (--writable-root)

Removal of custom gcc-14.3.0 source override

Removal of nss-certs from Windows codesigning inputs

Technical analysis

Evidence from the diff

The commit updates contrib/guix to a newer Guix revision (c5eee3336cc1d10a3cc1c97fde2809c3451624d3), upgrading packages such as binutils, glibc, git-minimal, LLVM/Clang, mingw-w64, python-minimal, and others. It also adds –writable-root to the guix time-machine shell invocations in guix-build and guix-codesign, removes a custom gcc-14.3.0 override in favor of the upstream gcc-14 package, drops nss-certs from the Windows codesigning manifest, and adjusts a winpthreads patch context. The symbol-check.py version check is updated for LLVM 19.1.7.

Changed components

contrib/guix/guix-buildcontrib/guix/guix-codesigncontrib/guix/libexec/prelude.bashcontrib/guix/manifest.scmcontrib/guix/patches/winpthreads-remap-guix-store.patchcontrib/guix/symbol-check.py

Inspect captured patch +16 / −22

diff --git a/contrib/guix/guix-build b/contrib/guix/guix-build
index ee285bf3..bef1c841 100755
--- a/contrib/guix/guix-build
+++ b/contrib/guix/guix-build
@@ -383,6 +383,8 @@ EOF
         #     Running in an isolated container minimizes build-time differences
         #     between machines and improves reproducibility
         #
+        #   --writable-root    make the root filesystem writable
+        #
         #   --pure             unset existing environment variables
         #
         #     Same rationale as --container
@@ -441,6 +443,7 @@ EOF
         # shellcheck disable=SC2086,SC2031
         time-machine shell --manifest="${PWD}/contrib/guix/manifest.scm" \
                                  --container \
+                                 --writable-root \
                                  --pure \
                                  --no-cwd \
                                  --share="$PWD"=/bitcoin \
diff --git a/contrib/guix/guix-codesign b/contrib/guix/guix-codesign
index 791b75c5..39291dfe 100755
--- a/contrib/guix/guix-codesign
+++ b/contrib/guix/guix-codesign
@@ -299,6 +299,8 @@ EOF
         #     Running in an isolated container minimizes build-time differences
         #     between machines and improves reproducibility
         #
+        #   --writable-root    make the root filesystem writable
+        #
         #   --pure             unset existing environment variables
         #
         #     Same rationale as --container
@@ -341,6 +343,7 @@ EOF
         # shellcheck disable=SC2086,SC2031
         time-machine shell --manifest="${PWD}/contrib/guix/manifest.scm" \
                                  --container \
+                                 --writable-root \
                                  --pure \
                                  --no-cwd \
                                  --share="$PWD"=/bitcoin \
diff --git a/contrib/guix/libexec/prelude.bash b/contrib/guix/libexec/prelude.bash
index b7c13cc9..166675e8 100644
--- a/contrib/guix/libexec/prelude.bash
+++ b/contrib/guix/libexec/prelude.bash
@@ -71,7 +71,7 @@ fi
 time-machine() {
     # shellcheck disable=SC2086
     guix time-machine --url=https://codeberg.org/guix/guix.git \
-                      --commit=5cb84f2013c5b1e48a7d0e617032266f1e6059e2 \
+                      --commit=c5eee3336cc1d10a3cc1c97fde2809c3451624d3 \
                       --cores="$JOBS" \
                       --keep-failed \
                       --fallback \
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index 9cadd410..dedfb118 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -1,7 +1,6 @@
 (use-modules (gnu packages)
              ((gnu packages bash) #:select (bash-minimal))
              (gnu packages bison)
-             ((gnu packages certs) #:select (nss-certs))
              ((gnu packages check) #:select (libfaketime))
              ((gnu packages cmake) #:select (cmake-minimal))
              (gnu packages commencement)
@@ -19,7 +18,7 @@
              ((gnu packages python-build) #:select (python-poetry-core))
              ((gnu packages python-crypto) #:select (python-asn1crypto))
              ((gnu packages python-science) #:select (python-scikit-build-core))
-             ((gnu packages python-xyz) #:select (python-pydantic-2))
+             ((gnu packages python-xyz) #:select (python-pydantic))
              ((gnu packages tls) #:select (openssl))
              ((gnu packages version-control) #:select (git-minimal))
              (guix build-system cmake)
@@ -94,17 +93,7 @@ chain for " target " development."))
       (home-page (package-home-page xgcc))
       (license (package-license xgcc)))))
 
-(define base-gcc
-  (package
-    (inherit gcc-14) ;; 14.2.0
-    (version "14.3.0")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "mirror://gnu/gcc/gcc-"
-                                  version "/gcc-" version ".tar.xz"))
-              (sha256
-               (base32
-                "0fna78ly417g69fdm4i5f3ms96g8xzzjza8gwp41lqr5fqlpgp70"))))))
+(define base-gcc gcc-14)
 
 (define base-linux-kernel-headers linux-libre-headers-6.1)
 
@@ -186,7 +175,7 @@ chain for " target " development."))
     (native-inputs (list cmake-minimal
                          ninja
                          python-scikit-build-core
-                         python-pydantic-2))
+                         python-pydantic))
     (arguments
      (list
       #:tests? #f                  ;needs network
@@ -545,7 +534,7 @@ inspecting signatures in Mach-O binaries.")
         gnu-make
         ninja
         ;; Scripting
-        python-minimal ;; (3.10)
+        python-minimal ;; (3.11)
         ;; Git
         git-minimal
         ;; Tests
@@ -555,7 +544,6 @@ inspecting signatures in Mach-O binaries.")
            (list zip
                  (make-mingw-pthreads-cross-toolchain "x86_64-w64-mingw32")
                  nsis-x86_64
-                 nss-certs
                  osslsigncode))
           ((string-contains target "-linux-")
            (list bison
diff --git a/contrib/guix/patches/winpthreads-remap-guix-store.patch b/contrib/guix/patches/winpthreads-remap-guix-store.patch
index e1f1a6eb..4530e5f3 100644
--- a/contrib/guix/patches/winpthreads-remap-guix-store.patch
+++ b/contrib/guix/patches/winpthreads-remap-guix-store.patch
@@ -6,12 +6,12 @@ the package, map all guix store prefixes to something fixed, e.g. /usr.
 
 --- a/mingw-w64-libraries/winpthreads/Makefile.in
 +++ b/mingw-w64-libraries/winpthreads/Makefile.in
-@@ -478,7 +478,7 @@ top_build_prefix = @top_build_prefix@
+@@ -465,7 +465,7 @@ top_build_prefix = @top_build_prefix@
  top_builddir = @top_builddir@
  top_srcdir = @top_srcdir@
  SUBDIRS = . tests
--AM_CFLAGS = -Wall -DWIN32_LEAN_AND_MEAN $(am__append_1)
-+AM_CFLAGS = -Wall -DWIN32_LEAN_AND_MEAN $(am__append_1) $(shell find /gnu/store -maxdepth 1 -mindepth 1 -type d -exec echo -n " -ffile-prefix-map={}=/usr" \;)
+-AM_CFLAGS = $(am__append_1) $(am__append_3)
++AM_CFLAGS = $(am__append_1) $(am__append_3) $(shell find /gnu/store -maxdepth 1 -mindepth 1 -type d -exec echo -n " -ffile-prefix-map={}=/usr" \;)
  ACLOCAL_AMFLAGS = -I m4
  lib_LTLIBRARIES = libwinpthread.la
- include_HEADERS = include/pthread.h include/sched.h include/semaphore.h include/pthread_unistd.h include/pthread_time.h include/pthread_compat.h include/pthread_signal.h
+ include_HEADERS = \
diff --git a/contrib/guix/symbol-check.py b/contrib/guix/symbol-check.py
index 93002ddc..d31d5aa8 100755
--- a/contrib/guix/symbol-check.py
+++ b/contrib/guix/symbol-check.py
@@ -241,7 +241,7 @@ def check_MACHO_sdk(binary) -> bool:
     return False
 
 def check_MACHO_lld(binary) -> bool:
-    if binary.build_version.tools[0].version == [19, 1, 4]:
+    if binary.build_version.tools[0].version == [19, 1, 7]:
         return True
     return False

Risk score

Why this scored 16/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 2/15

Confidence 7/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 16/100

Community notes

Related watches

test: test the result order of a multiple import request is correct

test: test invalid or missing timestamp throws importdescriptors

ci, iwyu: Enforce warning-free `src/common`