What the developer wrote
Authored by fanquake
guix: disable gprofng in GCC
What changed, and why it matters
This commit changes the build recipe used by Guix (a reproducible-build system) to compile GCC with gprofng disabled. gprofng is a newer profiling tool bundled with some GCC versions. The change is a hardening/packaging tweak: it removes an unneeded component from the compiler used to build Bitcoin Core releases, reducing the attack surface and build-time dependencies. There is no direct evidence in the commit or supplied references that this fixes a known exploitable vulnerability.
Treat as routine hardening. Monitor upstream GCC/binutils security advisories for gprofng; if a future CVE is disclosed, verify whether this change mitigates it. No immediate action required for Bitcoin Core operators.
Security signals we found
Build-hardening change (reduces toolchain attack surface)
Disables optional profiling component (gprofng) in GCC
No CVE, advisory, or security rationale in commit metadata
Single-line change in Guix manifest only
Evidence from the diff
The patch adds --enable-gprofng=no to the GCC configure flags in contrib/guix/manifest.scm. gprofng is the next-generation GNU profiler, introduced in binutils/gprof and optionally built with GCC. Disabling it in the toolchain used for deterministic Bitcoin Core builds reduces the set of libraries and tools included in the build environment. This is consistent with a defense-in-depth / minimal-toolchain hardening measure rather than a patch for a specific CVE. The commit message gives no CVE, no bug reference, and no security rationale.
Changed components
contrib/guix/manifest.scmGCC toolchain build configuration for Guix deterministic buildsInspect captured patch +1 / −0
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index fd0e2e6a..7fe9430c 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -440,6 +440,7 @@ inspecting signatures in Mach-O binaries.")
"--enable-host-bind-now=yes",
"--enable-standard-branch-protection=yes",
"--enable-cet=yes",
+ "--enable-gprofng=no",
"--disable-gcov",
"--disable-libgomp",
"--disable-libquadmath",
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.