guix, refactor: Add `BASE` argument to `*_for_host` functions

Bitcoin Core/Bitcoin Core

62cf7bc5 View source ↗

Public commit record

What the developer wrote

Authored by Hennadii Stepanov

50/100 · Thin

guix, refactor: Add `BASE` argument to `*_for_host` functions

✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body

The short version

What changed, and why it matters

This commit is a straightforward internal cleanup of the Bitcoin Core Guix build scripts. It changes how directory paths are computed by adding an optional BASE argument to helper functions, replacing a temporary environment-variable trick. There is no change to how Bitcoin validates transactions, handles network data, or stores wallets, and nothing in the commit suggests a security fix or vulnerability.

Recommended action

No security action needed. Treat as normal build-system refactoring during routine review.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The patch refactors three Guix-related shell scripts. Previously, callers overrode DISTSRC_BASE/OUTDIR_BASE inline (e.g., DISTSRC_BASE=/distsrc-base && distsrc_for_host “$HOST”). The refactor adds a third optional BASE parameter to distsrc_for_host and outdir_for_host, and a second BASE parameter to codesigning_tarball_for_host, so callers pass the base path directly. It also removes now-unnecessary shellcheck SC2030/SC2031 suppressions. The computed paths remain the same; only the implementation style changed.

Changed components

contrib/guix/guix-buildcontrib/guix/guix-codesigncontrib/guix/libexec/prelude.bash

Inspect captured patch +24 / −19

diff --git a/contrib/guix/guix-build b/contrib/guix/guix-build
index eed9d459..1ab9cc7e 100755
--- a/contrib/guix/guix-build
+++ b/contrib/guix/guix-build
@@ -321,7 +321,6 @@ for host in $HOSTS; do
         # for the particular $HOST we're building for
         export HOST="$host"
 
-        # shellcheck disable=SC2030
 cat << EOF
 INFO: Building ${VERSION:?not set} for platform triple ${HOST:?not set}:
       ...using reference timestamp: ${SOURCE_DATE_EPOCH:?not set}
@@ -329,9 +328,9 @@ INFO: Building ${VERSION:?not set} for platform triple ${HOST:?not set}:
       ...from worktree directory: '${PWD}'
           ...bind-mounted in container to: '/bitcoin'
       ...in build directory: '$(distsrc_for_host "$HOST")'
-          ...bind-mounted in container to: '$(DISTSRC_BASE=/distsrc-base && distsrc_for_host "$HOST")'
+          ...bind-mounted in container to: '$(distsrc_for_host "$HOST" "" /distsrc-base)'
       ...outputting in: '$(outdir_for_host "$HOST")'
-          ...bind-mounted in container to: '$(OUTDIR_BASE=/outdir-base && outdir_for_host "$HOST")'
+          ...bind-mounted in container to: '$(outdir_for_host "$HOST" "" /outdir-base)'
       ADDITIONAL FLAGS (if set)
           ADDITIONAL_GUIX_COMMON_FLAGS: ${ADDITIONAL_GUIX_COMMON_FLAGS}
           ADDITIONAL_GUIX_ENVIRONMENT_FLAGS: ${ADDITIONAL_GUIX_ENVIRONMENT_FLAGS}
@@ -405,7 +404,7 @@ EOF
         #    Please read the README.md in the same directory as this file for
         #    more information.
         #
-        # shellcheck disable=SC2086,SC2031
+        # shellcheck disable=SC2086
         time-machine shell --manifest="${PWD}/contrib/guix/manifest_build.scm" \
                                  --container \
                                  --writable-root \
@@ -433,8 +432,8 @@ EOF
                                         ${SOURCES_PATH:+SOURCES_PATH="$SOURCES_PATH"} \
                                         ${BASE_CACHE:+BASE_CACHE="$BASE_CACHE"} \
                                         ${SDK_PATH:+SDK_PATH="$SDK_PATH"} \
-                                        DISTSRC="$(DISTSRC_BASE=/distsrc-base && distsrc_for_host "$HOST")" \
-                                        OUTDIR="$(OUTDIR_BASE=/outdir-base && outdir_for_host "$HOST")" \
+                                        DISTSRC="$(distsrc_for_host "$HOST" "" /distsrc-base)" \
+                                        OUTDIR="$(outdir_for_host "$HOST" "" /outdir-base)" \
                                         DIST_ARCHIVE_BASE=/outdir-base/dist-archive \
                                       bash -c "cd /bitcoin && bash contrib/guix/libexec/build.sh"
     )
diff --git a/contrib/guix/guix-codesign b/contrib/guix/guix-codesign
index 1ceb65d6..8cc6993b 100755
--- a/contrib/guix/guix-codesign
+++ b/contrib/guix/guix-codesign
@@ -138,13 +138,18 @@ fi
 # Codesigning tarballs SHOULD exist
 ################
 
+# Usage: codesigning_tarball_for_host HOST [BASE]
+#
+#   HOST: The current platform triple we're building for
+#   BASE: Optional. If provided, replaces ${OUTDIR_BASE}
+#
 codesigning_tarball_for_host() {
     case "$1" in
         *mingw*)
-            echo "$(outdir_for_host "$1")/${DISTNAME}-win64-codesigning.tar.gz"
+            echo "$(outdir_for_host "$1" "" "$2")/${DISTNAME}-win64-codesigning.tar.gz"
             ;;
         *darwin*)
-            echo "$(outdir_for_host "$1")/${DISTNAME}-${1}-codesigning.tar.gz"
+            echo "$(outdir_for_host "$1" "" "$2")/${DISTNAME}-${1}-codesigning.tar.gz"
             ;;
         *)
             exit 1
@@ -249,16 +254,15 @@ for host in $HOSTS; do
         # for the particular $HOST we're building for
         export HOST="$host"
 
-        # shellcheck disable=SC2030
 cat << EOF
 INFO: Codesigning ${VERSION:?not set} for platform triple ${HOST:?not set}:
       ...using reference timestamp: ${SOURCE_DATE_EPOCH:?not set}
       ...from worktree directory: '${PWD}'
           ...bind-mounted in container to: '/bitcoin'
       ...in build directory: '$(distsrc_for_host "$HOST" codesigned)'
-          ...bind-mounted in container to: '$(DISTSRC_BASE=/distsrc-base && distsrc_for_host "$HOST" codesigned)'
+          ...bind-mounted in container to: '$(distsrc_for_host "$HOST" codesigned /distsrc-base)'
       ...outputting in: '$(outdir_for_host "$HOST" codesigned)'
-          ...bind-mounted in container to: '$(OUTDIR_BASE=/outdir-base && outdir_for_host "$HOST" codesigned)'
+          ...bind-mounted in container to: '$(outdir_for_host "$HOST" codesigned /outdir-base)'
       ...using detached signatures in: '${DETACHED_SIGS_REPO:?not set}'
           ...bind-mounted in container to: '/detached-sigs'
 EOF
@@ -315,7 +319,7 @@ EOF
         #    Please read the README.md in the same directory as this file for
         #    more information.
         #
-        # shellcheck disable=SC2086,SC2031
+        # shellcheck disable=SC2086
         time-machine shell --manifest="${PWD}/contrib/guix/manifest_codesign.scm" \
                                  --container \
                                  --writable-root \
@@ -339,11 +343,11 @@ EOF
                                         JOBS="$JOBS" \
                                         SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:?unable to determine value}" \
                                         ${V:+V=1} \
-                                        DISTSRC="$(DISTSRC_BASE=/distsrc-base && distsrc_for_host "$HOST" codesigned)" \
-                                        OUTDIR="$(OUTDIR_BASE=/outdir-base && outdir_for_host "$HOST" codesigned)" \
+                                        DISTSRC="$(distsrc_for_host "$HOST" codesigned /distsrc-base)" \
+                                        OUTDIR="$(outdir_for_host "$HOST" codesigned /outdir-base)" \
                                         DIST_ARCHIVE_BASE=/outdir-base/dist-archive \
                                         DETACHED_SIGS_REPO=/detached-sigs \
-                                        CODESIGNING_TARBALL="$(OUTDIR_BASE=/outdir-base && codesigning_tarball_for_host "$HOST")" \
+                                        CODESIGNING_TARBALL="$(codesigning_tarball_for_host "$HOST" /outdir-base)" \
                                       bash -c "cd /bitcoin && bash contrib/guix/libexec/codesign.sh"
     )
 
diff --git a/contrib/guix/libexec/prelude.bash b/contrib/guix/libexec/prelude.bash
index 21e668cf..c89af174 100644
--- a/contrib/guix/libexec/prelude.bash
+++ b/contrib/guix/libexec/prelude.bash
@@ -80,22 +80,24 @@ time-machine() {
                       -- "$@"
 }
 
-# Usage: distsrc_for_host HOST [SUFFIX]
+# Usage: distsrc_for_host HOST [SUFFIX] [BASE]
 #
 #   HOST: The current platform triple we're building for
 #   SUFFIX: Optional. If provided, appended to the directory name as "-SUFFIX"
+#   BASE: Optional. If provided, replaces ${DISTSRC_BASE}
 #
 distsrc_for_host() {
-    echo "${DISTSRC_BASE}/distsrc-${VERSION}-${1}${2:+-${2}}"
+    echo "${3:-${DISTSRC_BASE}}/distsrc-${VERSION}-${1}${2:+-${2}}"
 }
 
-# Usage: outdir_for_host HOST [SUFFIX]
+# Usage: outdir_for_host HOST [SUFFIX] [BASE]
 #
 #   HOST: The current platform triple we're building for
 #   SUFFIX: Optional. If provided, appended to the directory name as "-SUFFIX"
+#   BASE: Optional. If provided, replaces ${OUTDIR_BASE}
 #
 outdir_for_host() {
-    echo "${OUTDIR_BASE}/${1}${2:+-${2}}"
+    echo "${3:-${OUTDIR_BASE}}/${1}${2:+-${2}}"
 }
 
 # Usage: profiledir_for_host HOST [SUFFIX]

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

test: test the result order of a multiple import request is correct

test: test invalid or missing timestamp throws importdescriptors

ci, iwyu: Enforce warning-free `src/common`