guix: disable building libgomp in GCC
What the developer wrote
Authored by fanquake
guix: disable building libgomp in GCC
Prunes:
libgomp.a
libgomp.la
libgomp.so
libgomp.so.1
libgomp.so.1.0.0
libgomp.spec
What changed, and why it matters
This commit changes the build setup for Bitcoin Core's Guix deterministic build environment so that GCC no longer builds the libgomp library. libgomp is the GNU Offloading and Multi Processing Runtime Library, used for OpenMP parallel programming. Removing it reduces the attack surface and build artifacts, but there is no direct evidence in the commit that a specific vulnerability is being fixed.
No immediate action required for users. For builders/developers, verify that release builds remain deterministic and that no required functionality depended on libgomp. Treat as routine hardening.
Security signals we found
Reduction of build-time attack surface by disabling an unused OpenMP runtime
Pruning of toolchain artifacts that could theoretically be exploited or linked unexpectedly
No direct security bug fix or vulnerability reference present in commit
Evidence from the diff
The patch adds --disable-libgomp to the GCC configure flags in contrib/guix/manifest.scm for both base-gcc and linux-base-gcc. This prevents the Guix build of GCC from producing libgomp static/shared libraries and related files. The change is a hardening/pruning measure rather than a fix for a known exploitable bug in Bitcoin Core itself. It may reduce supply-chain risk by excluding an unneeded runtime library from the toolchain outputs used to build release binaries.
Changed components
contrib/guix/manifest.scmGuix-based deterministic build toolchainGCC build configurationInspect captured patch +2 / −0
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index 011ba0de..760b1a25 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -422,6 +422,7 @@ inspecting signatures in Mach-O binaries.")
(list "--enable-threads=posix",
"--enable-default-ssp=yes",
"--disable-gcov",
+ "--disable-libgomp",
building-on)))))))
(define-public linux-base-gcc
@@ -438,6 +439,7 @@ inspecting signatures in Mach-O binaries.")
"--enable-standard-branch-protection=yes",
"--enable-cet=yes",
"--disable-gcov",
+ "--disable-libgomp",
"--disable-libsanitizer",
building-on)))
((#:phases phases)
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.