Merge bitcoin/bitcoin#36256: guix: Update osslsigncode to 2.14
What the developer wrote
Authored by Hennadii Stepanov
Merge bitcoin/bitcoin#36256: guix: Update osslsigncode to 2.14
59a465ce37829b2305319b378e8e85c9e653f29a guix: Validate codesigned windows binaries (Ava Chow)
66eeac216ad5b5b8d42a727aa730d7fc603f55fe guix: Use osslsigncode 2.14 (Ava Chow)
Pull request description:
#34550 mistakenly removed the package `nss-certs`. This results in an error during codesigining: `Use the "-CAfile" option to add one or more trusted CA certificates to verify the signature.`
However, introducing the package is not enough to make codesigning work. #34550 switched us to using osslsigncode 2.13 from upstream, but osslsigncode versions 2.6 through 2.13 all require network access as they validate CRLs. While the `verify` command has the ability to skip CRL validation, `attach-signature` does not.
osslsigncode 2.14 resolves both issues for us by removing signature validation, instead it only checks that the hash in the signature matches the hash of the binary. But we still want to do a belt-and-suspenders signature validation, and we can achieve this by calling `verify` afterwards with CRL validation disabled to avoid the network access issue, along with including the `nss-certs` package.
Lastly, guix upstream already has 2.14, so we could get it by bumping the time-machine commit. But it seems like bumping that is problematic for other packages, see #36233 and #35855. Instead, this PR copies in the package definition from upstream.
ACKs for top commit:
Sjors:
re-utACK 59a465ce37829b2305319b378e8e85c9e653f29a
hebasto:
re-ACK 59a465ce37829b2305319b378e8e85c9e653f29a, tested the signed installer on Windows:
Tree-SHA512: 4c5915aa23b5a9ace37003b72ce94a1b1711c39503e4793d4145fb99d96180329056902f94c29094986a4ea57217cffef6deb51e4f4bb4e9a7fcdc9bae38568a
What changed, and why it matters
This change updates the Windows code-signing tool used in Bitcoin Core's reproducible build process. It fixes a build-time failure where signature verification could not complete because a certificate package was missing and the old tool version required internet access. The patch adds the missing certificates package, upgrades the signing tool to version 2.14, and changes the verification step so it no longer needs network access. This is a build-infrastructure reliability fix, not a vulnerability in the Bitcoin software users run.
No immediate action required for end users or node operators. Build maintainers should ensure the new osslsigncode 2.14 package definition and nss-certs dependency are present in their Guix environment and that Windows release builds still produce valid signatures. Reviewers may want to confirm the pinned osslsigncode 2.14 source hash matches upstream.
Security signals we found
Tooling update in release signing pipeline
Restores CA certificate store for signature verification
Disables CRL/CDP network lookups during verification
No change to consensus, P2P, wallet, or RPC code
Evidence from the diff
The commit updates Guix codesigning infrastructure for Windows targets. It reintroduces nss-certs (removed in #34550), defines and uses osslsigncode 2.14 instead of the Guix-default osslsigncode, and splits the previous attach-signature + implicit verification into attach-signature followed by an explicit verify with -ignore-crl and -ignore-cdp. osslsigncode 2.14 itself no longer validates signatures during attach-signature; the added verify step restores belt-and-suspenders validation without network access. The change affects only the release build/codesigning path in contrib/guix.
Changed components
contrib/guix/libexec/codesign.shcontrib/guix/manifest_codesign.scmWindows release binary codesigning workflowInspect captured patch +22 / −2
### contrib/guix/libexec/codesign.sh
@@ -85,8 +85,13 @@ mkdir -p "$DISTSRC"
osslsigncode attach-signature \
-in "${bin}" \
-out "${WORKDIR}/${bin_base/-unsigned}" \
- -CAfile "$GUIX_ENVIRONMENT/etc/ssl/certs/ca-certificates.crt" \
-sigin codesignatures/win/"${bin_base}".pem
+ osslsigncode verify \
+ -CAfile "$GUIX_ENVIRONMENT/etc/ssl/certs/ca-certificates.crt" \
+ -TSA-CAfile "$GUIX_ENVIRONMENT/etc/ssl/certs/ca-certificates.crt" \
+ -ignore-crl \
+ -ignore-cdp \
+ -in "${WORKDIR}/${bin_base/-unsigned}"
done
# Move installer to outdir
### contrib/guix/manifest_codesign.scm
@@ -1,6 +1,7 @@
(use-modules ((gnu packages bash) #:select (bash-minimal))
((gnu packages compression) #:select (gzip zip))
((gnu packages crypto) #:select (osslsigncode))
+ ((gnu packages nss) #:select (nss-certs))
((gnu packages python-build) #:select (python-poetry-core))
((gnu packages python-crypto) #:select (python-asn1crypto python-oscrypto))
((gnu packages tls) #:select (openssl))
@@ -158,6 +159,20 @@ specific moment in time, whitelisting and revocation checks.")
inspecting signatures in Mach-O binaries.")
(license license:expat))))
+(define-public osslsigncode-2.14
+ (package
+ (inherit osslsigncode)
+ (version "2.14")
+ (source
+ (origin
+ (method git-fetch)
+ (uri (git-reference
+ (url "https://github.com/mtrojnar/osslsigncode")
+ (commit version)))
+ (file-name (git-file-name (package-name osslsigncode) version))
+ (sha256
+ (base32 "06ybcp9r8w0algxvvv0mz4h1cjw764b33s9b26n1dhvpl1dqc24c"))))))
+
(packages->manifest
(append
(list ;; The Basics
@@ -173,7 +188,7 @@ inspecting signatures in Mach-O binaries.")
git-minimal)
(let ((target (getenv "HOST")))
(cond ((string-suffix? "-mingw32" target)
- (list osslsigncode))
+ (list osslsigncode-2.14 nss-certs))
((string-contains target "darwin")
(list python-signapple))
(else '())))))Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.