guix: update time-machine to 5cb84f2013c5b1e48a7d0e617032266f1e6059e2
What the developer wrote
Authored by fanquake
guix: update time-machine to 5cb84f2013c5b1e48a7d0e617032266f1e6059e2
Package updates:
(base) glibc 2.35 -> 2.39
binutils 2.38 -> 2.41
diffutils 3.8 -> 3.10
gawk 5.2.1 -> 5.3.0
git-minimal 2.45.2 -> 2.46.0
grep 3.8 -> 3.11
gzip 1.12 -> 1.13
linux-headers 6.1.106 -> 6.1.119
make 4.3 -> 4.4.1
xz 5.2.8 -> 5.4.5
CMake 3.30 becomes available.
Clang/LLVM 19 becomes available.
What changed, and why it matters
This commit updates the Guix build environment used to create reproducible Bitcoin Core release binaries. It moves to a newer Guix snapshot and newer toolchain packages (like glibc, binutils, and compiler tools). There is no direct evidence in the commit that this fixes a specific security vulnerability, but keeping build dependencies current is a normal defensive maintenance practice that can reduce exposure to known bugs in older components.
Treat as routine build-system maintenance. Monitor Guix and upstream toolchain release notes for any security advisories associated with the bumped package versions. No immediate code-level action is required beyond normal review and CI validation of reproducible builds.
Security signals we found
Dependency/toolchain version bumps in reproducible build environment
No explicit security claim, CVE, or advisory in commit message
No diff evidence of vulnerability fix or behavior change in Bitcoin Core code
Evidence from the diff
The change updates contrib/guix/libexec/prelude.bash to pin guix time-machine to commit 5cb84f2013c5b1e48a7d0e617032266f1e6059e2 and updates a comment in contrib/guix/manifest.scm to reflect that the inherited glibc is now 2.39. The commit message lists package version bumps for the Guix bootstrap/toolchain environment, including glibc 2.35→2.39, binutils 2.38→2.41, git-minimal, linux-headers, xz, and notes that CMake 3.30 and Clang/LLVM 19 become available. No vulnerability, CVE, or security advisory is mentioned in the commit or supplied references.
Changed components
contrib/guix/libexec/prelude.bashcontrib/guix/manifest.scmGuix reproducible build environmentInspect captured patch +2 / −2
diff --git a/contrib/guix/libexec/prelude.bash b/contrib/guix/libexec/prelude.bash
index d25c371a..b7c13cc9 100644
--- a/contrib/guix/libexec/prelude.bash
+++ b/contrib/guix/libexec/prelude.bash
@@ -71,7 +71,7 @@ fi
time-machine() {
# shellcheck disable=SC2086
guix time-machine --url=https://codeberg.org/guix/guix.git \
- --commit=53396a22afc04536ddf75d8f82ad2eafa5082725 \
+ --commit=5cb84f2013c5b1e48a7d0e617032266f1e6059e2 \
--cores="$JOBS" \
--keep-failed \
--fallback \
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index 795e45dc..469a332e 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -455,7 +455,7 @@ inspecting signatures in Mach-O binaries.")
(define-public glibc-2.31
(let ((commit "7b27c450c34563a28e634cccb399cd415e71ebfe"))
(package
- (inherit glibc) ;; 2.35
+ (inherit glibc) ;; 2.39
(version "2.31")
(source (origin
(method git-fetch)
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.