What the developer wrote
Authored by fanquake
guix: use latest glibc 2.31
https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.31/master.
What changed, and why it matters
This commit updates the version of the GNU C library (glibc) used in Bitcoin Core's reproducible build system (Guix) from one specific 2.31 snapshot to a newer 2.31 snapshot. It changes a commit hash and its corresponding cryptographic hash in a build manifest. There is no direct evidence in the commit that this fixes a specific security vulnerability; it appears to be a routine dependency refresh within the same glibc release branch.
Treat as a routine build dependency update. Review the upstream glibc 2.31 shortlog at the referenced URL to determine whether the newer snapshot includes any security fixes relevant to the build environment. If the snapshot includes security fixes, consider expediting the update in release builds; otherwise, no immediate security action is required.
Security signals we found
Dependency update (glibc 2.31 snapshot refresh)
No explicit security claim in commit message
No CVE or advisory referenced in commit
Build-system-only change (Guix manifest)
Same major/minor glibc version (2.31)
Evidence from the diff
The patch modifies contrib/guix/manifest.scm, which defines the Guix package used to build Bitcoin Core. It updates the glibc-2.31 package definition to point to a newer upstream commit (28eb5caf895ced5d895cb02757e109004a2d33e5) on the release/2.31/master branch and updates the base32 sha256 checksum accordingly. The change is a point update within the glibc 2.31 release branch, not a major version upgrade. No security advisory, CVE, or vulnerability description is present in the commit message or diff.
Changed components
contrib/guix/manifest.scmBitcoin Core Guix reproducible build environmentglibc 2.31 package used in build toolchainInspect captured patch +2 / −2
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index acebaf2d..710178dd 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -335,7 +335,7 @@ inspecting signatures in Mach-O binaries.")
#t))))))))
(define-public glibc-2.31
- (let ((commit "7b27c450c34563a28e634cccb399cd415e71ebfe"))
+ (let ((commit "28eb5caf895ced5d895cb02757e109004a2d33e5"))
(package
(inherit glibc) ;; 2.39
(version "2.31")
@@ -347,7 +347,7 @@ inspecting signatures in Mach-O binaries.")
(file-name (git-file-name "glibc" commit))
(sha256
(base32
- "017qdpr5id7ddb4lpkzj2li1abvw916m3fc6n7nw28z4h5qbv2n0"))
+ "07arjrc1smqy8wrhg38apr1s9ji7xv1rpzdapk4k2ps2n07irp58"))
(patches (search-our-patches "glibc-guix-prefix.patch"
"glibc-riscv-jumptarget.patch"))))
(arguments
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.