guix: mirror some arguments from linux-gcc to mingw-w64-gcc
What the developer wrote
Authored by fanquake
guix: mirror some arguments from linux-gcc to mingw-w64-gcc
What changed, and why it matters
This commit adjusts the build settings used to compile the Windows version of Bitcoin Core's toolchain. It copies some hardening and cleanup options from the Linux build configuration to the Windows (MinGW) build configuration, and reorders others. There is no direct evidence this fixes an active security vulnerability; it appears to be a build-hardening and consistency improvement.
No urgent action required. Treat as a routine build-hardening improvement. Review whether the added flags materially change produced Windows binaries and include in normal release testing. If a security advisory is later published, reassess.
Security signals we found
Adds stack-smashing protection default (--enable-default-ssp=yes) to Windows toolchain
Adds host bind-now hardening (--enable-host-bind-now=yes) to Windows toolchain
Disables unused/extra runtime components (gcov, libgomp, lto, nls, libsanitizer, gprofng) in Windows toolchain
Build-hardening alignment between Linux and Windows release toolchains
Evidence from the diff
The change modifies contrib/guix/manifest_build.scm, which defines how Guix builds the GCC cross-compiler toolchains for Bitcoin Core releases. For the mingw-w64 (Windows) toolchain, it mirrors flags already used by the linux-gcc toolchain: adds –enable-default-ssp=yes, –enable-host-bind-now=yes, –disable-gcov, –disable-libgomp, –disable-lto, –disable-nls, and reorders existing flags. It also adds –enable-gprofng=no and –disable-libsanitizer to mingw-w64, matching the linux-gcc side. For linux-gcc, it only reorders existing flags and adds no new ones. The practical effect is more consistent compiler hardening and reduced attack surface in the Windows release toolchain, but the commit message does not frame this as a security fix.
Changed components
contrib/guix/manifest_build.scmWindows (mingw-w64) release toolchain build configurationGCC cross-compiler build flags for Bitcoin Core Guix releasesInspect captured patch +7 / −5
diff --git a/contrib/guix/manifest_build.scm b/contrib/guix/manifest_build.scm
index d465b5e2..53e70ac0 100644
--- a/contrib/guix/manifest_build.scm
+++ b/contrib/guix/manifest_build.scm
@@ -167,11 +167,13 @@ chain for " target " development."))
((#:configure-flags flags)
#~(append #$flags
;; https://gcc.gnu.org/install/configure.html
- (list "--enable-threads=posix"
- "--enable-default-ssp=yes"
+ (list "--enable-default-ssp=yes"
+ "--enable-gprofng=no"
"--enable-host-bind-now=yes"
+ "--enable-threads=posix"
"--disable-gcov"
"--disable-libgomp"
+ "--disable-libsanitizer"
"--disable-lto"
"--disable-nls"
#$building-on)))))))
@@ -184,13 +186,13 @@ chain for " target " development."))
((#:configure-flags flags)
#~(append #$flags
;; https://gcc.gnu.org/install/configure.html
- (list "--enable-initfini-array=yes"
+ (list "--enable-cet=yes"
"--enable-default-ssp=yes"
"--enable-default-pie=yes"
+ "--enable-gprofng=no"
"--enable-host-bind-now=yes"
+ "--enable-initfini-array=yes"
"--enable-standard-branch-protection=yes"
- "--enable-cet=yes"
- "--enable-gprofng=no"
"--disable-gcov"
"--disable-libgomp"
"--disable-libquadmath"
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.