guix: documented shasum gathering command
What the developer wrote
Authored by janb84
guix: documented shasum gathering command
What changed, and why it matters
This commit only adds documentation to a README file explaining how developers can collect SHA-256 checksums of build outputs. It is a pure documentation change with no code modifications and no security relevance.
No action needed; this is a documentation-only change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff adds a new section to contrib/guix/README.md describing how to gather SHA256SUMS files produced by Guix builds and print them to the console. No executable code, build scripts, cryptographic logic, or network-facing components are changed.
Changed components
contrib/guix/README.mdInspect captured patch +12 / −0
diff --git a/contrib/guix/README.md b/contrib/guix/README.md
index 7f6b8232..cce00ddc 100644
--- a/contrib/guix/README.md
+++ b/contrib/guix/README.md
@@ -103,6 +103,18 @@ worktree to save disk space:
./contrib/guix/guix-clean
```
+## Gathering shasums of build outputs
+
+After a successful build, the shasums of the build outputs are gathered
+into files named `SHA256SUMS`. These files are located in each of the
+architecture-specific output directories.
+
+To gather all shasums and output them together to console, for e.g.
+inclusion in a Guix pull request comment, run:
+
+``` sh
+source contrib/shell/git-utils.bash && uname -m && find guix-build-$(git_head_version)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
+```
## Attesting to build outputs
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.