macdeploy: disable compression in macOS gen-sdk script
What changed, and why it matters
This commit changes the macOS SDK packaging script for Bitcoin Core so that it produces an uncompressed .tar archive instead of a .tar.gz archive. The reason is that different Linux distributions use different underlying compression libraries, which can produce slightly different compressed files even from identical input. That breaks reproducible builds (determinism), where everyone expects the exact same output. The uncompressed archive is larger (~157 MB) but byte-for-byte identical across machines. There is no security vulnerability being fixed here.
No security action required. Treat as a normal build-system reproducibility improvement. Reviewers may verify that the new uncompressed SDK tarball still extracts correctly and that CI caches/URLs are updated to match the .tar filename.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies contrib/macdeploy/gen-sdk to remove gzip compression and switch the tar format from GNU_FORMAT to PAX_FORMAT. It updates CI install and documentation references from .tar.gz to .tar and refreshes the expected SHA-256. The stated motivation is restoring build determinism: starting with Python 3.11, gzip.compress may delegate to zlib, and OS-level zlib implementations (e.g., Ubuntu vs. Fedora) can yield different compressed output for the same input. By disabling compression, the resulting SDK tarball becomes deterministic across build environments. This is a build-system/reproducibility change, not a code or cryptography change.
Changed components
contrib/macdeploy/gen-sdkci/test/01_base_install.shcontrib/guix/README.mdcontrib/macdeploy/README.mdInspect captured patch +15 / −22
diff --git a/ci/test/01_base_install.sh b/ci/test/01_base_install.sh
index 9bb67aa5..a0f4164b 100755
--- a/ci/test/01_base_install.sh
+++ b/ci/test/01_base_install.sh
@@ -90,7 +90,7 @@ mkdir -p "${DEPENDS_DIR}/SDKs" "${DEPENDS_DIR}/sdk-sources"
OSX_SDK_BASENAME="Xcode-${XCODE_VERSION}-${XCODE_BUILD_ID}-extracted-SDK-with-libcxx-headers"
if [ -n "$XCODE_VERSION" ] && [ ! -d "${DEPENDS_DIR}/SDKs/${OSX_SDK_BASENAME}" ]; then
- OSX_SDK_FILENAME="${OSX_SDK_BASENAME}.tar.gz"
+ OSX_SDK_FILENAME="${OSX_SDK_BASENAME}.tar"
OSX_SDK_PATH="${DEPENDS_DIR}/sdk-sources/${OSX_SDK_FILENAME}"
if [ ! -f "$OSX_SDK_PATH" ]; then
${CI_RETRY_EXE} curl --location --fail "${SDK_URL}/${OSX_SDK_FILENAME}" -o "$OSX_SDK_PATH"
diff --git a/contrib/guix/README.md b/contrib/guix/README.md
index 7f6b8232..aadc231e 100644
--- a/contrib/guix/README.md
+++ b/contrib/guix/README.md
@@ -37,7 +37,7 @@ You can then either point to the SDK using the `SDK_PATH` environment variable:
```sh
# Extract the SDK tarball to /path/to/parent/dir/of/extracted/SDK/Xcode-<foo>-<bar>-extracted-SDK-with-libcxx-headers
-tar -C /path/to/parent/dir/of/extracted/SDK -xaf /path/to/Xcode-<foo>-<bar>-extracted-SDK-with-libcxx-headers.tar.gz
+tar -C /path/to/parent/dir/of/extracted/SDK -xaf /path/to/Xcode-<foo>-<bar>-extracted-SDK-with-libcxx-headers.tar
# Indicate where to locate the SDK tarball
export SDK_PATH=/path/to/parent/dir/of/extracted/SDK
diff --git a/contrib/macdeploy/README.md b/contrib/macdeploy/README.md
index 3cbf5b50..a4723861 100644
--- a/contrib/macdeploy/README.md
+++ b/contrib/macdeploy/README.md
@@ -51,8 +51,8 @@ path to `Xcode.app` (extracted in the previous stage) as the first argument.
./contrib/macdeploy/gen-sdk '/path/to/Xcode.app'
```
-The generated archive should be: `Xcode-15.0-15A240d-extracted-SDK-with-libcxx-headers.tar.gz`.
-The `sha256sum` should be `5aa41897b7f00abdaf1ece242dde3eb96a395746c09638b3a59720694712387d`.
+The generated archive should be: `Xcode-15.0-15A240d-extracted-SDK-with-libcxx-headers.tar`.
+The `sha256sum` should be `95b00dc41fa090747dc0a7907a5031a2fcb2d7f95c9584ba6bccdb99b6e3d498`.
## Deterministic macOS App Notes
diff --git a/contrib/macdeploy/gen-sdk b/contrib/macdeploy/gen-sdk
index f2693691..cf379292 100755
--- a/contrib/macdeploy/gen-sdk
+++ b/contrib/macdeploy/gen-sdk
@@ -2,9 +2,7 @@
import argparse
import plistlib
import pathlib
-import sys
import tarfile
-import gzip
import os
import contextlib
@@ -22,12 +20,12 @@ def run():
parser = argparse.ArgumentParser(
description=__doc__, formatter_class=argparse.RawTextHelpFormatter)
- parser.add_argument('xcode_app', metavar='XCODEAPP', nargs=1)
- parser.add_argument("-o", metavar='OUTSDKTGZ', nargs=1, dest='out_sdktgz', required=False)
+ parser.add_argument('xcode_app', metavar='XCODEAPP', type=pathlib.Path)
+ parser.add_argument("-o", metavar='OUTSDKTAR', dest='out_sdkt', type=pathlib.Path, required=False)
args = parser.parse_args()
- xcode_app = pathlib.Path(args.xcode_app[0]).resolve()
+ xcode_app = args.xcode_app.resolve()
assert xcode_app.is_dir(), "The supplied Xcode.app path '{}' either does not exist or is not a directory".format(xcode_app)
xcode_app_plist = xcode_app.joinpath("Contents/version.plist")
@@ -47,11 +45,7 @@ def run():
out_name = "Xcode-{xcode_version}-{xcode_build_id}-extracted-SDK-with-libcxx-headers".format(xcode_version=xcode_version, xcode_build_id=xcode_build_id)
- if args.out_sdktgz:
- out_sdktgz_path = pathlib.Path(args.out_sdktgz_path)
- else:
- # Construct our own out_sdktgz if not specified on the command line
- out_sdktgz_path = pathlib.Path("./{}.tar.gz".format(out_name))
+ out_sdkt_path = args.out_sdkt or pathlib.Path("./{}.tar".format(out_name))
def tarfp_add_with_base_change(tarfp, dir_to_add, alt_base_dir):
"""Add all files in dir_to_add to tarfp, but prepend alt_base_dir to the files'
@@ -87,14 +81,13 @@ def run():
tarfp.add("./usr/lib", recursive=True, filter=change_tarinfo_base)
tarfp.add("./System/Library/Frameworks", recursive=True, filter=change_tarinfo_base)
- print("Creating output .tar.gz file...")
- with out_sdktgz_path.open("wb") as fp:
- with gzip.GzipFile(fileobj=fp, mode='wb', compresslevel=9, mtime=0) as gzf:
- with tarfile.open(mode="w", fileobj=gzf, format=tarfile.GNU_FORMAT) as tarfp:
- print("Adding MacOSX SDK {} files...".format(sdk_version))
- tarfp_add_with_base_change(tarfp, sdk_dir, out_name)
- print("Done! Find the resulting gzipped tarball at:")
- print(out_sdktgz_path.resolve())
+ print("Creating output .tar file...")
+ with out_sdkt_path.open("wb") as fp:
+ with tarfile.open(mode="w", fileobj=fp, format=tarfile.PAX_FORMAT) as tarfp:
+ print("Adding MacOSX SDK {} files...".format(sdk_version))
+ tarfp_add_with_base_change(tarfp, sdk_dir, out_name)
+ print("Done! Find the resulting tarball at:")
+ print(out_sdkt_path.resolve())
if __name__ == '__main__':
run()
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.