guix: use a temporary file over sponge

Bitcoin Core/Bitcoin Core

c86bce59 View source ↗

Public commit record

What the developer wrote

Authored by fanquake

25/100 · Opaque

guix: use a temporary file over sponge

Remove sponge (moreutils).

✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body! Contains work-in-progress language

The short version

What changed, and why it matters

This commit changes the Bitcoin Core Guix build scripts to stop using the 'sponge' tool from the 'moreutils' package. Instead of writing a checksum file directly through a pipeline, the scripts now write to a temporary file and then move it into place. This removes a third-party dependency from the trusted build environment, which is a hardening improvement rather than a fix for a known active vulnerability.

Recommended action

No urgent action required. Treat as routine build-hardening cleanup. Reviewers may verify that the temporary file is created in a safe location and that the mv is atomic in the Guix build context.

Security signals we found

Reduction of third-party build dependency

Supply-chain hardening of Guix reproducible build environment

No direct vulnerability fix or memory-safety issue in diff

No explicit security disclosure or advisory language in commit

Technical analysis

Evidence from the diff

The patch replaces ‘… | sponge “$ACTUAL_OUTDIR”/SHA256SUMS.part’ with ‘… > “$tmp”; mv “$tmp” “$ACTUAL_OUTDIR”/SHA256SUMS.part’ in both build.sh and codesign.sh. It also removes the custom Guix package definition for ‘sponge’ and its inclusion in the manifest. The functional behavior is equivalent: the SHA256SUMS.part file is atomically populated with sorted checksums. The change reduces the supply-chain surface of the reproducible build environment by eliminating a dependency on moreutils/sponge.

Changed components

contrib/guix/libexec/build.shcontrib/guix/libexec/codesign.shcontrib/guix/manifest.scm

Inspect captured patch +8 / −35

diff --git a/contrib/guix/libexec/build.sh b/contrib/guix/libexec/build.sh
index 78976711..072e5b91 100755
--- a/contrib/guix/libexec/build.sh
+++ b/contrib/guix/libexec/build.sh
@@ -400,12 +400,14 @@ mv --no-target-directory "$OUTDIR" "$ACTUAL_OUTDIR" \
     || ( rm -rf "$ACTUAL_OUTDIR" && exit 1 )
 
 (
+    tmp="$(mktemp)"
     cd /outdir-base
     {
         echo "$GIT_ARCHIVE"
         find "$ACTUAL_OUTDIR" -type f
     } | xargs realpath --relative-base="$PWD" \
-      | xargs sha256sum \
-      | sort -k2 \
-      | sponge "$ACTUAL_OUTDIR"/SHA256SUMS.part
+        | xargs sha256sum \
+        | sort -k2 \
+        > "$tmp";
+    mv "$tmp" "$ACTUAL_OUTDIR"/SHA256SUMS.part
 )
diff --git a/contrib/guix/libexec/codesign.sh b/contrib/guix/libexec/codesign.sh
index 9ea683b9..9b7f085d 100755
--- a/contrib/guix/libexec/codesign.sh
+++ b/contrib/guix/libexec/codesign.sh
@@ -141,6 +141,7 @@ mv --no-target-directory "$OUTDIR" "$ACTUAL_OUTDIR" \
     || ( rm -rf "$ACTUAL_OUTDIR" && exit 1 )
 
 (
+    tmp="$(mktemp)"
     cd /outdir-base
     {
         echo "$CODESIGNING_TARBALL"
@@ -149,5 +150,6 @@ mv --no-target-directory "$OUTDIR" "$ACTUAL_OUTDIR" \
     } | xargs realpath --relative-base="$PWD" \
         | xargs sha256sum \
         | sort -k2 \
-        | sponge "$ACTUAL_OUTDIR"/SHA256SUMS.part
+        > "$tmp";
+    mv "$tmp" "$ACTUAL_OUTDIR"/SHA256SUMS.part
 )
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index ea1ffe5d..9cadd410 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -521,36 +521,6 @@ inspecting signatures in Mach-O binaries.")
                    (("^install-others =.*$")
                     (string-append "install-others = " out "/etc/rpc\n")))))))))))))
 
-;; The sponge tool from moreutils.
-(define-public sponge
-  (package
-    (name "sponge")
-    (version "0.69")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append
-                    "https://git.joeyh.name/index.cgi/moreutils.git/snapshot/
-                    moreutils-" version ".tar.gz"))
-              (file-name (string-append "moreutils-" version ".tar.gz"))
-              (sha256
-               (base32
-                "1l859qnzccslvxlh5ghn863bkq2vgmqgnik6jr21b9kc6ljmsy8g"))))
-    (build-system gnu-build-system)
-    (arguments
-     (list #:phases
-           #~(modify-phases %standard-phases
-               (delete 'configure)
-               (replace 'install
-                (lambda* (#:key outputs #:allow-other-keys)
-                  (let ((bin (string-append (assoc-ref outputs "out") "/bin")))
-                  (install-file "sponge" bin)))))
-           #:make-flags
-           #~(list "sponge" (string-append "CC=" #$(cc-for-target)))))
-    (home-page "https://joeyh.name/code/moreutils/")
-    (synopsis "Miscellaneous general-purpose command-line tools")
-    (description "Just sponge")
-    (license license:gpl2+)))
-
 (packages->manifest
  (append
   (list ;; The Basics
@@ -565,7 +535,6 @@ inspecting signatures in Mach-O binaries.")
         patch
         gawk
         sed
-        sponge
         ;; Compression and archiving
         tar
         gzip

Risk score

Why this scored 17/100

Our methodology →

Potential impact 2/30

Exploitability 2/25

Stealth signal 2/15

Affected reach 2/15

Confidence 6/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 17/100

Community notes

Related watches

test: test the result order of a multiple import request is correct

test: test invalid or missing timestamp throws importdescriptors

ci, iwyu: Enforce warning-free `src/common`