← Watch feed
guix: Split manifest into build and codesign manifests
Public commit record
50/100 · Thin
What the developer wrote
Authored by Hennadii Stepanov
guix: Split manifest into build and codesign manifests
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
What changed, and why it matters
This commit is a build-system housekeeping change for Bitcoin Core's Guix reproducible-build tooling. It takes one large package list file (manifest.scm) and splits it into two smaller files: one used when compiling the software (manifest_build.scm) and one used when applying release signatures (manifest_codesign.scm). The scripts that invoke Guix are updated to point at the correct new file. There is no change to the Bitcoin Core node software, wallet logic, or network behavior, and nothing in the commit suggests a security vulnerability or fix.
Recommended action
No security action required. Treat as a normal build-system refactoring; routine review and CI verification that Guix builds and codesign workflows still produce identical outputs is sufficient.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff deletes contrib/guix/manifest.scm and creates contrib/guix/manifest_build.scm and contrib/guix/manifest_codesign.scm. The build manifest retains the compiler toolchains, libc, binutils, build utilities, and target-specific packaging tools. The codesign manifest retains only the tools needed for release signing: osslsigncode for Windows and python-signapple (plus its Python crypto dependencies) for macOS, plus basic shell/archive utilities. guix-build and guix-codesign are updated to reference the respective manifests. No package versions, source URLs, hashes, or build flags are modified; the change is purely a separation of concerns between the build and codesign environments.
Changed components
contrib/guix/guix-buildcontrib/guix/guix-codesigncontrib/guix/manifest_build.scmcontrib/guix/manifest_codesign.scmInspect captured patch +482 / −458
diff --git a/contrib/guix/guix-build b/contrib/guix/guix-build
index bef1c841..767ea920 100755
--- a/contrib/guix/guix-build
+++ b/contrib/guix/guix-build
@@ -441,7 +441,7 @@ EOF
# more information.
#
# shellcheck disable=SC2086,SC2031
- time-machine shell --manifest="${PWD}/contrib/guix/manifest.scm" \
+ time-machine shell --manifest="${PWD}/contrib/guix/manifest_build.scm" \
--container \
--writable-root \
--pure \
diff --git a/contrib/guix/guix-codesign b/contrib/guix/guix-codesign
index 39291dfe..8c8682dd 100755
--- a/contrib/guix/guix-codesign
+++ b/contrib/guix/guix-codesign
@@ -341,7 +341,7 @@ EOF
# more information.
#
# shellcheck disable=SC2086,SC2031
- time-machine shell --manifest="${PWD}/contrib/guix/manifest.scm" \
+ time-machine shell --manifest="${PWD}/contrib/guix/manifest_codesign.scm" \
--container \
--writable-root \
--pure \
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
deleted file mode 100644
index bf2c346a..00000000
--- a/contrib/guix/manifest.scm
+++ /dev/null
@@ -1,456 +0,0 @@
-(use-modules (gnu packages)
- ((gnu packages bash) #:select (bash-minimal))
- (gnu packages bison)
- ((gnu packages cmake) #:select (cmake-minimal))
- (gnu packages commencement)
- (gnu packages compression)
- (gnu packages cross-base)
- ((gnu packages crypto) #:select (osslsigncode))
- (gnu packages gawk)
- (gnu packages gcc)
- ((gnu packages installers) #:select (nsis-x86_64))
- ((gnu packages linux) #:select (linux-libre-headers-6.1))
- (gnu packages llvm)
- (gnu packages mingw)
- (gnu packages ninja)
- (gnu packages pkg-config)
- ((gnu packages python) #:select (python-minimal))
- ((gnu packages python-build) #:select (python-poetry-core))
- ((gnu packages python-crypto) #:select (python-asn1crypto python-oscrypto))
- ((gnu packages python-xyz) #:select (python-lief))
- ((gnu packages tls) #:select (openssl))
- ((gnu packages version-control) #:select (git-minimal))
- (guix build-system python)
- (guix build-system pyproject)
- (guix build-system trivial)
- (guix download)
- (guix gexp)
- (guix git-download)
- ((guix licenses) #:prefix license:)
- (guix packages)
- ((guix utils) #:select (substitute-keyword-arguments)))
-
-(define-syntax-rule (search-our-patches file-name ...)
- "Return the list of absolute file names corresponding to each
-FILE-NAME found in ./patches relative to the current file."
- (parameterize
- ((%patch-path (list (string-append (dirname (current-filename)) "/patches"))))
- (list (search-patch file-name) ...)))
-
-(define building-on (string-append "--build=" (list-ref (string-split (%current-system) #\-) 0) "-guix-linux-gnu"))
-
-(define (base-binutils target)
- (package
- (inherit (cross-binutils target)) ;; 2.44
- (version "2.46.0")
- (source (origin
- (method url-fetch)
- (uri (string-append "mirror://gnu/binutils/binutils-"
- version ".tar.bz2"))
- (sha256
- (base32
- "04nd9vl7c1pxjbc9wh3ckddzhz5g82xyjqq9y9kf171a59im4c8g"))))
- (arguments
- (substitute-keyword-arguments (package-arguments (cross-binutils target))
- ((#:configure-flags flags)
- #~(append #$flags
- (list "--enable-gprofng=no")))))
- (native-inputs
- (modify-inputs
- (package-native-inputs (cross-binutils target))
- (delete "bison")))
- )
-)
-
-(define (make-cross-toolchain target
- base-gcc-for-libc
- base-kernel-headers
- base-libc
- base-gcc)
- "Create a cross-compilation toolchain package for TARGET"
- (let* ((xbinutils (base-binutils target))
- ;; 1. Build a cross-compiling gcc without targeting any libc, derived
- ;; from BASE-GCC-FOR-LIBC
- (xgcc-sans-libc (cross-gcc target
- #:xgcc base-gcc-for-libc
- #:xbinutils xbinutils))
- ;; 2. Build cross-compiled kernel headers with XGCC-SANS-LIBC, derived
- ;; from BASE-KERNEL-HEADERS
- (xkernel (cross-kernel-headers target
- #:linux-headers base-kernel-headers
- #:xgcc xgcc-sans-libc
- #:xbinutils xbinutils))
- ;; 3. Build a cross-compiled libc with XGCC-SANS-LIBC and XKERNEL,
- ;; derived from BASE-LIBC
- (xlibc (cross-libc target
- #:libc base-libc
- #:xgcc xgcc-sans-libc
- #:xbinutils xbinutils
- #:xheaders xkernel))
- ;; 4. Build a cross-compiling gcc targeting XLIBC, derived from
- ;; BASE-GCC
- (xgcc (cross-gcc target
- #:xgcc base-gcc
- #:xbinutils xbinutils
- #:libc xlibc)))
- ;; Define a meta-package that propagates the resulting XBINUTILS, XLIBC, and
- ;; XGCC
- (package
- (name (string-append target "-toolchain"))
- (version (package-version xgcc))
- (source #f)
- (build-system trivial-build-system)
- (arguments '(#:builder (begin (mkdir %output) #t)))
- (propagated-inputs
- (list xbinutils
- xlibc
- xgcc
- `(,xlibc "static")
- `(,xgcc "lib")))
- (synopsis (string-append "Complete GCC tool chain for " target))
- (description (string-append "This package provides a complete GCC tool
-chain for " target " development."))
- (home-page (package-home-page xgcc))
- (license (package-license xgcc)))))
-
-(define base-gcc
- (package-with-extra-patches gcc-14
- (search-our-patches "gcc-remap-guix-store.patch" "gcc-ssa-generation.patch")))
-
-(define base-linux-kernel-headers linux-libre-headers-6.1)
-
-(define* (make-bitcoin-cross-toolchain target
- #:key
- (base-gcc-for-libc linux-base-gcc)
- (base-kernel-headers base-linux-kernel-headers)
- (base-libc glibc-2.31)
- (base-gcc linux-base-gcc))
- "Convenience wrapper around MAKE-CROSS-TOOLCHAIN with default values
-desirable for building Bitcoin Core release binaries."
- (make-cross-toolchain target
- base-gcc-for-libc
- base-kernel-headers
- base-libc
- base-gcc))
-
-(define (binutils-mingw-patches binutils)
- (package-with-extra-patches binutils
- (search-our-patches "binutils-unaligned-default.patch")))
-
-(define (winpthreads-patches mingw-w64-x86_64-winpthreads)
- (package-with-extra-patches mingw-w64-x86_64-winpthreads
- (search-our-patches "winpthreads-remap-guix-store.patch")))
-
-(define (make-mingw-pthreads-cross-toolchain target)
- "Create a cross-compilation toolchain package for TARGET"
- (let* ((xbinutils (binutils-mingw-patches (base-binutils target)))
- (machine (substring target 0 (string-index target #\-)))
- (pthreads-xlibc (winpthreads-patches (make-mingw-w64 machine
- #:xgcc (cross-gcc target #:xgcc base-gcc)
- #:with-winpthreads? #t)))
- (pthreads-xgcc (cross-gcc target
- #:xgcc mingw-w64-base-gcc
- #:xbinutils xbinutils
- #:libc pthreads-xlibc)))
- ;; Define a meta-package that propagates the resulting XBINUTILS, XLIBC, and
- ;; XGCC
- (package
- (name (string-append target "-posix-toolchain"))
- (version (package-version pthreads-xgcc))
- (source #f)
- (build-system trivial-build-system)
- (arguments '(#:builder (begin (mkdir %output) #t)))
- (propagated-inputs
- (list xbinutils
- pthreads-xlibc
- pthreads-xgcc
- `(,pthreads-xgcc "lib")))
- (synopsis (string-append "Complete GCC tool chain for " target))
- (description (string-append "This package provides a complete GCC tool
-chain for " target " development."))
- (home-page (package-home-page pthreads-xgcc))
- (license (package-license pthreads-xgcc)))))
-
-(define-public python-elfesteem
- (let ((commit "2eb1e5384ff7a220fd1afacd4a0170acff54fe56"))
- (package
- (name "python-elfesteem")
- (version (git-version "0.1" "1" commit))
- (source
- (origin
- (method git-fetch)
- (uri (git-reference
- (url "https://github.com/LRGH/elfesteem")
- (commit commit)))
- (file-name (git-file-name name commit))
- (sha256
- (base32
- "07x6p8clh11z8s1n2kdxrqwqm2almgc5qpkcr9ckb6y5ivjdr5r6"))))
- (build-system python-build-system)
- ;; There are no tests, but attempting to run python setup.py test leads to
- ;; PYTHONPATH problems, just disable the test
- (arguments '(#:tests? #f))
- (home-page "https://github.com/LRGH/elfesteem")
- (synopsis "ELF/PE/Mach-O parsing library")
- (description "elfesteem parses ELF, PE and Mach-O files.")
- (license license:lgpl2.1))))
-
-(define-public python-oscryptotests
- (package (inherit python-oscrypto)
- (name "python-oscryptotests")
- (propagated-inputs
- (list python-oscrypto))
- (arguments
- `(#:tests? #f
- #:phases
- (modify-phases %standard-phases
- (add-after 'unpack 'hard-code-path-to-libscrypt
- (lambda* (#:key inputs #:allow-other-keys)
- (chdir "tests")
- #t)))))))
-
-(define-public python-certvalidator
- (let ((commit "a145bf25eb75a9f014b3e7678826132efbba6213"))
- (package
- (name "python-certvalidator")
- (version (git-version "0.1" "1" commit))
- (source
- (origin
- (method git-fetch)
- (uri (git-reference
- (url "https://github.com/achow101/certvalidator")
- (commit commit)))
- (file-name (git-file-name name commit))
- (sha256
- (base32
- "1qw2k7xis53179lpqdqyylbcmp76lj7sagp883wmxg5i7chhc96k"))))
- (build-system python-build-system)
- (propagated-inputs
- (list openssl
- python-asn1crypto
- python-oscrypto
- python-oscryptotests)) ;; certvalidator tests import oscryptotests
- (arguments
- `(#:phases
- (modify-phases %standard-phases
- (add-after 'unpack 'disable-broken-tests
- (lambda _
- (substitute* "tests/test_certificate_validator.py"
- (("^(.*)class CertificateValidatorTests" line indent)
- (string-append indent
- "@unittest.skip(\"Disabled by Guix\")\n"
- line)))
- (substitute* "tests/test_crl_client.py"
- (("^(.*)def test_fetch_crl" line indent)
- (string-append indent
- "@unittest.skip(\"Disabled by Guix\")\n"
- line)))
- (substitute* "tests/test_ocsp_client.py"
- (("^(.*)def test_fetch_ocsp" line indent)
- (string-append indent
- "@unittest.skip(\"Disabled by Guix\")\n"
- line)))
- (substitute* "tests/test_registry.py"
- (("^(.*)def test_build_paths" line indent)
- (string-append indent
- "@unittest.skip(\"Disabled by Guix\")\n"
- line)))
- (substitute* "tests/test_validate.py"
- (("^(.*)def test_revocation_mode_hard" line indent)
- (string-append indent
- "@unittest.skip(\"Disabled by Guix\")\n"
- line)))
- (substitute* "tests/test_validate.py"
- (("^(.*)def test_revocation_mode_soft" line indent)
- (string-append indent
- "@unittest.skip(\"Disabled by Guix\")\n"
- line)))
- #t))
- (replace 'check
- (lambda _
- (invoke "python" "run.py" "tests")
- #t)))))
- (home-page "https://github.com/wbond/certvalidator")
- (synopsis "Python library for validating X.509 certificates and paths")
- (description "certvalidator is a Python library for validating X.509
-certificates or paths. Supports various options, including: validation at a
-specific moment in time, whitelisting and revocation checks.")
- (license license:expat))))
-
-(define-public python-signapple
- (let ((commit "3fab3bb57f227f0dd31007b417683035f5204838"))
- (package
- (name "python-signapple")
- (version (git-version "0.2.0" "1" commit))
- (source
- (origin
- (method git-fetch)
- (uri (git-reference
- (url "https://github.com/achow101/signapple")
- (commit commit)))
- (file-name (git-file-name name commit))
- (sha256
- (base32
- "0qpr78bs50rw79dbihr9ifjq19y6819ih5pn9jd2rbjyifimzf7p"))))
- (build-system pyproject-build-system)
- (propagated-inputs
- (list python-asn1crypto
- python-oscrypto
- python-certvalidator
- python-elfesteem))
- (native-inputs (list python-poetry-core))
- (arguments
- ;; There are no tests, but attempting to run python setup.py test leads to
- ;; problems, just disable the test
- (list #:tests? #f
- #:phases
- #~(modify-phases %standard-phases
- ;; Add a phase to inject OpenSSL paths for oscrypto.
- (add-after 'wrap 'wrap-openssl-paths
- (lambda* (#:key inputs #:allow-other-keys)
- (let ((openssl (assoc-ref inputs "openssl")))
- (wrap-program (string-append #$output "/bin/signapple")
- `("SIGNAPPLE_OSCRYPTO_SSL_PATHS" =
- (,(string-append openssl "/lib/libcrypto.so" "," openssl "/lib/libssl.so"))))))))))
- (home-page "https://github.com/achow101/signapple")
- (synopsis "Mach-O binary signature tool")
- (description "signapple is a Python tool for creating, verifying, and
-inspecting signatures in Mach-O binaries.")
- (license license:expat))))
-
-(define-public mingw-w64-base-gcc
- (package
- (inherit base-gcc)
- (arguments
- (substitute-keyword-arguments (package-arguments base-gcc)
- ((#:configure-flags flags)
- `(append ,flags
- ;; https://gcc.gnu.org/install/configure.html
- (list "--enable-threads=posix",
- "--enable-default-ssp=yes",
- "--enable-host-bind-now=yes",
- "--disable-gcov",
- "--disable-libgomp",
- building-on)))))))
-
-(define-public linux-base-gcc
- (package
- (inherit base-gcc)
- (arguments
- (substitute-keyword-arguments (package-arguments base-gcc)
- ((#:configure-flags flags)
- `(append ,flags
- ;; https://gcc.gnu.org/install/configure.html
- (list "--enable-initfini-array=yes",
- "--enable-default-ssp=yes",
- "--enable-default-pie=yes",
- "--enable-host-bind-now=yes",
- "--enable-standard-branch-protection=yes",
- "--enable-cet=yes",
- "--enable-gprofng=no",
- "--disable-gcov",
- "--disable-libgomp",
- "--disable-libquadmath",
- "--disable-libsanitizer",
- building-on)))
- ((#:phases phases)
- `(modify-phases ,phases
- ;; Given a XGCC package, return a modified package that replace each instance of
- ;; -rpath in the default system spec that's inserted by Guix with -rpath-link
- (add-after 'pre-configure 'replace-rpath-with-rpath-link
- (lambda _
- (substitute* (cons "gcc/config/rs6000/sysv4.h"
- (find-files "gcc/config"
- "^gnu-user.*\\.h$"))
- (("-rpath=") "-rpath-link="))
- #t))))))))
-
-(define-public glibc-2.31
- (let ((commit "28eb5caf895ced5d895cb02757e109004a2d33e5"))
- (package
- (inherit glibc) ;; 2.39
- (version "2.31")
- (source (origin
- (method git-fetch)
- (uri (git-reference
- (url "https://sourceware.org/git/glibc.git")
- (commit commit)))
- (file-name (git-file-name "glibc" commit))
- (sha256
- (base32
- "07arjrc1smqy8wrhg38apr1s9ji7xv1rpzdapk4k2ps2n07irp58"))
- (patches (search-our-patches "glibc-guix-prefix.patch"
- "glibc-riscv-jumptarget.patch"))))
- (arguments
- (substitute-keyword-arguments (package-arguments glibc)
- ((#:configure-flags flags)
- `(append ,flags
- ;; https://www.gnu.org/software/libc/manual/html_node/Configuring-and-compiling.html
- (list "--enable-stack-protector=all",
- "--enable-cet",
- "--enable-bind-now",
- "--disable-werror",
- "--disable-timezone-tools",
- "--disable-profile",
- building-on)))
- ((#:phases phases)
- `(modify-phases ,phases
- (add-before 'configure 'set-etc-rpc-installation-directory
- (lambda* (#:key outputs #:allow-other-keys)
- ;; Install the rpc data base file under `$out/etc/rpc'.
- ;; Otherwise build will fail with "Permission denied."
- ;; Can be removed when we are building 2.32 or later.
- (let ((out (assoc-ref outputs "out")))
- (substitute* "sunrpc/Makefile"
- (("^\\$\\(inst_sysconfdir\\)/rpc(.*)$" _ suffix)
- (string-append out "/etc/rpc" suffix "\n"))
- (("^install-others =.*$")
- (string-append "install-others = " out "/etc/rpc\n")))))))))))))
-
-(packages->manifest
- (append
- (list ;; The Basics
- bash-minimal
- which
- coreutils-minimal
- ;; File(system) inspection
- grep
- diffutils
- findutils
- ;; File transformation
- patch
- gawk
- sed
- ;; Compression and archiving
- tar
- gzip
- xz
- ;; Build tools
- gcc-toolchain-14
- cmake-minimal
- gnu-make
- ninja
- ;; Scripting
- python-minimal ;; (3.11)
- ;; Git
- git-minimal
- ;; Tests
- python-lief)
- (let ((target (getenv "HOST")))
- (cond ((string-suffix? "-mingw32" target)
- (list zip
- (make-mingw-pthreads-cross-toolchain "x86_64-w64-mingw32")
- nsis-x86_64
- osslsigncode))
- ((string-contains target "-linux-")
- (list bison
- pkg-config
- (list gcc-toolchain-14 "static")
- (make-bitcoin-cross-toolchain target)))
- ((string-contains target "darwin")
- (list clang-toolchain-19
- lld-19
- (make-lld-wrapper lld-19 #:lld-as-ld? #t)
- python-signapple
- zip))
- (else '())))))
diff --git a/contrib/guix/manifest_build.scm b/contrib/guix/manifest_build.scm
new file mode 100644
index 00000000..576021e6
--- /dev/null
+++ b/contrib/guix/manifest_build.scm
@@ -0,0 +1,301 @@
+(use-modules (gnu packages)
+ ((gnu packages bash) #:select (bash-minimal))
+ (gnu packages bison)
+ ((gnu packages cmake) #:select (cmake-minimal))
+ (gnu packages commencement)
+ ((gnu packages compression) #:select (gzip xz zip))
+ (gnu packages cross-base)
+ (gnu packages gawk)
+ (gnu packages gcc)
+ ((gnu packages installers) #:select (nsis-x86_64))
+ ((gnu packages linux) #:select (linux-libre-headers-6.1))
+ (gnu packages llvm)
+ (gnu packages mingw)
+ (gnu packages ninja)
+ (gnu packages pkg-config)
+ ((gnu packages python) #:select (python-minimal))
+ ((gnu packages python-xyz) #:select (python-lief))
+ ((gnu packages version-control) #:select (git-minimal))
+ (guix build-system trivial)
+ (guix download)
+ (guix gexp)
+ (guix git-download)
+ ((guix licenses) #:prefix license:)
+ (guix packages)
+ ((guix utils) #:select (substitute-keyword-arguments)))
+
+(define-syntax-rule (search-our-patches file-name ...)
+ "Return the list of absolute file names corresponding to each
+FILE-NAME found in ./patches relative to the current file."
+ (parameterize
+ ((%patch-path (list (string-append (dirname (current-filename)) "/patches"))))
+ (list (search-patch file-name) ...)))
+
+(define building-on (string-append "--build=" (list-ref (string-split (%current-system) #\-) 0) "-guix-linux-gnu"))
+
+(define (base-binutils target)
+ (package
+ (inherit (cross-binutils target)) ;; 2.44
+ (version "2.46.0")
+ (source (origin
+ (method url-fetch)
+ (uri (string-append "mirror://gnu/binutils/binutils-"
+ version ".tar.bz2"))
+ (sha256
+ (base32
+ "04nd9vl7c1pxjbc9wh3ckddzhz5g82xyjqq9y9kf171a59im4c8g"))))
+ (arguments
+ (substitute-keyword-arguments (package-arguments (cross-binutils target))
+ ((#:configure-flags flags)
+ #~(append #$flags
+ (list "--enable-gprofng=no")))))
+ (native-inputs
+ (modify-inputs
+ (package-native-inputs (cross-binutils target))
+ (delete "bison")))
+ )
+)
+
+(define (make-cross-toolchain target
+ base-gcc-for-libc
+ base-kernel-headers
+ base-libc
+ base-gcc)
+ "Create a cross-compilation toolchain package for TARGET"
+ (let* ((xbinutils (base-binutils target))
+ ;; 1. Build a cross-compiling gcc without targeting any libc, derived
+ ;; from BASE-GCC-FOR-LIBC
+ (xgcc-sans-libc (cross-gcc target
+ #:xgcc base-gcc-for-libc
+ #:xbinutils xbinutils))
+ ;; 2. Build cross-compiled kernel headers with XGCC-SANS-LIBC, derived
+ ;; from BASE-KERNEL-HEADERS
+ (xkernel (cross-kernel-headers target
+ #:linux-headers base-kernel-headers
+ #:xgcc xgcc-sans-libc
+ #:xbinutils xbinutils))
+ ;; 3. Build a cross-compiled libc with XGCC-SANS-LIBC and XKERNEL,
+ ;; derived from BASE-LIBC
+ (xlibc (cross-libc target
+ #:libc base-libc
+ #:xgcc xgcc-sans-libc
+ #:xbinutils xbinutils
+ #:xheaders xkernel))
+ ;; 4. Build a cross-compiling gcc targeting XLIBC, derived from
+ ;; BASE-GCC
+ (xgcc (cross-gcc target
+ #:xgcc base-gcc
+ #:xbinutils xbinutils
+ #:libc xlibc)))
+ ;; Define a meta-package that propagates the resulting XBINUTILS, XLIBC, and
+ ;; XGCC
+ (package
+ (name (string-append target "-toolchain"))
+ (version (package-version xgcc))
+ (source #f)
+ (build-system trivial-build-system)
+ (arguments '(#:builder (begin (mkdir %output) #t)))
+ (propagated-inputs
+ (list xbinutils
+ xlibc
+ xgcc
+ `(,xlibc "static")
+ `(,xgcc "lib")))
+ (synopsis (string-append "Complete GCC tool chain for " target))
+ (description (string-append "This package provides a complete GCC tool
+chain for " target " development."))
+ (home-page (package-home-page xgcc))
+ (license (package-license xgcc)))))
+
+(define base-gcc
+ (package-with-extra-patches gcc-14
+ (search-our-patches "gcc-remap-guix-store.patch" "gcc-ssa-generation.patch")))
+
+(define base-linux-kernel-headers linux-libre-headers-6.1)
+
+(define* (make-bitcoin-cross-toolchain target
+ #:key
+ (base-gcc-for-libc linux-base-gcc)
+ (base-kernel-headers base-linux-kernel-headers)
+ (base-libc glibc-2.31)
+ (base-gcc linux-base-gcc))
+ "Convenience wrapper around MAKE-CROSS-TOOLCHAIN with default values
+desirable for building Bitcoin Core release binaries."
+ (make-cross-toolchain target
+ base-gcc-for-libc
+ base-kernel-headers
+ base-libc
+ base-gcc))
+
+(define (binutils-mingw-patches binutils)
+ (package-with-extra-patches binutils
+ (search-our-patches "binutils-unaligned-default.patch")))
+
+(define (winpthreads-patches mingw-w64-x86_64-winpthreads)
+ (package-with-extra-patches mingw-w64-x86_64-winpthreads
+ (search-our-patches "winpthreads-remap-guix-store.patch")))
+
+(define (make-mingw-pthreads-cross-toolchain target)
+ "Create a cross-compilation toolchain package for TARGET"
+ (let* ((xbinutils (binutils-mingw-patches (base-binutils target)))
+ (machine (substring target 0 (string-index target #\-)))
+ (pthreads-xlibc (winpthreads-patches (make-mingw-w64 machine
+ #:xgcc (cross-gcc target #:xgcc base-gcc)
+ #:with-winpthreads? #t)))
+ (pthreads-xgcc (cross-gcc target
+ #:xgcc mingw-w64-base-gcc
+ #:xbinutils xbinutils
+ #:libc pthreads-xlibc)))
+ ;; Define a meta-package that propagates the resulting XBINUTILS, XLIBC, and
+ ;; XGCC
+ (package
+ (name (string-append target "-posix-toolchain"))
+ (version (package-version pthreads-xgcc))
+ (source #f)
+ (build-system trivial-build-system)
+ (arguments '(#:builder (begin (mkdir %output) #t)))
+ (propagated-inputs
+ (list xbinutils
+ pthreads-xlibc
+ pthreads-xgcc
+ `(,pthreads-xgcc "lib")))
+ (synopsis (string-append "Complete GCC tool chain for " target))
+ (description (string-append "This package provides a complete GCC tool
+chain for " target " development."))
+ (home-page (package-home-page pthreads-xgcc))
+ (license (package-license pthreads-xgcc)))))
+
+(define-public mingw-w64-base-gcc
+ (package
+ (inherit base-gcc)
+ (arguments
+ (substitute-keyword-arguments (package-arguments base-gcc)
+ ((#:configure-flags flags)
+ `(append ,flags
+ ;; https://gcc.gnu.org/install/configure.html
+ (list "--enable-threads=posix",
+ "--enable-default-ssp=yes",
+ "--enable-host-bind-now=yes",
+ "--disable-gcov",
+ "--disable-libgomp",
+ building-on)))))))
+
+(define-public linux-base-gcc
+ (package
+ (inherit base-gcc)
+ (arguments
+ (substitute-keyword-arguments (package-arguments base-gcc)
+ ((#:configure-flags flags)
+ `(append ,flags
+ ;; https://gcc.gnu.org/install/configure.html
+ (list "--enable-initfini-array=yes",
+ "--enable-default-ssp=yes",
+ "--enable-default-pie=yes",
+ "--enable-host-bind-now=yes",
+ "--enable-standard-branch-protection=yes",
+ "--enable-cet=yes",
+ "--enable-gprofng=no",
+ "--disable-gcov",
+ "--disable-libgomp",
+ "--disable-libquadmath",
+ "--disable-libsanitizer",
+ building-on)))
+ ((#:phases phases)
+ `(modify-phases ,phases
+ ;; Given a XGCC package, return a modified package that replace each instance of
+ ;; -rpath in the default system spec that's inserted by Guix with -rpath-link
+ (add-after 'pre-configure 'replace-rpath-with-rpath-link
+ (lambda _
+ (substitute* (cons "gcc/config/rs6000/sysv4.h"
+ (find-files "gcc/config"
+ "^gnu-user.*\\.h$"))
+ (("-rpath=") "-rpath-link="))
+ #t))))))))
+
+(define-public glibc-2.31
+ (let ((commit "28eb5caf895ced5d895cb02757e109004a2d33e5"))
+ (package
+ (inherit glibc) ;; 2.39
+ (version "2.31")
+ (source (origin
+ (method git-fetch)
+ (uri (git-reference
+ (url "https://sourceware.org/git/glibc.git")
+ (commit commit)))
+ (file-name (git-file-name "glibc" commit))
+ (sha256
+ (base32
+ "07arjrc1smqy8wrhg38apr1s9ji7xv1rpzdapk4k2ps2n07irp58"))
+ (patches (search-our-patches "glibc-guix-prefix.patch"
+ "glibc-riscv-jumptarget.patch"))))
+ (arguments
+ (substitute-keyword-arguments (package-arguments glibc)
+ ((#:configure-flags flags)
+ `(append ,flags
+ ;; https://www.gnu.org/software/libc/manual/html_node/Configuring-and-compiling.html
+ (list "--enable-stack-protector=all",
+ "--enable-cet",
+ "--enable-bind-now",
+ "--disable-werror",
+ "--disable-timezone-tools",
+ "--disable-profile",
+ building-on)))
+ ((#:phases phases)
+ `(modify-phases ,phases
+ (add-before 'configure 'set-etc-rpc-installation-directory
+ (lambda* (#:key outputs #:allow-other-keys)
+ ;; Install the rpc data base file under `$out/etc/rpc'.
+ ;; Otherwise build will fail with "Permission denied."
+ ;; Can be removed when we are building 2.32 or later.
+ (let ((out (assoc-ref outputs "out")))
+ (substitute* "sunrpc/Makefile"
+ (("^\\$\\(inst_sysconfdir\\)/rpc(.*)$" _ suffix)
+ (string-append out "/etc/rpc" suffix "\n"))
+ (("^install-others =.*$")
+ (string-append "install-others = " out "/etc/rpc\n")))))))))))))
+
+(packages->manifest
+ (append
+ (list ;; The Basics
+ bash-minimal
+ which
+ coreutils-minimal
+ ;; File(system) inspection
+ grep
+ diffutils
+ findutils
+ ;; File transformation
+ patch
+ gawk
+ sed
+ ;; Compression and archiving
+ tar
+ gzip
+ xz
+ ;; Build tools
+ gcc-toolchain-14
+ cmake-minimal
+ gnu-make
+ ninja
+ ;; Scripting
+ python-minimal ;; (3.11)
+ ;; Git
+ git-minimal
+ ;; Tests
+ python-lief)
+ (let ((target (getenv "HOST")))
+ (cond ((string-suffix? "-mingw32" target)
+ (list (make-mingw-pthreads-cross-toolchain "x86_64-w64-mingw32")
+ nsis-x86_64
+ zip))
+ ((string-contains target "-linux-")
+ (list bison
+ pkg-config
+ (list gcc-toolchain-14 "static")
+ (make-bitcoin-cross-toolchain target)))
+ ((string-contains target "darwin")
+ (list clang-toolchain-19
+ lld-19
+ (make-lld-wrapper lld-19 #:lld-as-ld? #t)
+ zip))
+ (else '())))))
diff --git a/contrib/guix/manifest_codesign.scm b/contrib/guix/manifest_codesign.scm
new file mode 100644
index 00000000..652f40ac
--- /dev/null
+++ b/contrib/guix/manifest_codesign.scm
@@ -0,0 +1,179 @@
+(use-modules ((gnu packages bash) #:select (bash-minimal))
+ ((gnu packages compression) #:select (gzip zip))
+ ((gnu packages crypto) #:select (osslsigncode))
+ ((gnu packages python-build) #:select (python-poetry-core))
+ ((gnu packages python-crypto) #:select (python-asn1crypto python-oscrypto))
+ ((gnu packages tls) #:select (openssl))
+ ((gnu packages version-control) #:select (git-minimal))
+ (guix build-system python)
+ (guix build-system pyproject)
+ (guix git-download)
+ ((guix licenses) #:prefix license:)
+ (guix packages))
+
+(define-public python-elfesteem
+ (let ((commit "2eb1e5384ff7a220fd1afacd4a0170acff54fe56"))
+ (package
+ (name "python-elfesteem")
+ (version (git-version "0.1" "1" commit))
+ (source
+ (origin
+ (method git-fetch)
+ (uri (git-reference
+ (url "https://github.com/LRGH/elfesteem")
+ (commit commit)))
+ (file-name (git-file-name name commit))
+ (sha256
+ (base32
+ "07x6p8clh11z8s1n2kdxrqwqm2almgc5qpkcr9ckb6y5ivjdr5r6"))))
+ (build-system python-build-system)
+ ;; There are no tests, but attempting to run python setup.py test leads to
+ ;; PYTHONPATH problems, just disable the test
+ (arguments '(#:tests? #f))
+ (home-page "https://github.com/LRGH/elfesteem")
+ (synopsis "ELF/PE/Mach-O parsing library")
+ (description "elfesteem parses ELF, PE and Mach-O files.")
+ (license license:lgpl2.1))))
+
+(define-public python-oscryptotests
+ (package (inherit python-oscrypto)
+ (name "python-oscryptotests")
+ (propagated-inputs
+ (list python-oscrypto))
+ (arguments
+ `(#:tests? #f
+ #:phases
+ (modify-phases %standard-phases
+ (add-after 'unpack 'hard-code-path-to-libscrypt
+ (lambda* (#:key inputs #:allow-other-keys)
+ (chdir "tests")
+ #t)))))))
+
+(define-public python-certvalidator
+ (let ((commit "a145bf25eb75a9f014b3e7678826132efbba6213"))
+ (package
+ (name "python-certvalidator")
+ (version (git-version "0.1" "1" commit))
+ (source
+ (origin
+ (method git-fetch)
+ (uri (git-reference
+ (url "https://github.com/achow101/certvalidator")
+ (commit commit)))
+ (file-name (git-file-name name commit))
+ (sha256
+ (base32
+ "1qw2k7xis53179lpqdqyylbcmp76lj7sagp883wmxg5i7chhc96k"))))
+ (build-system python-build-system)
+ (propagated-inputs
+ (list openssl
+ python-asn1crypto
+ python-oscrypto
+ python-oscryptotests)) ;; certvalidator tests import oscryptotests
+ (arguments
+ `(#:phases
+ (modify-phases %standard-phases
+ (add-after 'unpack 'disable-broken-tests
+ (lambda _
+ (substitute* "tests/test_certificate_validator.py"
+ (("^(.*)class CertificateValidatorTests" line indent)
+ (string-append indent
+ "@unittest.skip(\"Disabled by Guix\")\n"
+ line)))
+ (substitute* "tests/test_crl_client.py"
+ (("^(.*)def test_fetch_crl" line indent)
+ (string-append indent
+ "@unittest.skip(\"Disabled by Guix\")\n"
+ line)))
+ (substitute* "tests/test_ocsp_client.py"
+ (("^(.*)def test_fetch_ocsp" line indent)
+ (string-append indent
+ "@unittest.skip(\"Disabled by Guix\")\n"
+ line)))
+ (substitute* "tests/test_registry.py"
+ (("^(.*)def test_build_paths" line indent)
+ (string-append indent
+ "@unittest.skip(\"Disabled by Guix\")\n"
+ line)))
+ (substitute* "tests/test_validate.py"
+ (("^(.*)def test_revocation_mode_hard" line indent)
+ (string-append indent
+ "@unittest.skip(\"Disabled by Guix\")\n"
+ line)))
+ (substitute* "tests/test_validate.py"
+ (("^(.*)def test_revocation_mode_soft" line indent)
+ (string-append indent
+ "@unittest.skip(\"Disabled by Guix\")\n"
+ line)))
+ #t))
+ (replace 'check
+ (lambda _
+ (invoke "python" "run.py" "tests")
+ #t)))))
+ (home-page "https://github.com/wbond/certvalidator")
+ (synopsis "Python library for validating X.509 certificates and paths")
+ (description "certvalidator is a Python library for validating X.509
+certificates or paths. Supports various options, including: validation at a
+specific moment in time, whitelisting and revocation checks.")
+ (license license:expat))))
+
+(define-public python-signapple
+ (let ((commit "3fab3bb57f227f0dd31007b417683035f5204838"))
+ (package
+ (name "python-signapple")
+ (version (git-version "0.2.0" "1" commit))
+ (source
+ (origin
+ (method git-fetch)
+ (uri (git-reference
+ (url "https://github.com/achow101/signapple")
+ (commit commit)))
+ (file-name (git-file-name name commit))
+ (sha256
+ (base32
+ "0qpr78bs50rw79dbihr9ifjq19y6819ih5pn9jd2rbjyifimzf7p"))))
+ (build-system pyproject-build-system)
+ (propagated-inputs
+ (list python-asn1crypto
+ python-oscrypto
+ python-certvalidator
+ python-elfesteem))
+ (native-inputs (list python-poetry-core))
+ (arguments
+ ;; There are no tests, but attempting to run python setup.py test leads to
+ ;; problems, just disable the test
+ (list #:tests? #f
+ #:phases
+ #~(modify-phases %standard-phases
+ ;; Add a phase to inject OpenSSL paths for oscrypto.
+ (add-after 'wrap 'wrap-openssl-paths
+ (lambda* (#:key inputs #:allow-other-keys)
+ (let ((openssl (assoc-ref inputs "openssl")))
+ (wrap-program (string-append #$output "/bin/signapple")
+ `("SIGNAPPLE_OSCRYPTO_SSL_PATHS" =
+ (,(string-append openssl "/lib/libcrypto.so" "," openssl "/lib/libssl.so"))))))))))
+ (home-page "https://github.com/achow101/signapple")
+ (synopsis "Mach-O binary signature tool")
+ (description "signapple is a Python tool for creating, verifying, and
+inspecting signatures in Mach-O binaries.")
+ (license license:expat))))
+
+(packages->manifest
+ (append
+ (list ;; The Basics
+ bash-minimal
+ coreutils-minimal
+ ;; File(system) inspection
+ findutils
+ ;; Compression and archiving
+ tar
+ gzip
+ zip
+ ;; Git
+ git-minimal)
+ (let ((target (getenv "HOST")))
+ (cond ((string-suffix? "-mingw32" target)
+ (list osslsigncode))
+ ((string-contains target "darwin")
+ (list python-signapple))
+ (else '())))))
Risk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.