guix: build for Linux HOSTS with -static-libgcc
What the developer wrote
Authored by fanquake
guix: build for Linux HOSTS with -static-libgcc
What changed, and why it matters
This change adjusts how Bitcoin Core is packaged for Linux so that the libgcc runtime library is bundled directly into the released binaries instead of being expected to come from the user's operating system. It also removes checks that previously ensured the released binaries only relied on specific system versions of libgcc. The goal is to make the official Linux releases work on a wider range of older or differently-configured distributions without requiring a particular libgcc to be installed. It is a build/packaging improvement rather than a fix for an active software bug or exploit.
Treat as a routine build-system change. Reviewers should verify that the resulting release binaries no longer list libgcc_s.so.1 or libatomic.so.1 as NEEDED and that -static-libgcc is correctly applied across all Linux HOST targets. No emergency response is warranted.
Security signals we found
Build hardening / dependency reduction: static linking of compiler runtime reduces attack surface from distribution-specific shared library versions.
Supply-chain / reproducibility relevance: changes to release build scripts affect what libraries are embedded in official binaries.
No direct vulnerability fix: diff does not patch source code logic, memory handling, cryptography, or network parsing.
Potential operational risk: static linking can delay receipt of distribution security updates for libgcc, but this is a deliberate portability trade-off common in portable binaries.
Evidence from the diff
The commit modifies the Guix deterministic build scripts for Linux hosts to add -static-libgcc to CMAKE_EXE_LINKER_FLAGS, alongside the existing -static-libstdc++. It also updates contrib/guix/symbol-check.py to remove the GCC and LIBATOMIC version checks and to drop libgcc_s.so.1 and libatomic.so.1 from the allowed NEEDED dynamic libraries list. The effect is that libgcc (and libatomic where applicable) are now statically linked into produced ELF executables, reducing external runtime dependencies and removing the need to track distribution-specific libgcc versions in the release symbol checker.
Changed components
contrib/guix/libexec/build.shcontrib/guix/symbol-check.pyOfficial Linux release binaries built via GuixInspect captured patch +1 / −9
diff --git a/contrib/guix/libexec/build.sh b/contrib/guix/libexec/build.sh
index f972c892..09cc058e 100755
--- a/contrib/guix/libexec/build.sh
+++ b/contrib/guix/libexec/build.sh
@@ -231,7 +231,7 @@ esac
# EXE FLAGS
case "$HOST" in
- *linux*) CMAKE_EXE_LINKER_FLAGS="-DCMAKE_EXE_LINKER_FLAGS=${HOST_LDFLAGS} -static-libstdc++" ;;
+ *linux*) CMAKE_EXE_LINKER_FLAGS="-DCMAKE_EXE_LINKER_FLAGS=${HOST_LDFLAGS} -static-libstdc++ -static-libgcc" ;;
esac
mkdir -p "$DISTSRC"
diff --git a/contrib/guix/symbol-check.py b/contrib/guix/symbol-check.py
index 464b33cf..249c53a2 100755
--- a/contrib/guix/symbol-check.py
+++ b/contrib/guix/symbol-check.py
@@ -16,23 +16,18 @@ import lief
# Debian 11 (Bullseye) EOL: 2026. https://wiki.debian.org/LTS
#
-# - libgcc version 10.2.1 (https://packages.debian.org/bullseye/libgcc-s1)
# - libc version 2.31 (https://packages.debian.org/source/bullseye/glibc)
#
# Ubuntu 20.04 (Focal) EOL: 2030. https://wiki.ubuntu.com/ReleaseTeam
#
-# - libgcc version 10.5.0 (https://packages.ubuntu.com/focal/libgcc1)
# - libc version 2.31 (https://packages.ubuntu.com/focal/libc6)
#
# CentOS Stream 9 EOL: 2027. https://www.centos.org/cl-vs-cs/#end-of-life
#
-# - libgcc version 12.2.1 (https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os/Packages/)
# - libc version 2.34 (https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os/Packages/)
#
-# See https://gcc.gnu.org/onlinedocs/libstdc++/manual/abi.html for more info.
MAX_VERSIONS = {
-'GCC': (7,0,0),
'GLIBC': {
lief.ELF.ARCH.X86_64: (2,31),
lief.ELF.ARCH.ARM: (2,31),
@@ -40,7 +35,6 @@ MAX_VERSIONS = {
lief.ELF.ARCH.PPC64: (2,31),
lief.ELF.ARCH.RISCV: (2,31),
},
-'LIBATOMIC': (1,0),
'V': (0,5,0), # xkb (bitcoin-qt only)
}
@@ -93,11 +87,9 @@ ELF_ABIS: dict[lief.ELF.ARCH, dict[lief.Header.ENDIANNESS, list[int]]] = {
# Allowed NEEDED libraries
ELF_ALLOWED_LIBRARIES = {
# bitcoind and bitcoin-qt
-'libgcc_s.so.1', # GCC base support
'libc.so.6', # C library
'libpthread.so.0', # threading
'libm.so.6', # math library
-'libatomic.so.1',
'ld-linux-x86-64.so.2', # 64-bit dynamic linker
'ld-linux.so.2', # 32-bit dynamic linker
'ld-linux-aarch64.so.1', # 64-bit ARM dynamic linker
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.