guix builds: Use codeberg.org instead of git.savannah.gnu.org
What the developer wrote
Authored by Pablo Greco
guix builds: Use codeberg.org instead of git.savannah.gnu.org
Cherry-picked from https://github.com/bitcoin/bitcoin/commit/5c2ba9f583e28460e618cc1119a10c06b868377c
What changed, and why it matters
This commit simply changes the web address from which the Guix build system downloads its own source code during reproducible builds. It switches from the GNU project's Savannah server to Codeberg, a non-profit code hosting platform. There is no security vulnerability or malicious change visible in the diff.
No security action required. Reviewers may optionally verify that Codeberg is an acceptable upstream mirror for the project and that the pinned commit hash is still correct.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch updates the --url argument passed to guix time-machine in contrib/guix/guix-build and contrib/guix/guix-codesign from https://git.savannah.gnu.org/git/guix.git to https://codeberg.org/guix.git. The pinned Guix commit (ae03f401381e956c4c41b4cf495cbde964fa43d0) remains unchanged, so the exact code being executed by the time-machine is still fixed. This is an infrastructure/reliability change, not a code change affecting consensus, wallet, networking, or build logic.
Changed components
contrib/guix/guix-buildcontrib/guix/guix-codesignInspect captured patch +2 / −2
diff --git a/contrib/guix/guix-build b/contrib/guix/guix-build
index b38f91f..c2e7a6b 100755
--- a/contrib/guix/guix-build
+++ b/contrib/guix/guix-build
@@ -238,7 +238,7 @@ SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(git -c log.showSignature=false log --f
# across time.
time-machine() {
# shellcheck disable=SC2086
- guix time-machine --url=https://git.savannah.gnu.org/git/guix.git \
+ guix time-machine --url=https://codeberg.org/guix.git \
--commit=ae03f401381e956c4c41b4cf495cbde964fa43d0 \
--cores="$JOBS" \
--keep-failed \
diff --git a/contrib/guix/guix-codesign b/contrib/guix/guix-codesign
index 4b272f3..2a9779a 100755
--- a/contrib/guix/guix-codesign
+++ b/contrib/guix/guix-codesign
@@ -226,7 +226,7 @@ SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(git -c log.showSignature=false log --f
# across time.
time-machine() {
# shellcheck disable=SC2086
- guix time-machine --url=https://git.savannah.gnu.org/git/guix.git \
+ guix time-machine --url=https://codeberg.org/guix.git \
--commit=ae03f401381e956c4c41b4cf495cbde964fa43d0 \
--cores="$JOBS" \
--keep-failed \
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.