backport: guix related backports #5237
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Collaborator
Author
|
@thephez |
Collaborator
Did this come via a backport? If so, we should probably just handle it however bitcoin did. |
knst
force-pushed
the
guix-2
branch
4 times, most recently
from
3413d33 to
c09129b
Compare
Member
|
my results |
Collaborator
Author
hashes matched, but somehow |
PastaPastaPasta
approved these changes
Mar 22, 2023
Member
PastaPastaPasta
left a comment
PastaPastaPasta
left a comment
There was a problem hiding this comment.
utACK for merging via merge commit
UdjinM6
requested changes
Mar 24, 2023
f852761 guix: Add clarifying documentation for V env var (Carl Dong) 85f4a4b guix: Make V=1 more powerful for debugging (Carl Dong) Pull request description: ``` - Print commands in both unexpanded and expanded forms - Set VERBOSE=1 for CMake ``` Ping MarcoFalke hopefully you use `V=1` already for the Guix builds on DrahtBot? ACKs for top commit: fanquake: ACK f852761. Ran a Windows Guix build and compared the output from master and this PR when using `V=1`. i.e `HOSTS=x86_64-w64-mingw32 PATH="/root/.config/guix/current/bin${PATH:+:}$PATH" V=1 ./contrib/guix/guix-build.sh`. Tree-SHA512: 8bc466fa7b869618bbd5a0a91c6b23d4785009289f8dfb93b0349317463a9ab9ece128c72436e02a0819722a63e703100aed15807867a716fda891292fcb9d9d
…ry name faa2f06 scripted-diff: [build] Ensure source tarball has leading directory name (MarcoFalke) Pull request description: This has been fixed in 0.20, so it needs to be fixed on master as well to avoid a regression bitcoin#18945 ACKs for top commit: laanwj: ACK faa2f06 hebasto: ACK faa2f06, tested gitian builds only. promag: ACK faa2f06. Tree-SHA512: e3b025c29c45b025002abc35262bb5d771f6cbd807f1c256c477c243685e93cd43ad9f642b38e3cf218590912abe6ea0ddfec3bfbef36f99080aad74ed6cc0af
570e43f guix: Print build params inside/outside of container (Carl Dong) 2f9d1fd guix: Move DISTSRC determination to guix-build.sh (Carl Dong) 0b7cd07 guix: Move OUTDIR determination+creation to guix-build.sh (Carl Dong) d27ff8b guix: Add more sanity checks to guix-build.sh (Carl Dong) 57f9533 guix: Add section headings to guix-build.sh (Carl Dong) 38b7b2e genbuild: Specify rev-parse length (Carl Dong) 036dc74 docs: Point to contrib/guix/README.md in doc/guix.md (Carl Dong) 34f0fda guix: Small updates to README wording (Carl Dong) 402e3a5 guix: Update HOSTS README entry for new architectures (Carl Dong) cfa7ceb guix: Remove README development environment section (Carl Dong) 93b6a85 guix: Add ADDITIONAL_GUIX_{COMMON,TIMEMACHINE}_FLAGS options (Carl Dong) 0f31e24 guix: Add SUBSTITUTE_URLS option (Carl Dong) 444fcfc guix: Make guix honor MAX_JOBS setting (Carl Dong) Pull request description: After live-demo-ing a Guix build (which completed successfully!) on achow101's stream, I realized there were a few quality of life improvements which can be made to improve the user experience of our Guix build process. Here are a few of them. Notable changes: 1. When `MAX_JOBS` is specified, both `guix time-machine` and `guix environment` will now build up to `MAX_JOBS` packages at a time when creating the build environment 2. The instructions for using substitutes were incorrect, and has now been replaced with a `SUBSTITUTE_URLS` environment variable, which works well with shell's IFS splitting rules 3. New `ADDITIONAL_GUIX_{COMMON,TIMEMACHINE}_FLAGS` options, for more granular customization of the build process. 4. README cleanup ACKs for top commit: fanquake: ACK 570e43f - lets move this forward. Tree-SHA512: 4e8ab560522ade5efb5e8736aec0fb1a3f19ae9deb586c1ab87020816876f3f466a950b3f8c04d9fa1d072ae5ee780038c5c9063577049bdd9db17978e11c328
…E-DATE-EPOCH 1fca981 lint: Skip whitespace lint for guix patches (Carl Dong) a91c46c guix: Make nsis reproducible by respecting SOURCE-DATE-EPOCH (Carl Dong) Pull request description: ``` When building nsis, if VERSION is not specified, it defaults to cvs_version which is non-deterministic as it includes the current date. This patches nsis to default to SOURCE_DATE_EPOCH if it exists so that nsis is reproducible. Upstream change: NSIS-Dev/nsis#13 ``` Sidenote: also a good demonstration of how Guix allows us to flexibly patch our tools! Note to reviewers: if you want to compare hashes, please build after Jan 16th 2021 without my substitute server enabled! ACKs for top commit: fanquake: ACK 1fca981 Tree-SHA512: b800e0ce5f73827ad353739effb9167ec3a6bdb362c725ae20dd3f025ce78660f85c70ce1d75cd0896facf1e8fe38a9e058459ed13dec71ab3a2fe41e20eaa5d
f169475 guix: Fix typo (Carl Dong) 771c4b9 guix: README: Add darwin HOSTS entry (Carl Dong) 8dbf18c guix: Check for macOS SDK before building anything (Carl Dong) 34b23f5 guix: Set ZERO_AR_DATE for darwin build determinism (Carl Dong) f3835dc build: Make xorrisofs reproducible with -volume_date (Carl Dong) c9eb4cf guix: Add support for darwin builds (Carl Dong) 37fe73a build: Add var printing target to src/Makefile.am (Carl Dong) Pull request description: This PR brings our Guix builds on par with Gitian in terms of supported architectures. Reviewers: if you run a build, please submit: ``` find output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum ``` So that we can compare hashes and ensure reproducibility! ACKs for top commit: fanquake: ACK f169475 - I think we can make some small usability improvements, but this is ok to merge now. Tree-SHA512: 4af2b71654a9736467dcc681d10601c6eee37800d7847011a50585455b67b55d61742ca5604585f310a2fd75335b674e5e27dfb5169cb2f26e112aa4c411d8be
5200929 depends: Include GUIX_ENVIRONMENT in id string (Carl Dong) 4c7d418 depends: Improve id string robustness (Carl Dong) b3bdff4 build: Proper quoting for var printing targets (Carl Dong) Pull request description: ``` Environment variables and search paths can drastically effect the operation of build tools. Include these in our id string to mitigate against false cache hits. ``` Note to builders: This will invalidate all depends output caches in `BASE_CACHE` ACKs for top commit: laanwj: re-ACK 5200929 Tree-SHA512: e70c98da89cde90dc54bc3be89b925787cf94bbf246e27cc9345816b312073d78a02215448f731f21d8cf033c455234a2377ff1d66c00e1f3db69c9c9687d027
…guix builds cb151b7 build: Disable --disable-fuzz-binary for guix builds (Hennadii Stepanov) fd7caae build: Disable --disable-fuzz-binary for gitian builds (Hennadii Stepanov) Pull request description: Fuzz binary is not shipped to users. This PR saves hundreds MB of the disk space for containers. ACKs for top commit: MarcoFalke: review ACK cb151b7 fanquake: ACK cb151b7 Tree-SHA512: 858e3816576c307b47915bb05de79a28029beaef8835c01f1bd6a764a0cf7f7f63ef8c2dc2c5944cb36cc9f4788d9b0590b8a5dda96940167252ba371cdbd078
901f543 guix: Passthrough BASE_CACHE into container (Carl Dong) Pull request description: This allows depends-built packages to be cached. ACKs for top commit: MarcoFalke: Approach ACK 901f543 fanquake: ACK 901f543 Tree-SHA512: 464815f41fc081d7956bec84380668834b6ee6751c7a3d56daad6e1fc91e582de4bbdd1a89f399b1136f2adc4d9941517cfe4db694f0ee5bf59bf2f44fc6fda0
d02076b guix: Jump forwards in time-machine and adapt (Carl Dong) f8ca8c5 guix: Supply --keep-failed for debugging (Carl Dong) Pull request description: ``` The new time-machine commit is Guix v1.2.0 with a yet-unupstreamed patch for NSIS. A few important changes: 1. Guix switched back from using CPATH to C{,PLUS}_INCLUDE_PATH as the way to indicate #include search paths. 2. GCC's library is now split into a separate output, whereas before it was included in the default output. This means that our gcc toolchain packages need to propagate that output. 3. A few package versions were bumped ``` See this compare to review my custom patches to Guix: dongcarl/guix@version-1.2.0...7d6bd44 ACKs for top commit: laanwj: ACK d02076b Tree-SHA512: 896d5bf1b6e5fda2f0106013c568c119bbbb86cb31a8c0a22432bada9b7da51678b96374bf8fd7c15353698ba47ac9dd39874d40c39001281471db7c78bf1705
95990b9 guix: Update conservative space requirements (Carl Dong) 5e6df11 guix: Add support for powerpc64{,le} (Carl Dong) Pull request description: ``` The new time-machine commit contains a few small changes that make the powerpc cross-toolchain work. ``` See this compare to review my custom patches to Guix: dongcarl/guix@7d6bd44...6c9d16d ACKs for top commit: fanquake: ACK 95990b9 Tree-SHA512: 464b0fb93d65962d8c27499293edb618d13d18f40d44e3eed96935e86d430666dfb1c5b8a30f99ffdfd17b44514ad88e358977390b689a2e3831d521f6f7b86a
a6a1b10 guix: only download sources for hosts being built (fanquake) Pull request description: For example, if a user is only interested in building for Linux, this saves downloading the macOS compiler and additional dependencies, which is meaningful on a slow/poor connection. This will result in a few additional `make` invocations, for the Linux hosts, however this is low overhead, and time-wise irrelevant in terms of the overall build. ACKs for top commit: laanwj: Code review ACK a6a1b10 Tree-SHA512: 34c916ae6f69fed0d5845690b39111a8bee37208fd727176f375cf5eb4860f512abe12bde2680d697c859b4d50a3bc5688ddca7c2f28f9968fcf358753cf3f6d
d98f459 guix: Explicitly set umask in build container (Carl Dong) Pull request description: Opened as a separate PR to fix non-reproducibility found through testing here: bitcoin#21089 (comment) Many thanks to everyone who helped find this! ACKs for top commit: laanwj: ACK d98f459 fanquake: ACK d98f459 - I'm seeing matching hashes. Tree-SHA512: ea339c3902f2f4dea32e8ef5cc675a1df0679530881260ae999aaaf7339d5b12c46e01e58677cbb079f33e573ad105e2b443a835f3e944ef8e943a25f83027f1
13a9fd1 guix: Passthrough SDK_PATH into container (Carl Dong) Pull request description: This is a usability improvement for Guix builders so that they don't have to extract the Xcode tarball into `depends/SDKs` every time. Inspiration: bitcoin#21089 (comment) ACKs for top commit: laanwj: Tested ACK 13a9fd1 Tree-SHA512: 63392d537e48a0da9f0ee04a929613b139bef1ac5643187871c9ea5376afd2a3d95df0f5e0950ae0eccd2813b166667be98401e5a248ae9c187fe4e84e54d427
fbbb2d4 lint: Fix spelling errors in comments (fyquah) Pull request description: Found some spelling errors while running spelling linter bitcoin#21245 This PR fixes them. ACKs for top commit: fanquake: ACK fbbb2d4 - I thought we just fixed all of these. Tree-SHA512: 95525040001f94e899b778c616cb66ebafb679dff88835b66fccf6349d8eb942d6b7374c536a44e393f13156bce9a32ed57e6a82bb02074d2b3cddb2696addb2
c967fb7 guix: Remove libcap from manifest (Hennadii Stepanov) 7bbb409 guix: Update darwin native packages dependencies (Hennadii Stepanov) Pull request description: It is a bitcoin#20470 follow up. ACKs for top commit: fanquake: ACK c967fb7 Tree-SHA512: 66ce05770f578ba61a44c58747c5a2669f425a989ed987838058bd86e3b49e342ac5a4f8852fc49f2b3a86b58fb6a340fdf3e34c1fc19bdab910729febba4bc7
…ring 7476b46 guix: Build dmg as a static binary (Carl Dong) 06d6cf6 depends: libdmg-hfsplus: Skip CMake RPATH patching (Carl Dong) 65176ab guix: Remove codesign_allocate+pagestuff from unsigned tarball (Carl Dong) ca85679 guix: Use clang-toolchain instead of clang (Carl Dong) 1aec0ed guix: Fallback to local build for substitute-enabled Guix users (Carl Dong) 1742f8e guix: Add early health check for guix-daemon (Carl Dong) c1ae726 guix: More thoroughly control native toolchain (Carl Dong) 3974112 guix: Supply --link-profile (Carl Dong) d55a105 guix: Add troubleshooting documentation entries (Carl Dong) 7f401c9 guix: Adapt guix-build to prelude, restructure hier (Carl Dong) 4eccf06 guix: Remove guix-build.sh filename extension (Carl Dong) 7753357 guix: Add source-able bash prelude and utils (Carl Dong) e5b49a0 guix: Create windeploy inside distsrc-* (Carl Dong) 3e9982a contrib: Silence git-describe when looking for tag (Carl Dong) d5a71e9 guix: Use --cores instead of --max-jobs (Carl Dong) Pull request description: This PR addresses a few hiccups encountered by the brave souls who've been experimenting with the Guix scripts: - Resolves confusion between `--cores=` and `--max-jobs=` - `guix`'s `--cores=` actually corresponds to make's `--jobs=`, so let's just control `--cores=` with our overridable env var - `git-describe` will scream `fatal: no tag exactly matches '<hash>'` when looking for a tag, but we don't care, so silence that - `windeploy/unsigned` should be inside `distsrc-*` and created idempotently (sorry I know this one annoyed people) - Add troubleshooting documentation to `README.md` - Add early health check for `guix-daemon` in case user forgot to start a `guix-daemon` - Depending on configuration, a `--fallback` flag may be needed to tell Guix to not fail if substitutes fail but fallback to building locally - `codesign_allocate` and `pagestuff` are now unnecessary for codesigning as we're now using `signapple` A few robustness changes are also included: - We supply the `--link-profile` flag, as some Guix packages may expect the profile to be available under `$HOME/.guix-profile` - We now clear and manually set all toolchain-related env vars (e.g. `C*_INCLUDE_PATH`) ourselves, after patching a Qt::moc bug - We use the native `clang-toolchain` package for darwin builds instead of `clang`, lining up with all our other toolchain packages. Finally, we restructure the guix building hierarchy such that it looks something like: ``` guix-build-<short-hash-or-version-tag> ├── distsrc-<short-hash-or-version-tag>-${HOST} │ ├── contrib │ ├── depends │ ├── src │ └── ... ├── distsrc-<short-hash-or-version-tag>-... └── output ├── dist-archive │ └── bitcoin-<short-hash-or-version-tag>.tar.gz ├── *-linux-* │ ├── bitcoin-<short-hash-or-version-tag>-*-linux-*-debug.tar.gz │ └── bitcoin-<short-hash-or-version-tag>-*-linux-*.tar.gz ├── x86_64-apple-darwin18 │ ├── bitcoin-<short-hash-or-version-tag>-osx64.tar.gz │ ├── bitcoin-<short-hash-or-version-tag>-osx-unsigned.dmg │ └── bitcoin-<short-hash-or-version-tag>-osx-unsigned.tar.gz └── x86_64-w64-mingw32 ├── bitcoin-<short-hash-or-version-tag>-win64-debug.zip ├── bitcoin-<short-hash-or-version-tag>-win64-setup-unsigned.exe ├── bitcoin-<short-hash-or-version-tag>-win64.zip └── bitcoin-<short-hash-or-version-tag>-win-unsigned.tar.gz ``` Separating guix builds by their version identifier (basically namespacing them) allows us to change the layout in the future without worry about potential naming conflicts. ACKs for top commit: sipa: ACK 7476b46 laanwj: ACK 7476b46 Tree-SHA512: 0e899aa941aafdf552b2a7e8a08131ee9283180bbef7334439e2461a02aa7235ab7b9ca9c149b80fc5d0a9f4bbd35bc80fcee26197c0836ba8eaf2d86ffa0386
5c09bca Fix a typo in guix-build output (Pieter Wuille) Pull request description: This was overlooked in bitcoin#21375. ACKs for top commit: fanquake: ACK 5c09bca Tree-SHA512: 81d8ad4061abb17d5f16ae72ab0c88df76d5a2f100cb9f471ca700d2e87583103036367ea1958a1066f9613f63908d1b2b35734a7eb77ec9850d4c8b079732e1
94c7dd9 doc: Fix typos from codespell lint (Yerzhan Mazhkenov) Pull request description: Typos from codespell linter: https://cirrus-ci.com/task/6677401661865984?logs=lint#L856 - txrequest.cpp: `annoucements` ==> `announcements` - contrib/guix/README.md:298: `stil` ==> `still` - contrib/guix/guix-build:18: `invokable` ==> `invocable` - contrib/guix/libexec/prelude.bash:12: `invokable` ==> `invocable` - src/test/fuzz/tx_pool.cpp:37: `acess` ==> `access` - src/txorphanage.h:29: `orginating` ==> `originating` ACKs for top commit: practicalswift: cr ACK 94c7dd9: thnaks fro fiixng tpyos! jarolrod: ACK 94c7dd9 Tree-SHA512: e0fac462a2f9e68b6a161c9f5d95b4d0648ce5c618fd7cd243d57db8f0256138b8823b166ea406b21e95586eae43047df1ef0df04616858082a39c1d1eb13a86
…for container profiles 867a5e1 guix: Register garbage collector root for containers (Carl Dong) 8f8b96f guix: Update hint messages to mention guix-clean (Carl Dong) 44f6d4f guix: Record precious directories and add guix-clean (Carl Dong) 84912d4 build: Remove spaces from variable-printing rules (Carl Dong) Pull request description: ``` guix: Record precious directories and add guix-clean Many users have reported problems that stem from having an unclean working tree. To that end, I've written a guix-clean script which should help reset the working tree while respecting user-specified precious directories. Precious directories, such as: - SOURCES_PATH - BASE_CACHE - SDK_PATH - OUTDIR Should be preserved when cleaning the working tree, and are thus recorded in ./contrib/guix/var/precious_dirs. The ./contrib/guix/guix-clean script is able to parse that file and make sure to avoid them when cleaning out the working tree. ``` ACKs for top commit: laanwj: ACK 867a5e1 Tree-SHA512: c498fad781ff5e6406639df2b91b687fc528273fdf266bcdba8f6eec3b3b37ecce544b6da0252f0b9c6717f9d88e844e4c7b72d1877bdbabfc6871ddd0172af5
… doc 09b3e46 doc: remove boostrap info from GUIX_COMMON_FLAGS doc (fanquake) Pull request description: Passing `ADDITIONAL_GUIX_COMMON_FLAGS="--no-substitutes --bootstrap"` as suggested doesn't work: ```bash ...outputting in: '/bitcoin/guix-build-a1f0b8b62eb8/output/x86_64-linux-gnu' ...bind-mounted in container to: '/outdir-base/x86_64-linux-gnu' guix time-machine: error: bootstrap: unrecognized option ``` and I think bootstrapping is more than covered in the preceding "Choose your security model" section. ACKs for top commit: dongcarl: ACK 09b3e46 jarolrod: ACK 09b3e46 laanwj: Documentation review ACK 09b3e46 Tree-SHA512: e533a0b925a2ec091884ec04313f56376b4e85f615c8853dd51840181493d61bd01fee1c019e34880c32d7896e4871ea77e63398ba02b022f614c03bb16531aa
…or determinism c799a19 build, qt: No longer need to set QT_RCC_TEST=1 for determinism (Hennadii Stepanov) Pull request description: The Qt Resource Compiler (rcc) output order relies on [`QHash`](https://doc.qt.io/qt-5/qhash.html): > This randomization of `QHash` is enabled by default. Even though programs should never depend on a particular `QHash` ordering, there may be situations where you temporarily need deterministic behavior, for example for debugging or regression testing. To disable the randomization, define the environment variable `QT_HASH_SEED` to have the value 0. Since dashpay#3620 we use `QT_RCC_TEST=1` to achieve a deterministic output. Since Qt 5.3.1 hash seeding is disabled for all of the bootstrapped tools, including rcc. Therefore, `QT_RCC_TEST=1` is no longer needed. See commit [5283a6c87beac5a43f612786fefd6e43f2c70bf6](qt/qtbase@5283a6c). ACKs for top commit: fanquake: ACK c799a19 Tree-SHA512: 9d116ac1e8c605ee3e8ed7f618586f0de85d8b06bbbb70fe8c298939ce203d2a7e97264a9afac037179993ab54c5f69a65ebb9ab27ca7f45acb963011bd45743
a5550f8 build: use -stdlib++-isystem with Clang 10 (fanquake) 51d9d16 guix: use Clang 10 for the macOS cross compile (fanquake) b80a6af build: no longer patch threading out of ld64 (fanquake) c29cba4 build: Xcode 12.1, macOS SDK 10.15.6 (fanquake) 9ed2f19 build: native cctools 973.0.1, ld64 609 (fanquake) f48f187 build: Clang 10.0.1 (Hennadii Stepanov) 9b193cd build: libtapi 1100.0.11 (fanquake) Pull request description: Bumps our macOS toolchain to be using the following: * Clang 10.0.1 (gitian) & Clang 10.0.0 (Guix) * ld64 609 * libtapi 1100.0.11 * cctools 973.0.1 * Xcode 12.1 * macOS SDK 10.15.6 which are currently the most recent releases available as open source. See upstream [`cctools`](https://github.com/tpoechtrager/cctools-port/commits/973.0.1-ld64-609) and [`libtapi`](https://github.com/tpoechtrager/apple-libtapi/tree/1100.0.11). This should improve the possibility of Apple ARM cross-compilation in depends. This also removes our [patching out of pthreads usage](https://github.com/bitcoin/bitcoin/blob/master/depends/patches/native_cctools/ld64_disable_threading.patch) in `ld64`. There have been multiple changes since `ld64 450.3`, which have likely fixed the non-determinism we were working around. i.e from [InputFiles.cpp](https://opensource.apple.com/source/ld64/ld64-609/src/ld/InputFiles.cpp.auto.html): ```cpp // <rdar://problem/15002251> make implicit dylib order be deterministic by sorting by install_name std::sort(implicitDylibs.begin(), implicitDylibs.end(), DylibByInstallNameSorter()); ``` ```cpp // <rdar://problem/42675402> ld64 output is not deterministic due to dylib processing order std::sort(unprocessedDylibs.begin(), unprocessedDylibs.end(), [](const ld::dylib::File* lhs, const ld::dylib::File* rhs) { return strcmp(lhs->path(), rhs->path()) < 0; }); ``` Guix Build: ```bash find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum f6c3817b8fe5f7370299d1ae2533e4a3acd313ba9f9aa8d423a8956117e52dd5 guix-build-a5550f877a2c/output/dist-archive/bitcoin-a5550f877a2c.tar.gz 4954dcf563c2d496b8d9fecd48f8e3f7fba2f319ffa254a5bc8ee12cfee6acf0 guix-build-a5550f877a2c/output/x86_64-apple-darwin18/bitcoin-a5550f877a2c-osx-unsigned.dmg 8f6095b445c7f1a8e6accd86bb7f0696d5849402084927d2b726b7d557831c3a guix-build-a5550f877a2c/output/x86_64-apple-darwin18/bitcoin-a5550f877a2c-osx-unsigned.tar.gz cc40f25477b4defc1617ae694313d80f307ddf6742fe6cc85c6bc0e215ef8be0 guix-build-a5550f877a2c/output/x86_64-apple-darwin18/bitcoin-a5550f877a2c-osx64.tar.gz ``` Gitian Build: ```bash Generating report 506a8abdefe559999b43dd9f14905b9b2b5a3363b1cd013d45ae47acc1f7ef6c bitcoin-a5550f877a2c-osx-unsigned.dmg f606997f74026dd12d110d683c6f116b40df324836904ef507dd7ac787e6ebe2 bitcoin-a5550f877a2c-osx-unsigned.tar.gz 5b495ef15f2c3260c2950921b61326912a9bf533cccd51e13818809fd225489e bitcoin-a5550f877a2c-osx64.tar.gz f6c3817b8fe5f7370299d1ae2533e4a3acd313ba9f9aa8d423a8956117e52dd5 src/bitcoin-a5550f877a2c.tar.gz 9eb0221e962d2839770963bd03c6c9e98e8bf3078566bee2ae42f06233a710fa bitcoin-core-osx-22-res.yml Done. ``` ACKs for top commit: hebasto: ACK a5550f8 Tree-SHA512: 504c4b0f9cd3b939714a322298320c5bde07e9356a48a9a000060b36f8dce4d6134ed60c3a5188810476a28ec5b108733eabbc6fb8053231b9ea8a494cc91b12
c90f6e5 guix: Consistently use gcc-8 for $HOST (Carl Dong) Pull request description: Only non-base commit is the last commit: bitcoin@b5abb07 Right now, here's what we use in Gitian: - Linux: Focal's [`g++-8-<arch>-linux-gnu`](https://packages.ubuntu.com/focal/g++-8-aarch64-linux-gnu) (`8.4.0-3ubuntu1cross1`) - MinGW-w64: Focal's [`g++-mingw-w64`](https://packages.ubuntu.com/focal/g++-mingw-w64) (`9.3.0-7ubuntu1+22~exp1ubuntu4`) In Guix right now we use `gcc-9` across the board. I think it makes more sense to use `gcc-8` across the board, as it doesn't suffer from the `memcmp` bug, and is what debian buster (stable) does, meaning it will be well tested ([`g++-mingw-w64`](https://packages.debian.org/buster/g++-mingw-w64), [`g++-aarch64-linux-gnu`](https://packages.debian.org/buster/g++-aarch64-linux-gnu)). We can accomplish this somewhat easily using Guix as we have tighter control over the toolchain (see: bitcoin@b5abb07). Let me know your thoughts! ACKs for top commit: MarcoFalke: Approach ACK c90f6e5, haven't reviewed laanwj: Code review ACK c90f6e5 hebasto: ACK c90f6e5, I have reviewed the code and it looks OK, I agree it can be merged. Tree-SHA512: 3e5b9297305232273323aa745ec417ed1be2418ead0e432db7742f5d5f45efe6e4a2ed44328731512cff4bfde80e5f2dc350a131b8b8fb9207a2ef66bce27ed2
d420e5c guix-attest: Avoid incomplete sigdirs with ERR traps (Carl Dong) feda2c8 guix: Skip attesting to dist-archive (Carl Dong) d522d80 guix: Attest to inputs in inputs.SHA256SUMS (Carl Dong) f9e2960 guix: Construct $OUTDIR in ${DISTSRC}/output (Carl Dong) 022abc8 guix: Minor quoting fix in libexec/build.sh (Carl Dong) c83c4fa guix-attest: Allow skipping GPG signing with NO_SIGN (Carl Dong) 0e1c2e4 guix-attest: Use ascii-armor signatures (Carl Dong) b5fd89c guix-attest: Only use cross-platform flags for find+xargs (Carl Dong) 5926432 guix: Add guix-verify script (Carl Dong) 30daf76 guix: Add guix-attest script (Carl Dong) Pull request description: Adds replacements for `gsign` and `gverify`. Personally I'm not a big fan of using the word "sign" as it's been used to refer to both codesigning and GPG signing. ACKs for top commit: laanwj: Code review and tested ACK d420e5c Tree-SHA512: 93d82d201f4596eaea0e3825aa55b013dfb91790e6ccee79893833d37921513d7b4e735f0641103e1e2ea8308abe4cb6218b73160924708802f2e0e3f7f6caf1
…sx+win ee88320 guix: repro: Sort find output in libtool for gcc-8 (Carl Dong) ee0a67c codesigning: Use SHA256 as digest for osslsigncode (Windows) (Carl Dong) 38eb91e guix: Add codesigning functionality (Carl Dong) bac2690 guix: Package codesigning tools (Carl Dong) 0a2176d guix: Reindent existing manifest.scm (Carl Dong) c090a3e Makefile.am: use APP_DIST_DIR instead of hard-coding dist (Carl Dong) Pull request description: This is the last PR before we reach feature-parity with the Gitian process! Note: I tried using the `Makefile` inside the distsrc to make the dmg instead of manually listing out the commands, but `make` seems to want to re-make a lot of other files which broke the dmg. The workflow looks something like this: 1. `env [ FOO=bar... ] ./contrib/guix/guix-build` (add additional env vars as necessary) 2. Codesigners only: 1. Copy `guix-build-<short-id>/output/x86_64-apple-darwin18/bitcoin-<short-id>-osx-unsigned.tar.gz` and `guix-build-<short-id>/output/x86_64-w64-mingw32/bitcoin-<short-id>-win-unsigned.tar.gz` to signing computer 2. Codesign with `./detached-sig-create.sh` inside the tarball 3. Upload contents of `signature-{osx,win}.tar.gz` to https://github.com/bitcoin-core/bitcoin-detached-sigs (as a new tag) 3. Checkout new tag for `bitcoin-core/bitcoin-detached-sigs` with the detached signatures 4. `env [ FOO=bar... ] DETACHED_SIGS_REPO=<path/to/bitcoin-detached-sigs> ./contrib/guix/guix-codesign` (modify env vars as necessary) 5. Make sure `guix.sigs` is cloned and updated 6. `env GUIX_SIGS_REPO=<path/to/guix.sigs> SIGNER=0x96AB007F1A7ED999=dongcarl ./contrib/guix/guix-attest` (modify env vars as necessary) 7. Commit your new signatures and SHA256SUMS in `guix.sigs` 8. Optionally, after there are multiple signatures in `guix.sigs`: `env GUIX_SIGS_REPO=<path/to/guix.sigs> ./contrib/guix/guix-verify` ACKs for top commit: laanwj: Tested ACK ee88320 achow101: ACK ee88320 Tree-SHA512: e812a07a5f19f900600c70cb9c717769ef544a6c0c12760b5558b76b6b37df863257f3dbf38b0757e6e06e334470267e94c9f2bdbc27409d6837b1a0bfc6acbc
a58868d build: Makes rcc output always deterministic (Hennadii Stepanov) Pull request description: The Qt Resource Compiler ([rcc](https://doc.qt.io/qt-5/rcc.html)) has a command-line option `--format-version` which has the [default value](https://code.qt.io/cgit/qt/qtbase.git/tree/src/tools/rcc/main.cpp?h=5.12.10#n172) 2. The only difference from `--format-version 1` is adding a [last modified timestamp](https://code.qt.io/cgit/qt/qtbase.git/tree/src/tools/rcc/rcc.cpp?h=5.12.10#n207) to the output file ([credits](bitcoin#21654 (comment)) to **fanquake**). That, in turn, forces us to use `QT_RCC_SOURCE_DATE_OVERRIDE=1` to get deterministic builds (bitcoin#13732). This change makes rcc output always deterministic by using `--format-version 1` option that makes usage of the `QT_RCC_SOURCE_DATE_OVERRIDE` needless. --- Also it improves interaction with ccache: On master (f6c44e9): ``` $ make && make clean && ccache --zero-stats && make && ccache --show-stats ... cache directory /home/hebasto/.ccache primary config /home/hebasto/.ccache/ccache.conf secondary config (readonly) /etc/ccache.conf stats updated Sun Apr 11 15:45:43 2021 stats zeroed Sun Apr 11 15:45:05 2021 cache hit (direct) 638 cache hit (preprocessed) 0 cache miss 1 cache hit rate 99.84 % called for link 10 cleanups performed 0 files in cache 20023 cache size 13.2 GB max cache size 15.0 GB ``` The missed file is always `qt/libbitcoinqt_a-qrc_bitcoin_locale.o`. With this PR: ``` $ make && make clean && ccache --zero-stats && make && ccache --show-stats ... cache directory /home/hebasto/.ccache primary config /home/hebasto/.ccache/ccache.conf secondary config (readonly) /etc/ccache.conf stats updated Sun Apr 11 15:28:46 2021 stats zeroed Sun Apr 11 15:28:21 2021 cache hit (direct) 639 cache hit (preprocessed) 0 cache miss 0 cache hit rate 100.00 % called for link 10 cleanups performed 0 files in cache 20012 cache size 13.2 GB max cache size 15.0 GB ``` ACKs for top commit: fanquake: ACK a58868d Tree-SHA512: 52f4a3267f41883d13025c0de79b6da22e92d60c729e01b986935c6812bbfe7fadc40b742bd715bfdf09df94af6838d4fbbe8208c6123f366108e38c8e1121c5
108a6be guix: Check for disk space availability before building (Carl Dong) d7dec89 guix: Remove dest if OUTDIR mv fails (Carl Dong) Pull request description: There seems to be some corner cases that can be hit when guix scripts unexpectedly fail in the middle of operation, see: https://gnusha.org/bitcoin-builds/2021-05-24.log - Perform an early disk space check for `guix-build` - Overwrite existing output directory after a successful build (the existing one might be malformed), and cleanup output directory if the `mv` somehow fails ACKs for top commit: laanwj: Tested ACK 108a6be achow101: ACK 108a6be Tree-SHA512: cf6438317da40bf55714cd2d8cce859b3d435cc66cabefe8d4a53552d7880966acfe84ffe8fadf1c80e368ae6b037992258a6d409df85ffc6ce8bf780e98e2e5
683d197 Use latest signapple commit (Andrew Chow) Pull request description: Update gitian and guix to use the same latest signapple commit. Also changed guix to use the actual repo. The changes from the fork were incorporated upstream. ACKs for top commit: fanquake: ACK 683d197 - sanity checked that the updated package is built: Tree-SHA512: a4981f8bbe33e6c5654632bc9b9f6f2f1e675741a19ac7296205e370f1e64a747101ecb632e0cc82a0134e4c2e9ce47b3f7b4d8c8f75f0f06dd069c078303759
…d hierarchy e2c40a4 guix-attest: Error out if SHA256SUMS is unexpected (Carl Dong) 4cc35da Rewrite guix-{attest,verify} for new hier (Carl Dong) 28a9c9b Make SHA256SUMS fragment right after build (Carl Dong) Pull request description: Based on: bitcoin#22075 Code reviewers: I recommend reading the new `guix-{attest,verify}` files instead of trying to read the diff The following changes resolve many usability improvements which were pointed out to me: 1. Some maintainers like to extract their "uncodesigned tarball" inside the `output/` directory, resulting in the older `guix-attest` mistakenly attesting to the extracted contents 2. Maintainers whose GPG keys reside on an external smartcard often need to physically interact with the smartcard as a way to approve the signing operation, having one signature per platform means a lot of fidgeting 3. Maintainers wishing to sign on a separate machine now has the option of transferring only a subtree of `output/`, namely `output/*/SHA256SUMS.part`, in order to perform a signature (you may need to specify an `$OUTDIR_BASE` env var) 4. An `all.SHA256SUMS` file should be usable as the base `SHA256SUMS` in bitcoin core torrents and on the release server. For those who sign on an separate machine than the one you do builds on, the following steps will work: 1. `env GUIX_SIGS_REPO=/home/achow101/guix.sigs SIGNER=achow101 NO_SIGN=1 ./contrib/guix/guix-attest` 2. Copy `/home/achow101/guix.sigs/<tag>/achow101` (which does not yet have signatures) to signing machine 3. Sign the `SHA256SUMS` files: ```bash for i in "<path-to-achow101>/*.SHA256SUMS"; do gpg --detach-sign --local-user "<your-key-here>" --armor --output "$i"{.asc,} done ``` 5. Upload `<path-to-achow101>` (now with signatures) to `guix.sigs` ----- After this change, output directories will now include a `SHA256SUMS.part` fragment, created immediately after a successful build: ``` output └── x86_64-w64-mingw32 ├── bitcoin-4e069f7589da-win64-debug.zip ├── bitcoin-4e069f7589da-win64-setup-unsigned.exe ├── bitcoin-4e069f7589da-win64.zip ├── bitcoin-4e069f7589da-win-unsigned.tar.gz └── SHA256SUMS.part ``` These `SHA256SUMS.part` fragments look something like: ``` 3ebd7262b1a0a5bb757fef1f70e7e14033c70f98c059bc4dbfee5d1992b25825 dist-archive/bitcoin-4e069f7589da.tar.gz def2e7d3de5ab3e3f955344e75151df4f33713f9101f5295bd13c9375bdf633b x86_64-w64-mingw32/bitcoin-4e069f7589da-win64-debug.zip 643049fe3ee4a4e83a1739607e67b11b7c9b1a66208a6f35a9ff634ba795500e x86_64-w64-mingw32/bitcoin-4e069f7589da-win64-setup-unsigned.exe a247a1ccec0ccc2e138c648284bd01f6a761f2d8d6d07d91b5b4a6670ec3f288 x86_64-w64-mingw32/bitcoin-4e069f7589da-win-unsigned.tar.gz fab76a836dcc592e39c04fd2396696633fb6eb56e39ecbf6c909bd173ed4280c x86_64-w64-mingw32/bitcoin-4e069f7589da-win64.zip ``` Meaning that they are valid `SHA256SUMS` files when `sha256sum --check`'d at the `guix-build-*/output` directory level When `guix-attest` is invoked, these `SHA256SUMS.part` files are combined and sorted (by `-k2`, `LC_ALL=C`) to create: 1. `noncodesigned.SHA256SUMS` for a manifest of all non-codesigned outputs, and 3. `all.SHA256SUMS` for a manifest of all outputs including non-codesigned outputs Then both files are signed, resulting in the following `guix.sigs` hierarchy: ``` 4e069f7/ └── dongcarl ├── all.SHA256SUMS ├── all.SHA256SUMS.asc ├── noncodesigned.SHA256SUMS └── noncodesigned.SHA256SUMS.asc ``` ACKs for top commit: achow101: ACK e2c40a4 hebasto: ACK e2c40a4, tested on Linux Mint 20.1 (x86_64) with and w/o `NO_SIGN=1`. Changes in `contrib/guix/libexec/codesign.sh` and `contrib/guix/guix-verify` are reviewed only. Tree-SHA512: 618aacefb0eb6595735a9ab6a98ea6598fce65f9ccf33fa1e7ef93bf140c0f6cfc16e34870c6aa3e4777dd3f004b92a82a994141879870141742df948ec59c1f
… our cross toolchains on older glibcs 647f7e5 guix: Also sort SHA256SUMS.part (Carl Dong) dc4137a guix: Build depends/qt with our platform definition (Carl Dong) 16b0a93 guix: Rebase toolchain on glibc 2.24 (2.27 for riscv64) (Carl Dong) Pull request description: After this PR, we'll have the following: - riscv64 -> build with a toolchain targeting glibc 2.27 - everything else -> builds with a toolchain targeting glibc 2.24, but will not have symbols > 2.17 (checked by `symbol-check.py`) ACKs for top commit: achow101: reACK 647f7e5 hebasto: ACK 647f7e5 MarcoFalke: review ACK 647f7e5 fanquake: ACK 647f7e5 - documentation can be fixed shortly. Tree-SHA512: ddff57a5d7c053687b0a273720d4ad7d28c6fc8816226d4304869284d017af5e3630d4b57565d91e74f2e1b7583c9c83ee8b2e5e70e41d619ab618e602c97a94
… from Guix build 797b3ed script: remove gitian reference from symbol-check.py (fanquake) 15fc9a0 guix: add additional documentation to patches (fanquake) 4516e5e lint: exclude Guix patches from spell-checking (fanquake) de6ca41 guix: no-longer pass --enable-glibc-back-compat to Guix (fanquake) 84dd81f build: remove glibc backcompat requirement for Linux symbol checks (fanquake) Pull request description: Now that our Guix toolchains are based on glibc 2.24 and 2.27 (RISCV), we don't need to use the `--enable-glibc-back-compat` option to produce binaries that don't use any symbols from glibc 2.17 and 2.27 or later. This also adds additional documentation to some Guix patches (pointed out in bitcoin#22365) and removes Guix patches from the spelling linter, because that isn't our spelling. Symbol usage: https://gist.github.com/fanquake/d15604fc580718444c5aa4b3c3c75fdc. Guix Builds: ```bash bash-5.1# find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum ed54e6a6cf4fab328557c0c72eb08c73f2a58c6c70959544cf4b1882e75ea69e guix-build-797b3ed90900/output/aarch64-linux-gnu/SHA256SUMS.part 83bd9dadc59f89f848d143fa4fc3964f16fe0b4bdf35e5093b577ff2c4bd1f43 guix-build-797b3ed90900/output/aarch64-linux-gnu/bitcoin-797b3ed90900-aarch64-linux-gnu-debug.tar.gz 94cb8c35281f12dec6ea5b390b66cad5e27ac8c45a30c42c8d38c438695d54c0 guix-build-797b3ed90900/output/aarch64-linux-gnu/bitcoin-797b3ed90900-aarch64-linux-gnu.tar.gz 7318b63d65c0aa52d2446de8e1f40658d2e47ab8fb0268820c3b7585d140fb23 guix-build-797b3ed90900/output/arm-linux-gnueabihf/SHA256SUMS.part 95e1ffb372964b73f539653ca703b70cf0c018801a9c4c0ffc46a0b63539253c guix-build-797b3ed90900/output/arm-linux-gnueabihf/bitcoin-797b3ed90900-arm-linux-gnueabihf-debug.tar.gz 039d3842e6499626cf955ae0a7590dd6b3d0935cdc217c98aaf9d156b0ebd3b4 guix-build-797b3ed90900/output/arm-linux-gnueabihf/bitcoin-797b3ed90900-arm-linux-gnueabihf.tar.gz e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 guix-build-797b3ed90900/output/dist-archive/SKIPATTEST.TAG 2c4e7b6e7aff63ba811e5bf59362d16866c3a358f8844fba8739a61192870622 guix-build-797b3ed90900/output/dist-archive/bitcoin-797b3ed90900.tar.gz 955029b949c368eabd517dd33040d2f01e2ac6a55e7b4f9107907a7c6e0c6060 guix-build-797b3ed90900/output/powerpc64-linux-gnu/SHA256SUMS.part fd6d6b137f8efedf58a879d11205b1d4649e1f97d7f91e193239ef206fcc285d guix-build-797b3ed90900/output/powerpc64-linux-gnu/bitcoin-797b3ed90900-powerpc64-linux-gnu-debug.tar.gz 51736ac8e77737999f1b5bd4c381b0016f19a8d5e40e786fe941ff04e84c11c9 guix-build-797b3ed90900/output/powerpc64-linux-gnu/bitcoin-797b3ed90900-powerpc64-linux-gnu.tar.gz 8c244c16bfa46c1efdb120e1d91fdd14d3f14eefee8d7e1fbb0a9b4664a5c315 guix-build-797b3ed90900/output/powerpc64le-linux-gnu/SHA256SUMS.part 704ee593251a1b1c65a5bebeef93b23f266af4e8cbf8ae556150c3b2e8f06a6c guix-build-797b3ed90900/output/powerpc64le-linux-gnu/bitcoin-797b3ed90900-powerpc64le-linux-gnu-debug.tar.gz 0ec06ae7d344de20d61e3965d8b383747ef20b0e9d93a3165733ea23bdf2ead8 guix-build-797b3ed90900/output/powerpc64le-linux-gnu/bitcoin-797b3ed90900-powerpc64le-linux-gnu.tar.gz 2dd6c6ecc67b0ea40ca9c43f92efca81ccd054b8db8c197ad84ad9674d510a25 guix-build-797b3ed90900/output/riscv64-linux-gnu/SHA256SUMS.part 5ebb27a855a677f7a188d83995be6b2a3ea8606be152abb7fc7832713fb0677a guix-build-797b3ed90900/output/riscv64-linux-gnu/bitcoin-797b3ed90900-riscv64-linux-gnu-debug.tar.gz bdaf1783f5e1861597afa37c1880364e118d9a7a7af8017302d82202791019f6 guix-build-797b3ed90900/output/riscv64-linux-gnu/bitcoin-797b3ed90900-riscv64-linux-gnu.tar.gz 726c9092b60ac2e7d7e14b2c24467fcf276a6f89170a871ddab9dce6ac230699 guix-build-797b3ed90900/output/x86_64-apple-darwin18/SHA256SUMS.part 2af4d709b44952654f3c08c86593bf2ccc9a44ed422783a1b95b8a199a894db2 guix-build-797b3ed90900/output/x86_64-apple-darwin18/bitcoin-797b3ed90900-osx-unsigned.dmg fd49ba445aa6cf3d8c47019a05e9e5740cb0f53349344dd80671297127f49f1a guix-build-797b3ed90900/output/x86_64-apple-darwin18/bitcoin-797b3ed90900-osx-unsigned.tar.gz 3f51cbf8cf18420d4be70e656aa993675cf5e828a255c2030047ae2e059ed5b7 guix-build-797b3ed90900/output/x86_64-apple-darwin18/bitcoin-797b3ed90900-osx64.tar.gz afd1edee1447bb88d81e972abfae4c4e065b5b1827769f033cff9472084c7c1b guix-build-797b3ed90900/output/x86_64-linux-gnu/SHA256SUMS.part ec468ef886d25e685f4f7a18b4f7d497dedf757495e0d5beb72c23cc32ab69b5 guix-build-797b3ed90900/output/x86_64-linux-gnu/bitcoin-797b3ed90900-x86_64-linux-gnu-debug.tar.gz 1934d7294f0c9e083d38a3f68d4a61cd679defa79ce0a89f77386978692b9b18 guix-build-797b3ed90900/output/x86_64-linux-gnu/bitcoin-797b3ed90900-x86_64-linux-gnu.tar.gz 94c11c328a628052eb6f50e9816aa768f87ea7acfbbbafdab60f6928da766811 guix-build-797b3ed90900/output/x86_64-w64-mingw32/SHA256SUMS.part fd371922ba93d81bd4a2b711d617af6756f9f0494db6d83aa0e5f491a24168ef guix-build-797b3ed90900/output/x86_64-w64-mingw32/bitcoin-797b3ed90900-win-unsigned.tar.gz 4e4ad976bc029bbbf9596ad8493accaaba8b0d5c598dd342f8da330609bbdf21 guix-build-797b3ed90900/output/x86_64-w64-mingw32/bitcoin-797b3ed90900-win64-debug.zip 3a89a16b9101e9a17d98efb9234b5bdd264c0bba2c6326511017730e1a08311f guix-build-797b3ed90900/output/x86_64-w64-mingw32/bitcoin-797b3ed90900-win64-setup-unsigned.exe e285ab737e3c843fd3f1c26c2f053e421a3c39b33995747ce48281884d3f28d1 guix-build-797b3ed90900/output/x86_64-w64-mingw32/bitcoin-797b3ed90900-win64.zip ``` ACKs for top commit: sipa: utACK 797b3ed hebasto: ACK 797b3ed Tree-SHA512: 3a569702d8832c155c5ce8d2f6d823f7f12603885576078bc5192bc9038a48261ecb541800f79d1e9bc86d71fa640265c5b8b89df9d8bb680b3bb05d9d78a666
1edddf5 Avoid GCC 7.1 ABI change warning in guix build (Pieter Wuille) Pull request description: The arm-linux-gnueabihf guix build output is littered with warnings like: ``` /gnu/store/7a96hdqdb2qi8a39f09n84xjy2hr23rs-gcc-cross-arm-linux-gnueabihf-8.4.0/include/c++/bits/stl_vector.h:1085:4: note: parameter passing for argument of type '__gnu_cxx::__normal_iterator<CRecipient*, std::vector<CRecipient> >' changed in GCC 7.1 ``` These are irrelevant for us. Disable them using `-Wno-psabi`. ACKs for top commit: laanwj: ACK 1edddf5 hebasto: ACK 1edddf5, after thorough reading related materials, I agree this change can be merged. As I mentioned above, I have been compiling my arm-32bit binaries with `-Wno-psabi` flag for two years, and no related flaws were observed. Tree-SHA512: 485c7500547ac5da567ad23847341c18ff832607f5a1002676404cc647e437cf3445b6894ecff5b52929ca52bea946c06bd90eace1997c895e56204e787065e4
… upstream 1.3.0 commit e6a94d4 guix: Bump to version-1.3.0 from upstream (Carl Dong) 90fd13b guix: Pin kernel header version (Carl Dong) Pull request description: ``` - Use 4.19 for riscv64 (earliest LTS release w/ riscv64 support) - Use 4.9 for all others (second-oldest LTS release, released in combination with glibc glibc 2.24 in Debian stretch) ``` ``` The chosen commit is the HEAD of Guix's version-1.3.0 branch as of July 15th, 2021. Also fix visual indenting. ``` ----- This + the documentation PR should make our Guix system ready for release! ACKs for top commit: MarcoFalke: review ACK e6a94d4 to change to vanilla guix. Did not review the kernel change. laanwj: ACK e6a94d4 fanquake: ACK e6a94d4 Tree-SHA512: a175e4ddb3ee786a39f5e800ce336932ad2f6797a3a28400a6f723875d0f19833fd36cedc41b3580e4604110517211bd9f557be36adf7265fd8e591c434ae032
9f01fed guix/build: Remove vestigial SKIPATTEST.TAG (Carl Dong) Pull request description: No longer needed or referenced by anything. A relic from prior to the great hierarchy overhaul of bitcoin#22182 ACKs for top commit: achow101: ACK 9f01fed fanquake: ACK 9f01fed Tree-SHA512: a94cf63f0c5cb8dbacf1025b6c0e81b219c2a3c93b3cbcefc239ccde29e602ecd4b717b1d93dbe53cb791a5017236fb09823c034aec42b0c31894fc9e0ab8b21
d451b60 guix-verify: Non-zero exit code when anything fails (Carl Dong) Pull request description: ``` Previously, if verification fails, the correct message will be printed, but the exit code would still be 0. ``` ACKs for top commit: achow101: ACK d451b60 Tree-SHA512: 695d72121f308d8a66db780eca16878fb378b4d766de5b58c2d6f778c5661a2f7bdf37a96e8e8e283b0a46b5d55f24bca05fa7509aa1822f0854c50064200572
…SION` 96cc6bb guix/prelude: Override VERSION with FORCE_VERSION (Carl Dong) Pull request description: ``` Previously, if the builder exported $VERSION in their environment (as past Gitian-building docs told them to), but their HEAD does not actually point to v$VERSION, their build outputs will differ from those of other builders. This is because the contrib/guix/guix-* scripts only ever act on the current git worktree, and does not try to check out $VERSION if $VERSION is set in the environment. Setting $VERSION only makes the scripts pretend like the current worktree is $VERSION. This problem was seen in jonatack's attestation for all.SHA256SUMS, where only his bitcoin-22.0rc3-osx-signed.dmg differed from everyone else's. Here is my deduced sequence of events: 1. Aug 27th: He guix-builds 22.0rc3 and uploads his attestations up to guix.sigs 2. Aug 30th, sometime after POSIX time 1630310848: he pulls the latest changes from master in the same worktree where he guix-built 22.0rc3 and ends up at 7be143a 3. Aug 30th, sometime before POSIX time 1630315907: With his worktree still on 7be143a, he guix-codesigns. Normally, this would result in outputs going in guix-build-7be143a960e2, but he had VERSION=22.0rc3 in his environment, so the guix-* scripts pretended like he was building 22.0rc3, and used 22.0rc3's guix-build directory to locate un-codesigned outputs and dump codesigned ones. However, our SOURCE_DATE_EPOCH defaults to the POSIX time of HEAD (7be143a), which made all timestamps in the resulting codesigned DMG 1630310848, 7be143a's POSIX timestamp. This differs from the POSIX timestamp of 22.0rc3, which is 1630348517. Note that the windows codesigning procedure does not consider SOURCE_DATE_EPOCH. We resolve this by only allowing VERSION overrides via the FORCE_VERSION environment variable. ``` Please ignore the branch name, it's not relevant to the change. ACKs for top commit: fanquake: ACK 96cc6bb - Also makes sense given there are Guix build guides recommending to set `VERSION` as part of the process. i.e https://gist.github.com/hebasto/7293726cbfcd0b58e1cfd5418316cee3. Tree-SHA512: 9dca3fc637ce11049286a3ebee3cd61cce2125fc51d31cf472fbed7f659e1846fc44062753e0e71bfaec9e7fbab6f040bb88d9d4bc4f8acb28c6890563584acf
…ator test b7ecef1 guix: ignore additioanl failing certvalidator test (fanquake) Pull request description: Backports bitcoin@8588591 from bitcoin#24057 so that from-scratch Guix builds for the Darwin host aren't broken due to a (very recently) expired certificate causing one of the python-certvalidator tests to fail. Kept separate from bitcoin#23276 because that hasn't gotten review attention, and I don't think we should leave `22.x` Darwin Guix builds broken for any longer than we have to. Fixes bitcoin#24110. ```bash ====================================================================== ERROR: test_revocation_mode_soft (tests.test_validate.ValidateTests) ---------------------------------------------------------------------- Traceback (most recent call last): File "/tmp/guix-build-python-certvalidator-0.1-1.e5bdb4b.drv-0/source/tests/test_validate.py", line 85, in test_revocation_mode_soft validate_path(context, path) File "/tmp/guix-build-python-certvalidator-0.1-1.e5bdb4b.drv-0/source/tests/../certvalidator/validate.py", line 50, in validate_path return _validate_path(validation_context, path) File "/tmp/guix-build-python-certvalidator-0.1-1.e5bdb4b.drv-0/source/tests/../certvalidator/validate.py", line 358, in _validate_path raise PathValidationError(pretty_message( certvalidator.errors.PathValidationError: The path could not be validated because the end-entity certificate expired 2022-01-14 12:00:00Z ``` Guix Build: ```bash bash-5.1# find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum 359755bffecc64b4c005c5cdee3824190f6b1759dbc6c20034476dcc06413959 guix-build-b7ecef1ddf0c/output/dist-archive/bitcoin-b7ecef1ddf0c.tar.gz 0c6700270ec75991d70a97cad77e22cc00553f812edb56c1bac5ef6421f963e1 guix-build-b7ecef1ddf0c/output/x86_64-apple-darwin/SHA256SUMS.part 87d4637a87959a304422550edf87feda3953d7305894154a6a2d413cc0dd2034 guix-build-b7ecef1ddf0c/output/x86_64-apple-darwin/bitcoin-b7ecef1ddf0c-osx-unsigned.dmg 9cabae32689bd5f93e7faaaf341827f1c4069a63ab6f74276564e47819343b6c guix-build-b7ecef1ddf0c/output/x86_64-apple-darwin/bitcoin-b7ecef1ddf0c-osx-unsigned.tar.gz bb5fb113bc022a305e49783d0ba48be90aca61e4a942beeb45206dbc5b91ca6e guix-build-b7ecef1ddf0c/output/x86_64-apple-darwin/bitcoin-b7ecef1ddf0c-x86_64-apple-darwin.tar.gz ``` ACKs for top commit: MarcoFalke: Concept ACK b7ecef1 Tree-SHA512: 8f761fece405b3b974b9f42ab4ebf8995d3284ce7bfb0556ff8459e1a7d30f8bd2f407cb5651e9fa1094c493148bba7a8918a251b54a83efe12acfaf3d39f350
1a0993a scripts: add PE dylib checking to symbol-check.py (fanquake) Pull request description: Uses `objdump -x` and looks for `DLL Name:` lines. i.e: ```bash objdump -x src/qt/bitcoin-qt.exe | grep "DLL Name:" DLL Name: ADVAPI32.dll DLL Name: dwmapi.dll DLL Name: GDI32.dll DLL Name: IMM32.dll DLL Name: IPHLPAPI.DLL DLL Name: KERNEL32.dll DLL Name: msvcrt.dll DLL Name: ole32.dll DLL Name: OLEAUT32.dll DLL Name: SHELL32.dll DLL Name: SHLWAPI.dll DLL Name: USER32.dll DLL Name: UxTheme.dll DLL Name: VERSION.dll DLL Name: WINMM.dll DLL Name: WS2_32.dll ``` ACKs for top commit: dongcarl: Concept ACK 1a0993a hebasto: ACK 1a0993a, tested on Linux Mint 19.3: Tree-SHA512: 0099a50e2c616d5239a15cafa9a7c483e9c40244af41549e4738be0f5360f27a2afb956eb50b47cf446b242f4cfc6dc9d111306a056fb83789eefbd71eddabd2
This was referenced Apr 3, 2023
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue being fixed or feature implemented
This PR improve overall support of guix:
Furthermore Guix is considered as a replacement for gitian for binary builds.
Prior work: #5194
Related issue: https://github.com/dashpay/dash-issues/issues/47
What was done?
There is a bunch of backports that is related to guix. These backports improve overall support of guix
gcc-8across the board bitcoin/bitcoin#21799VERSIONwithFORCE_VERSIONbitcoin/bitcoin#22847What is NOT done yet?
freetypepackage. To-be-fixed in further backportsguixto newer version. It would be done in futher PR, not trivial to be done ATM.native_qt5andnative_sqlite, but doesn't have fornative_tsan,arm,native_cxx20. Instead, let's do better build: remove glibc back compat bitcoin/bitcoin#22930 and after that we can finish this backport build: remove --enable-glibc-back-compat from Guix build bitcoin/bitcoin#22405 by adding missing changes:How Has This Been Tested?
export SDK_PATH=..... Be aware, that it works only for full path (not relative). Otherwise you will see this error similar to:contrib/guix/guix-build. You need ~30Gb of free space to get built all platform.NOTE: be careful with
./contrib/guix/guix-cleanbecause it removes all files without an entry in the index.Guix hashes
Gitian hashes
Don't forget to add Xcode-12.1 to
gitian-builder/inputs/Xcode-12.1-12A7403-extracted-SDK-with-libcxx-headers.tar.gzBreaking Changes
Should not be breaking changes at the moment. Btw, there's bump of XCode sdk version.
Checklist: