guix/prelude: Override VERSION with FORCE_VERSION
#22847
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Previously, if the builder exported $VERSION in their environment (as past Gitian-building docs told them to), but their HEAD does not actually point to v$VERSION, their build outputs will differ from those of other builders. This is because the contrib/guix/guix-* scripts only ever act on the current git worktree, and does not try to check out $VERSION if $VERSION is set in the environment. Setting $VERSION only makes the scripts pretend like the current worktree is $VERSION. This problem was seen in jonatack's attestation for all.SHA256SUMS, where only his bitcoin-22.0rc3-osx-signed.dmg differed from everyone else's. Here is my deduced sequence of events: 1. Aug 27th: He guix-builds 22.0rc3 and uploads his attestations up to guix.sigs 2. Aug 30th, sometime after POSIX time 1630310848: he pulls the latest changes from master in the same worktree where he guix-built 22.0rc3 and ends up at 7be143a 3. Aug 30th, sometime before POSIX time 1630315907: With his worktree still on 7be143a, he guix-codesigns. Normally, this would result in outputs going in guix-build-7be143a960e2, but he had VERSION=22.0rc3 in his environment, so the guix-* scripts pretended like he was building 22.0rc3, and used 22.0rc3's guix-build directory to locate un-codesigned outputs and dump codesigned ones. However, our SOURCE_DATE_EPOCH defaults to the POSIX time of HEAD (7be143a), which made all timestamps in the resulting codesigned DMG 1630310848, 7be143a's POSIX timestamp. This differs from the POSIX timestamp of 22.0rc3, which is 1630348517. Note that the windows codesigning procedure does not consider SOURCE_DATE_EPOCH. We resolve this by only allowing VERSION overrides via the FORCE_VERSION environment variable.
Member
|
Guix Builds: 76cd0201f9ffdb470335854ae18d313b20a31cc7622372a3c7eba8c339d531ed guix-build-96cc6bb04f7e/output/aarch64-linux-gnu/SHA256SUMS.part
cbc5ef7f59fae80657431b73a054a6abc9783d69a7f3aa9d0fe901962405f223 guix-build-96cc6bb04f7e/output/aarch64-linux-gnu/bitcoin-96cc6bb04f7e-aarch64-linux-gnu-debug.tar.gz
bc18e3ecd134493990efd4cdb22c873297068268930a48a2a98e838c2a50b19a guix-build-96cc6bb04f7e/output/aarch64-linux-gnu/bitcoin-96cc6bb04f7e-aarch64-linux-gnu.tar.gz
646f04a53a00daf1f8a5c66307d535a57b9bdf4d2be3829f0bffc9488c3a1413 guix-build-96cc6bb04f7e/output/arm-linux-gnueabihf/SHA256SUMS.part
02f40a58cc218b25870ad9a021e6e2cea4bf9538d205d7a56df486779aa90b81 guix-build-96cc6bb04f7e/output/arm-linux-gnueabihf/bitcoin-96cc6bb04f7e-arm-linux-gnueabihf-debug.tar.gz
d4482c11f87b5a836ac8650255aea5ba74b2a1e68c89adbef03ebae1cb0cbe30 guix-build-96cc6bb04f7e/output/arm-linux-gnueabihf/bitcoin-96cc6bb04f7e-arm-linux-gnueabihf.tar.gz
90ed3f5e785813dfaa3f86b7386370d76f59c747b954494674139cc5bc03356c guix-build-96cc6bb04f7e/output/dist-archive/bitcoin-96cc6bb04f7e.tar.gz
77ee9d102a65a4ce0d477ddd037677b8dca3a9f96cd78c5ae3fffb976efd23e6 guix-build-96cc6bb04f7e/output/powerpc64-linux-gnu/SHA256SUMS.part
711844dfdbb34f19bca0fd2e7e29d8e35d8f796bc29d8035d4e9f00e6f6c491d guix-build-96cc6bb04f7e/output/powerpc64-linux-gnu/bitcoin-96cc6bb04f7e-powerpc64-linux-gnu-debug.tar.gz
c84c8e35c359cbd97af8345f4d338c8e98c07d44869db686ba25988b2c4490c7 guix-build-96cc6bb04f7e/output/powerpc64-linux-gnu/bitcoin-96cc6bb04f7e-powerpc64-linux-gnu.tar.gz
598cb0d29622260d40d2cac5add21d0b4da42a29d42898a16b4863425083f4c6 guix-build-96cc6bb04f7e/output/powerpc64le-linux-gnu/SHA256SUMS.part
523787f7fd6d3ee03a73e22b83d7ce728dc7ef1c0bfc9a186673a3d5ab9a78e6 guix-build-96cc6bb04f7e/output/powerpc64le-linux-gnu/bitcoin-96cc6bb04f7e-powerpc64le-linux-gnu-debug.tar.gz
db6d4a607ab8ccaac7fa47439c4586053ac14535456ad38e9c2f9a8b5c09599a guix-build-96cc6bb04f7e/output/powerpc64le-linux-gnu/bitcoin-96cc6bb04f7e-powerpc64le-linux-gnu.tar.gz
2ee9ad0ec253000a76cea7ce31b09a2090f6cf20b06ac65129435fda770bc62a guix-build-96cc6bb04f7e/output/riscv64-linux-gnu/SHA256SUMS.part
c56f3701d27a2aa31d8d593827514778d20b0bdcdc3c84689fdf623b269efbe1 guix-build-96cc6bb04f7e/output/riscv64-linux-gnu/bitcoin-96cc6bb04f7e-riscv64-linux-gnu-debug.tar.gz
6eab943d55d77b2564cf87ab487d0965c3e10cbf709a1fd42053c2d4d8783524 guix-build-96cc6bb04f7e/output/riscv64-linux-gnu/bitcoin-96cc6bb04f7e-riscv64-linux-gnu.tar.gz
9de2eca01a1fceb27d3b996e953859476a91fc0ffd8dc80554d2b07ae403492e guix-build-96cc6bb04f7e/output/x86_64-apple-darwin18/SHA256SUMS.part
c04454a66e2f347d8fabffb6cebf87372a605184ca1c5441f5c6cb6ddcabf2db guix-build-96cc6bb04f7e/output/x86_64-apple-darwin18/bitcoin-96cc6bb04f7e-osx-unsigned.dmg
4cddbf6ced5c3e0b221436b9a9e88ed1b3dcb11add7a5d915e4e07033a35d7b6 guix-build-96cc6bb04f7e/output/x86_64-apple-darwin18/bitcoin-96cc6bb04f7e-osx-unsigned.tar.gz
aa90a28d8ad5388c5da2abb466012ecf690010378ad6f3b3d675f382eaafcd21 guix-build-96cc6bb04f7e/output/x86_64-apple-darwin18/bitcoin-96cc6bb04f7e-osx64.tar.gz
6bb6184f19e1a351533789e3b08fa7f210bb502f512b7ba4317dec539395ff15 guix-build-96cc6bb04f7e/output/x86_64-linux-gnu/SHA256SUMS.part
b297a7020da7e5e1f62bd76da118aaf5d8538a10307055fa713f3c7073c6c40b guix-build-96cc6bb04f7e/output/x86_64-linux-gnu/bitcoin-96cc6bb04f7e-x86_64-linux-gnu-debug.tar.gz
03d11427eb2811d1c7a08e30724c480852b9c1b73b37c9a00d3584df912ac94f guix-build-96cc6bb04f7e/output/x86_64-linux-gnu/bitcoin-96cc6bb04f7e-x86_64-linux-gnu.tar.gz
7a885ebca9e77706c4b51cf3eec1ca9de3499e2ce192c6332dbd47f3b5c72fa6 guix-build-96cc6bb04f7e/output/x86_64-w64-mingw32/SHA256SUMS.part
f8ea8df72c93acd4736a61ec6c61b7ded474fe81a50599994153256c03163538 guix-build-96cc6bb04f7e/output/x86_64-w64-mingw32/bitcoin-96cc6bb04f7e-win-unsigned.tar.gz
a06fd4b9a2edbf089c67c29f481d59ed9c75ac3b44a0e80a344bb5390f4285f6 guix-build-96cc6bb04f7e/output/x86_64-w64-mingw32/bitcoin-96cc6bb04f7e-win64-debug.zip
338fb4541d434b5539058c1e1dea03247c7499a51a17362d94fdc3b5f7096461 guix-build-96cc6bb04f7e/output/x86_64-w64-mingw32/bitcoin-96cc6bb04f7e-win64-setup-unsigned.exe
2a4cf3f068d2a1f95b81a34eb9fd445e984e2309b8e1404477bc74c165a291dd guix-build-96cc6bb04f7e/output/x86_64-w64-mingw32/bitcoin-96cc6bb04f7e-win64.zip |
Member
Guix builds: |
Contributor
Author
|
Matching: |
fanquake
approved these changes
Sep 2, 2021
Member
fanquake
left a comment
fanquake
left a comment
There was a problem hiding this comment.
ACK 96cc6bb - Also makes sense given there are Guix build guides recommending to set VERSION as part of the process. i.e https://gist.github.com/hebasto/7293726cbfcd0b58e1cfd5418316cee3.
fanquake
pushed a commit
to fanquake/bitcoin
that referenced
this pull request
Sep 2, 2021
Previously, if the builder exported $VERSION in their environment (as past Gitian-building docs told them to), but their HEAD does not actually point to v$VERSION, their build outputs will differ from those of other builders. This is because the contrib/guix/guix-* scripts only ever act on the current git worktree, and does not try to check out $VERSION if $VERSION is set in the environment. Setting $VERSION only makes the scripts pretend like the current worktree is $VERSION. This problem was seen in jonatack's attestation for all.SHA256SUMS, where only his bitcoin-22.0rc3-osx-signed.dmg differed from everyone else's. Here is my deduced sequence of events: 1. Aug 27th: He guix-builds 22.0rc3 and uploads his attestations up to guix.sigs 2. Aug 30th, sometime after POSIX time 1630310848: he pulls the latest changes from master in the same worktree where he guix-built 22.0rc3 and ends up at 7be143a 3. Aug 30th, sometime before POSIX time 1630315907: With his worktree still on 7be143a, he guix-codesigns. Normally, this would result in outputs going in guix-build-7be143a960e2, but he had VERSION=22.0rc3 in his environment, so the guix-* scripts pretended like he was building 22.0rc3, and used 22.0rc3's guix-build directory to locate un-codesigned outputs and dump codesigned ones. However, our SOURCE_DATE_EPOCH defaults to the POSIX time of HEAD (7be143a), which made all timestamps in the resulting codesigned DMG 1630310848, 7be143a's POSIX timestamp. This differs from the POSIX timestamp of 22.0rc3, which is 1630348517. Note that the windows codesigning procedure does not consider SOURCE_DATE_EPOCH. We resolve this by only allowing VERSION overrides via the FORCE_VERSION environment variable. Github-Pull: bitcoin#22847 Rebased-From: 96cc6bb
Merged
Member
|
Backported to 22.x in #22857. |
sidhujag
pushed a commit
to syscoin/syscoin
that referenced
this pull request
Sep 2, 2021
Contributor
laanwj
added a commit
that referenced
this pull request
Sep 8, 2021
303bc8a guix/prelude: Override VERSION with FORCE_VERSION (Carl Dong) 0640bf5 doc: mention bech32m/BIP350 in doc/descriptors.md (Pieter Wuille) Pull request description: Backports: * #22847 - guix/prelude: Override VERSION with FORCE_VERSION * #22837 - doc: mention bech32m/BIP350 in doc/descriptors.md Theses are both minor enough that they would not require and rc4. ACKs for top commit: laanwj: ACK 303bc8a Tree-SHA512: faac095f71abb537f1d2a338e4f79f8389be2362eec0841e3fb47aaee731ce242856db461f89351c2ca4e1129a3afdd49c3e918a7bf22af3e4d2f7deaff48ad8
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Please ignore the branch name, it's not relevant to the change.