guix: produce a `-static-pie` bitcoind #25573

pull fanquake wants to merge 7 commits into bitcoin:master from fanquake:fully_static_bitcoind changing 11 files +525 −252
  1. fanquake commented at 4:49 PM on July 8, 2022: member

    Use Guix to produce a -static-pie bitcoind using GCC 14.3.0 and glibc 2.44. Using glibc for static builds, would be less of a leap compared to switching to musl libc (POC in #23203).

    -static-pie

    Produce a static position independent executable on targets that support it. A static position independent executable is similar to a static executable, but can be loaded at any address without a dynamic linker.

    # file bitcoind
	ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped

# ldd bitcoind
	statically linked

    Tested on:

    • Alpine 3.24
    • CentOS 9
    • Debian 11
    • Debian 13
    • Ubuntu 20.04
    • Ubuntu 26.04

    Related upstream links / discussions:

    Also fixes #19075.

  2. fanquake added the label Build system on Jul 8, 2022
  3. fanquake marked this as a draft on Jul 8, 2022
  4. DrahtBot commented at 10:29 PM on July 8, 2022: contributor

    <!--e57a25ab6845829454e8d69fc972939a-->

    The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

    <!--006a51241073e994b41acfe9ec718e94-->

    Code Coverage & Benchmarks

    For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/25573.

    <!--021abf342d371248e50ceaed478a90ca-->

    Reviews

    See the guideline and AI policy for information on the review process.

    Type Reviewers
    Concept ACK dergoegge, w0xlt, hebasto
    Approach ACK willcl-ark

    If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

    <!--174a7506f384e20aa4161008e828411d-->

    Conflicts

    Reviewers, this pull request conflicts with the following ones:

    • #35855 (guix: update time-machine by fanquake)
    • #35713 (Remove boost as a unit test runner by rustaceanrob)

    If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

    <!--5faf32d7da4f0f540f40219e4f7537a3-->

    LLM Linter (✨ experimental)

    Possible typos and grammar issues:

    • systems than ship -> systems that ship [wrong word; the clause is ungrammatical as written]
    • than what we previously supported -> than we previously supported [extra word breaks the comparison]

    <sup>2026-08-06 09:49:23</sup>

  5. fanquake force-pushed on Jul 13, 2022
  6. fanquake commented at 5:46 PM on July 13, 2022: member

    Rebased, and made small changes to fixup the linter and improve the security/symbol checks.

  7. theuni commented at 9:00 PM on July 13, 2022: member

    This is amazing!

    Using glibc for static builds, would be less of a leap compared to switching to musl libc (POC in #23203).

    Hard agree. Static musl builds would be very cool but tricky to audit for parity and thus pretty unlikely to ever become official/supported imo. This is a MUCH more palatable change.

  8. fanquake force-pushed on Jul 14, 2022
  9. fanquake commented at 10:41 AM on July 14, 2022: member

    Added an additional patch to disable building various features/libs in GCC that we don't need. i.e libquadmath, libsanitizer, gcov, libada and native language support. This should speed up compiling GCC, and slightly reduces the size of the pthread patch. I'm not currently disabling these features via the available configure flags, because they get passed through to GMP, which cannot handle them.

    I've also updated -flto usage to be -flto=auto, as that seems to now be the preferred invocation, and it mitigates GCC warning output. i.e:

    lto-wrapper: warning: using serial compilation of 84 LTRANS jobs
lto-wrapper: note: see the '-flto' option documentation for more information

    I've also split the ELF PIE check into it's own func, so we can special-case x86_64, and re-added the list of allowed ELF libs, but special-cased x86_64 to only pass if the list is empty.

  10. luke-jr commented at 5:00 PM on July 16, 2022: member

    How does this handle resolvers? eg, static glibc 2.33 applications break on systems with glibc 2.34...

  11. DrahtBot added the label Needs rebase on Jul 19, 2022
  12. fanquake force-pushed on Jul 19, 2022
  13. DrahtBot removed the label Needs rebase on Jul 19, 2022
  14. DrahtBot added the label Needs rebase on Jul 30, 2022
  15. Frank-GER commented at 4:47 PM on August 4, 2022: none

    Which OS did you build on?

    On Ubuntu 20.04 after build: file bitcoind bitcoind: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, for GNU/Linux 3.2.0, stripped

    Trying to run it, it crashes after seconds: addcon thread start Loading addresses from DNS seed dnsseed.emzy.de. bitcoind: dl-call-libc-early-init.c:37: _dl_call_libc_early_init: Assertion `sym != NULL' failed. Aborted (core dumped)

    Any ideas?

  16. fanquake commented at 8:05 AM on August 5, 2022: member

    Which OS did you build on?

    The base OS shouldn't matter, because the build is performed with Guix. However I've been performing these builds on Ubuntu 22.04.

    Any ideas?

    How did you actually build bitcoind? Something like HOSTS="x86_64-linux-gnu" ./contrib/guix/guix-build?

  17. fanquake force-pushed on Aug 5, 2022
  18. fanquake commented at 8:39 AM on August 5, 2022: member

    Rebased on master. Added a commit to use LIEF master, which reduces the number of changes in our scripts, as support for -static-pie ELF binaries has been added: https://github.com/lief-project/LIEF/issues/747. Will switch to a new release when one is available.

  19. DrahtBot removed the label Needs rebase on Aug 5, 2022
  20. Frank-GER commented at 5:12 PM on August 5, 2022: none

    How did you actually build bitcoind? Something like HOSTS="x86_64-linux-gnu" ./contrib/guix/guix-build?

    Yes, that's what I used to build it. https://github.com/fanquake/bitcoin/commits/fully_static_bitcoind produces the exact same problem when building on Ubuntu 20.04

  21. fanquake commented at 5:32 PM on August 5, 2022: member

    https://github.com/fanquake/bitcoin/commits/fully_static_bitcoind produces the exact same problem when building on Ubuntu 20.04

    I have just re-tested building the changes here (ef0edd55f3bc1e3f229134ec7ecac632de52eea7), and this produces a -static-pie binary as expected:

    guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, with debug_info, not stripped

    It's not clear to me that you are actually running a Guix build.

  22. Frank-GER commented at 6:22 PM on August 5, 2022: none

    the build I was testing: ~/bitcoin/guix-build-caa066465973/distsrc-caa066465973-x86_64-linux-gnu/src$ file bitcoind bitcoind: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, for GNU/Linux 3.2.0, with debug_info, not stripped

    just building again, fresh cloned with commit ef0edd5 export HOSTS='x86_64-linux-gnu' ./contrib/guix/guix-build

    $ file guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, for GNU/Linux 3.2.0, with debug_info, not stripped

    $ ldd ./guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind statically linked

    $ ./bitcoind ... 2022-08-05T19:10:46Z init message: Starting network threads… 2022-08-05T19:10:46Z net thread start 2022-08-05T19:10:46Z dnsseed thread start 2022-08-05T19:10:46Z Loading addresses from DNS seed seed.bitcoinstats.com. 2022-08-05T19:10:46Z opencon thread start 2022-08-05T19:10:46Z msghand thread start 2022-08-05T19:10:46Z addcon thread start 2022-08-05T19:10:46Z init message: Done loading bitcoind: dl-call-libc-early-init.c:37: _dl_call_libc_early_init: Assertion `sym != NULL' failed. Aborted (core dumped)

    build and run on Ubuntu 20.04 there is no other bitcoind on that OS

  23. Frank-GER commented at 2:27 PM on August 8, 2022: none

    building the same on Ubuntu 22.04: file guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, with debug_info, not stripped

    ldd guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind statically linked

    Running it on Ubuntu22 it works.

    Taking this bitcoind to Ubuntu 20 it shows: file ./bitcoind ./bitcoind: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, for GNU/Linux 3.2.0, with debug_info, not stripped

    and crashes with the above mentioned message: bitcoind: dl-call-libc-early-init.c:37: _dl_call_libc_early_init: Assertion `sym != NULL' failed. Aborted (core dumped)

    Checksums are the same for both builds (on Ubuntu 20 and 22) Ubuntu 20 sees it as dynamic linked, Ubuntu 22 as static-pie linked. On Ubuntu 20 it crashes, on Ubuntu 22 it works.

    Same bitcoind on Debian 10: file ./bitcoind ./bitcoind: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, for GNU/Linux 3.2.0, with debug_info, not stripped ldd ./bitcoind statically linked Gets past that point where it crashes on Ubuntu 20 and starts syncing

  24. fanquake force-pushed on Aug 24, 2022
  25. fanquake commented at 3:34 PM on August 24, 2022: member

    Pushed a number of changes, and rebased on master. Switched from glibc 2.35 to 2.36. Added infra for aarch64 -static-pie builds. More fine-grained / logical commits. Updated to the latest version of LIEF (master).

  26. fanquake force-pushed on Sep 5, 2022
  27. fanquake force-pushed on Sep 7, 2022
  28. DrahtBot added the label Needs rebase on Sep 13, 2022
  29. fanquake force-pushed on Sep 13, 2022
  30. fanquake removed the label Needs rebase on Sep 13, 2022
  31. fanquake force-pushed on Jan 13, 2023
  32. fanquake force-pushed on Jan 25, 2023
  33. DrahtBot added the label Needs rebase on Feb 17, 2023
  34. fanquake force-pushed on Feb 17, 2023
  35. fanquake force-pushed on Feb 17, 2023
  36. fanquake commented at 11:22 AM on February 17, 2023: member

    Rebased past #27029.

  37. DrahtBot removed the label Needs rebase on Feb 17, 2023
  38. DrahtBot added the label Needs rebase on Mar 27, 2023
  39. fanquake force-pushed on Mar 27, 2023
  40. DrahtBot removed the label Needs rebase on Mar 27, 2023
  41. fanquake force-pushed on May 22, 2023
  42. DrahtBot added the label CI failed on May 30, 2023
  43. DrahtBot removed the label CI failed on May 31, 2023
  44. DrahtBot added the label Needs rebase on Jun 28, 2023
  45. fanquake force-pushed on Jun 30, 2023
  46. DrahtBot removed the label Needs rebase on Jun 30, 2023
  47. fanquake renamed this:
    [POC] guix: produce a fully -static-pie x86_64 bitcoind using GCC and glibc
    [POC] guix: produce a fully `-static-pie` bitcoind
    on Jul 27, 2023
  48. DrahtBot added the label Needs rebase on Aug 22, 2023
  49. fanquake force-pushed on Aug 23, 2023
  50. DrahtBot removed the label Needs rebase on Aug 23, 2023
  51. DrahtBot added the label CI failed on Aug 23, 2023
  52. DrahtBot added the label Needs rebase on Aug 24, 2023
  53. fanquake force-pushed on Aug 24, 2023
  54. DrahtBot removed the label Needs rebase on Aug 24, 2023
  55. DrahtBot removed the label CI failed on Aug 24, 2023
  56. fanquake force-pushed on Aug 26, 2023
  57. fanquake force-pushed on Aug 27, 2023
  58. fanquake force-pushed on Sep 8, 2023
  59. DrahtBot added the label Needs rebase on Nov 13, 2023
  60. fanquake force-pushed on Nov 13, 2023
  61. DrahtBot removed the label Needs rebase on Nov 13, 2023
  62. fanquake commented at 3:37 PM on November 27, 2023: member

    GCC now has -static-pie for RISC-V: https://gcc.gnu.org/pipermail/gcc-patches/2023-October/632219.html. Looks like support in glibc will also be available soon: https://sourceware.org/pipermail/libc-alpha/2023-October/152132.html.

  63. DrahtBot added the label CI failed on Jan 14, 2024
  64. fanquake commented at 9:57 AM on January 15, 2024: member

    Looks like support in glibc will also be available soon: https://sourceware.org/pipermail/libc-alpha/2023-October/152132.html.

    This has now landed: https://sourceware.org/git/?p=glibc.git;a=commit;h=e0590f41fe1e7a54169e8f8828efe62b5064139e.

  65. DrahtBot added the label Needs rebase on Jan 16, 2024
  66. fanquake force-pushed on Jan 16, 2024
  67. DrahtBot removed the label Needs rebase on Jan 16, 2024
  68. DrahtBot removed the label CI failed on Jan 16, 2024
  69. fanquake force-pushed on Feb 16, 2024
  70. DrahtBot added the label CI failed on Feb 28, 2024
  71. DrahtBot removed the label CI failed on Mar 4, 2024
  72. DrahtBot added the label Needs rebase on Mar 14, 2024
  73. fanquake force-pushed on Mar 15, 2024
  74. fanquake commented at 5:17 PM on March 15, 2024: member

    Rebased. Simplified somewhat. Switched to GCC 13.2.0 and glibc 2.39.

  75. DrahtBot removed the label Needs rebase on Mar 15, 2024
  76. DrahtBot added the label Needs rebase on Mar 26, 2024
  77. fanquake force-pushed on Mar 26, 2024
  78. DrahtBot removed the label Needs rebase on Mar 26, 2024
  79. fanquake force-pushed on Apr 15, 2024
  80. DrahtBot added the label Needs rebase on Apr 17, 2024
  81. fanquake force-pushed on May 2, 2024
  82. DrahtBot removed the label Needs rebase on May 2, 2024
  83. DrahtBot commented at 5:22 AM on May 2, 2024: contributor

    <!--85328a0da195eb286784d51f73fa0af9-->

    🚧 At least one of the CI tasks failed. Make sure to run all tests locally, according to the documentation.

    Possibly this is due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.

    Leave a comment here, if you need help tracking down a confusing failure.

    <sub>Debug: https://github.com/bitcoin/bitcoin/runs/24492691529</sub>

  84. DrahtBot added the label CI failed on May 2, 2024
  85. DrahtBot added the label Needs rebase on Jun 8, 2024
  86. fanquake force-pushed on Jul 1, 2024
  87. fanquake force-pushed on Jul 1, 2024
  88. DrahtBot removed the label Needs rebase on Jul 1, 2024
  89. DrahtBot removed the label CI failed on Jul 1, 2024
  90. DrahtBot added the label CI failed on Jul 15, 2024
  91. DrahtBot removed the label CI failed on Jul 20, 2024
  92. fanquake force-pushed on Jul 25, 2024
  93. DrahtBot added the label Needs rebase on Aug 28, 2024
  94. fanquake force-pushed on Aug 28, 2024
  95. DrahtBot removed the label Needs rebase on Aug 28, 2024
  96. fanquake force-pushed on Sep 19, 2024
  97. DrahtBot added the label Needs rebase on Dec 20, 2024
  98. fanquake force-pushed on Jan 20, 2025
  99. DrahtBot removed the label Needs rebase on Jan 20, 2025
  100. fanquake force-pushed on Feb 5, 2025
  101. DrahtBot added the label CI failed on Feb 5, 2025
  102. DrahtBot removed the label CI failed on Feb 5, 2025
  103. fanquake force-pushed on Feb 12, 2025
  104. DrahtBot added the label CI failed on Feb 12, 2025
  105. DrahtBot added the label Needs rebase on Feb 19, 2025
  106. fanquake force-pushed on Feb 19, 2025
  107. DrahtBot removed the label Needs rebase on Feb 19, 2025
  108. DrahtBot removed the label CI failed on Feb 19, 2025
  109. fanquake force-pushed on Feb 27, 2025
  110. fanquake force-pushed on Mar 12, 2025
  111. fanquake force-pushed on Mar 20, 2025
  112. fanquake force-pushed on Apr 11, 2025
  113. DrahtBot added the label Needs rebase on May 12, 2025
  114. fanquake force-pushed on May 12, 2025
  115. DrahtBot removed the label Needs rebase on May 12, 2025
  116. fanquake force-pushed on May 14, 2025
  117. fanquake force-pushed on May 14, 2025
  118. DrahtBot added the label Needs rebase on May 27, 2025
  119. fanquake force-pushed on May 28, 2025
  120. DrahtBot removed the label Needs rebase on May 28, 2025
  121. DrahtBot added the label Needs rebase on Jun 11, 2025
  122. fanquake force-pushed on Jun 11, 2025
  123. DrahtBot removed the label Needs rebase on Jun 11, 2025
  124. achow101 requested review from theuni on Oct 22, 2025
  125. achow101 requested review from willcl-ark on Oct 22, 2025
  126. dergoegge commented at 3:08 PM on October 22, 2025: member

    Concept ACK

  127. achow101 requested review from m3dwards on Oct 22, 2025
  128. fanquake force-pushed on Oct 28, 2025
  129. fanquake force-pushed on Oct 28, 2025
  130. willcl-ark referenced this in commit 0074e4aa14 on Oct 28, 2025
  131. willcl-ark referenced this in commit 3f8848d5d2 on Oct 28, 2025
  132. willcl-ark referenced this in commit 1944d38c16 on Oct 29, 2025
  133. willcl-ark referenced this in commit 11ca259f4d on Oct 29, 2025
  134. willcl-ark referenced this in commit 0430ebf3a8 on Oct 29, 2025
  135. willcl-ark referenced this in commit cbe8ae4b33 on Oct 29, 2025
  136. willcl-ark referenced this in commit 1146ab21ac on Oct 29, 2025
  137. fanquake force-pushed on Oct 29, 2025
  138. fanquake force-pushed on Oct 29, 2025
  139. fanquake referenced this in commit be853e9f7a on Nov 3, 2025
  140. fanquake referenced this in commit 9bcdd81636 on Nov 4, 2025
  141. fanquake referenced this in commit 701fb7c8e2 on Nov 4, 2025
  142. fanquake force-pushed on Nov 4, 2025
  143. fanquake referenced this in commit 5c41fa2918 on Nov 4, 2025
  144. fanquake referenced this in commit ffd7ca3c46 on Nov 5, 2025
  145. fanquake referenced this in commit 8649f7dcf7 on Nov 5, 2025
  146. fanquake force-pushed on Nov 5, 2025
  147. DrahtBot added the label CI failed on Nov 5, 2025
  148. fanquake force-pushed on Nov 5, 2025
  149. DrahtBot removed the label CI failed on Nov 5, 2025
  150. fanquake referenced this in commit 5b51244f21 on Nov 6, 2025
  151. fanquake force-pushed on Nov 6, 2025
  152. fanquake renamed this:
    [POC] guix: produce a fully `-static-pie` bitcoind
    guix: produce a fully `-static-pie` bitcoind
    on Nov 6, 2025
  153. fanquake renamed this:
    guix: produce a fully `-static-pie` bitcoind
    guix: produce a `-static-pie` bitcoind
    on Nov 6, 2025
  154. fanquake referenced this in commit a6417a24f6 on Nov 7, 2025
  155. m3dwards commented at 4:38 PM on November 7, 2025: contributor

    This is very cool.

    Have I got the potential trade-offs correct here?

    Positives:

    • More portable - especially running a modern binary on an older linux
    • Enable very small docker images

    Downsides:

    • Static glibc can struggle with resolvers and locale (although I don't think locale is an issue here) potentially undermining the portability benefit. I don't know if --enable-static-nss solves this? But as referenced in this line it's been broken for a long time.
    • Binary would be bigger
  156. fanquake referenced this in commit 6efb234510 on Nov 10, 2025
  157. fanquake referenced this in commit ce204ecace on Nov 10, 2025
  158. fanquake referenced this in commit 746c540845 on Nov 11, 2025
  159. fanquake referenced this in commit 4568773763 on Nov 11, 2025
  160. fanquake force-pushed on Nov 11, 2025
  161. fanquake commented at 12:20 PM on November 11, 2025: member

    Binary would be bigger

    Yes ~2mb. I've added a comparison of bitcoind size for master vs this change, to the PR description.

  162. fanquake referenced this in commit 0716bb53f0 on Nov 11, 2025
  163. fanquake referenced this in commit 94b5b3816c on Nov 11, 2025
  164. fanquake referenced this in commit 86fffd9380 on Nov 12, 2025
  165. fanquake referenced this in commit 2b6e451075 on Nov 12, 2025
  166. fanquake force-pushed on Nov 12, 2025
  167. fanquake referenced this in commit e40362b4ff on Nov 13, 2025
  168. fanquake referenced this in commit 81be7e5bef on Nov 14, 2025
  169. fanquake referenced this in commit ce6769c0e3 on Nov 14, 2025
  170. fanquake referenced this in commit 26c6dd1ca5 on Nov 14, 2025
  171. fanquake force-pushed on Nov 14, 2025
  172. DrahtBot added the label Needs rebase on Nov 17, 2025
  173. fanquake referenced this in commit 680f587b10 on Nov 17, 2025
  174. fanquake force-pushed on Nov 17, 2025
  175. willcl-ark commented at 12:35 PM on November 17, 2025: member

    ;; --enable-static-nss isn't used yet, because it has been broken ;; since 2.33: https://sourceware.org/bugzilla/show_bug.cgi?id=27959.

    What are the exact implications of this? I guix-built this branch and loaded it into a scratch docker container and the dns seeds were connected to and loaded fine. Is this coming from my host system perhaps, even inside a scratch container?

    I also tested the binary on alpine and it appeared to "fallback" to using libnss without issue...

  176. fanquake referenced this in commit f21d5bd923 on Nov 17, 2025
  177. DrahtBot removed the label Needs rebase on Nov 17, 2025
  178. fanquake referenced this in commit 59304910cb on Nov 17, 2025
  179. willcl-ark commented at 11:48 AM on November 18, 2025: member

    ;; --enable-static-nss isn't used yet, because it has been broken ;; since 2.33: sourceware.org/bugzilla/show_bug.cgi?id=27959.

    What are the exact implications of this? I guix-built this branch and loaded it into a scratch docker container and the dns seeds were connected to and loaded fine. Is this coming from my host system perhaps, even inside a scratch container?

    I also tested the binary on alpine and it appeared to "fallback" to using libnss without issue...

    Some additional context. When run in an alpine container with strace I see:

    <details> <summary>Log</summary>

    x86_64-linux-gnu/bitcoin-84d3c4d14e70/bin on  pr-25573 [$] via ❄️  impure (nix-shell-env) took 2s
❯ docker run --rm -it \
        -v "$PWD/bitcoind:/bitcoind:ro" \
        --entrypoint=sh \
        alpine \
        -lc 'apk add --no-cache strace >/dev/null && strace -f -e trace=%file /bitcoind'
        
<snip>

2025-11-18T11:40:10Z dnsseed thread start
strace: Process 52 attached
2025-11-18T11:40:10Z Loading addresses from DNS seed dnsseed.bluematt.me.
strace: Process 53 attached
2025-11-18T11:40:10Z init message: Done loading
2025-11-18T11:40:10Z opencon thread start
2025-11-18T11:40:10Z addcon thread start
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC2025-11-18T11:40:10Z msghand thread start
) = -1 ENOENT (No such file or directory)
[pid    50] openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 27
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/", {st_mode=S_IFDIR|0755, st_size=4096, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 27
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
[pid    50] openat(AT_FDCWD, "/etc/gai.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
2025-11-18T11:40:10Z Loading addresses from DNS seed dnsseed.emzy.de.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed seed.bitcoin.sipa.be.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed seed.bitcoin.jonasschnelli.ch.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed seed.mainnet.achownodes.xyz.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed seed.bitcoin.sprovoost.nl.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed dnsseed.bitcoin.dashjr-list-of-p2p-nodes.us.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed seed.bitcoin.wiz.biz.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed seed.btc.petertodd.net.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z 203 addresses found from DNS seeds
2025-11-18T11:40:10Z dnsseed thread exit

    </details>

    When run on my NixOS host I see:

    <details> <summary>Log</summary>

    x86_64-linux-gnu/bitcoin-84d3c4d14e70/bin on  pr-25573 [$] via ❄️  impure (nix-shell-env) took 11s
❯ strace -f \
        -e trace=open,openat,stat,statx,access,readlink \
        ./bitcoind -datadir=/tmp/b1 -daemon=0 2>&1 | grep -i 'libnss'
[pid 930543] openat(AT_FDCWD, "/nix/store/khwsqzc1s0b92y3l695g95f4773lb2h1-capnproto-1.2.0/lib/libnss_mymachines.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 930543] openat(AT_FDCWD, "/gnu/store/hhrsk659w4k3zs0bin6i4q1lnbr4zxx0-glibc-cross-x86_64-linux-gnu-2.42/lib/libnss_mymachines.so.2", O_RDONLY|O_CLOEXECstrace: Process 930545 attached
[pid 930543] openat(AT_FDCWD, "/nix/store/khwsqzc1s0b92y3l695g95f4773lb2h1-capnproto-1.2.0/lib/libnss_mdns4_minimal.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 930543] openat(AT_FDCWD, "/gnu/store/hhrsk659w4k3zs0bin6i4q1lnbr4zxx0-glibc-cross-x86_64-linux-gnu-2.42/lib/libnss_mdns4_minimal.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 930543] openat(AT_FDCWD, "/nix/store/khwsqzc1s0b92y3l695g95f4773lb2h1-capnproto-1.2.0/lib/libnss_myhostname.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 930543] openat(AT_FDCWD, "/gnu/store/hhrsk659w4k3zs0bin6i4q1lnbr4zxx0-glibc-cross-x86_64-linux-gnu-2.42/lib/libnss_myhostname.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
^C⏎

    </details>

    Both succeed in retrieving DNS seed addresses.

  180. willcl-ark commented at 2:48 PM on November 18, 2025: member

    Ah OK I think I might understand better now. Both systems I tested on include files and dns backends as part of nsswitch.conf (line starting with hosts: ):

    # alpine Container

x86_64-linux-gnu/bitcoin-84d3c4d14e70/bin on  pr-25573 [$] via ❄️  impure (nix-shell-env)
❯ cat /etc/nsswitch.conf
passwd:    files systemd
group:     files [success=merge] systemd
shadow:    files systemd
sudoers:   files

hosts:     mymachines mdns4_minimal [NOTFOUND=return] files myhostname dns mdns4
networks:  files

ethers:    files
services:  files
protocols: files
rpc:       files

# NixOS host

x86_64-linux-gnu/bitcoin-84d3c4d14e70/bin on  pr-25573 [$] via ❄️  impure (nix-shell-env)
❯ docker run --rm -it --entrypoint=sh alpine -lc 'cat /etc/nsswitch.conf'
# musl itself does not support NSS, however some third-party DNS
# implementations use the nsswitch.conf file to determine what
# policy to follow.
# Editing this file is not recommended.
hosts: files dns

    ...and these backends are actually baked into a static glibc, which allows it to succeed in lookups.

    The (failed) dlopen calls on my Nix host are because my system nsswitch.conf includes extra backends which we try to open the lib for, but fail.

    So it seems to be that --enable-static-nss must be for "statically linking extra lookup backends in" in addition to the baked in defaults.

    If my understanding here is correct, then it seems totally fine to proceed without static nss enabled (while it is broken), as it doesn't break our basic DNS lookup functionality at all, and at worst results in some failing dlopen trys.

  181. fanquake referenced this in commit 5b4c9a1b3b on Nov 19, 2025
  182. fanquake referenced this in commit 9351c2be9b on Nov 20, 2025
  183. fanquake referenced this in commit 61a8f3840a on Nov 20, 2025
  184. fanquake referenced this in commit 23c1c4636d on Nov 25, 2025
  185. fanquake referenced this in commit c767125efa on Nov 25, 2025
  186. fanquake referenced this in commit 19cb502045 on Nov 25, 2025
  187. fanquake referenced this in commit 0ee5642048 on Nov 25, 2025
  188. fanquake referenced this in commit 7a9020d4cc on Nov 26, 2025
  189. fanquake force-pushed on Nov 26, 2025
  190. fanquake referenced this in commit 2c16922fff on Nov 27, 2025
  191. fanquake referenced this in commit 086e749d5d on Nov 27, 2025
  192. fanquake referenced this in commit 26bec5cf2e on Nov 27, 2025
  193. fanquake referenced this in commit 977eeffeb2 on Nov 27, 2025
  194. fanquake referenced this in commit c204201538 on Nov 28, 2025
  195. fanquake force-pushed on Nov 28, 2025
  196. fanquake referenced this in commit 57e7ff7662 on Dec 1, 2025
  197. fanquake referenced this in commit 0e8c03e2b2 on Dec 2, 2025
  198. fanquake referenced this in commit 0d95833544 on Dec 2, 2025
  199. fanquake referenced this in commit 3d6e6f687f on Dec 2, 2025
  200. fanquake referenced this in commit a1f2a6a74e on Dec 2, 2025
  201. fanquake referenced this in commit dc1760ffbc on Dec 3, 2025
  202. fanquake referenced this in commit 492faf7986 on Dec 3, 2025
  203. fanquake referenced this in commit 8c062253ec on Dec 3, 2025
  204. fanquake force-pushed on Dec 3, 2025
  205. fanquake referenced this in commit c40e4f083a on Dec 3, 2025
  206. fanquake referenced this in commit a20549f8a4 on Dec 4, 2025
  207. willcl-ark referenced this in commit be3cb01da7 on Dec 4, 2025
  208. fanquake referenced this in commit 471eceb8e3 on Dec 5, 2025
  209. fanquake referenced this in commit e0b6bd0fac on Dec 5, 2025
  210. fanquake referenced this in commit fd26217722 on Dec 8, 2025
  211. fanquake referenced this in commit 12df342737 on Dec 8, 2025
  212. willcl-ark referenced this in commit 1f15187752 on Dec 9, 2025
  213. willcl-ark referenced this in commit 5b6f06485c on Dec 10, 2025
  214. fanquake referenced this in commit bff7e76491 on Dec 11, 2025
  215. fanquake referenced this in commit b611b1e1cc on Dec 17, 2025
  216. fanquake referenced this in commit a4d7314fc9 on Dec 17, 2025
  217. fanquake referenced this in commit ce101381df on Dec 18, 2025
  218. fanquake referenced this in commit a5f500dca4 on Dec 29, 2025
  219. fanquake referenced this in commit 0269868c83 on Dec 31, 2025
  220. fanquake referenced this in commit 34909799fe on Jan 6, 2026
  221. fanquake referenced this in commit ba7757cda3 on Jan 9, 2026
  222. fanquake force-pushed on Jan 9, 2026
  223. fanquake referenced this in commit a38af7806a on Jan 12, 2026
  224. fanquake referenced this in commit cb7c598668 on Jan 13, 2026
  225. glozow referenced this in commit 8e8d8f29a8 on Jan 13, 2026
  226. fanquake force-pushed on Jan 14, 2026
  227. fanquake force-pushed on Feb 9, 2026
  228. fanquake force-pushed on Feb 9, 2026
  229. DrahtBot added the label CI failed on Feb 9, 2026
  230. DrahtBot removed the label CI failed on Feb 9, 2026
  231. DrahtBot added the label Needs rebase on Feb 24, 2026
  232. fanquake force-pushed on Feb 25, 2026
  233. DrahtBot removed the label Needs rebase on Feb 25, 2026
  234. fanquake force-pushed on Mar 20, 2026
  235. fanquake force-pushed on Apr 1, 2026
  236. fanquake force-pushed on Apr 8, 2026
  237. sipa commented at 3:41 AM on April 8, 2026: member

    me want pie! https://www.youtube.com/watch?v=sb8rWCvnNbk

  238. fanquake force-pushed on Apr 8, 2026
  239. fanquake commented at 8:50 AM on April 8, 2026: member

    Added a few more changes here. Tested the bins back to glibc 2.15 (Ubuntu 12.04).

  240. w0xlt commented at 5:32 PM on April 8, 2026: contributor

    Concept ACK

  241. fanquake force-pushed on Apr 9, 2026
  242. fanquake force-pushed on Apr 13, 2026
  243. fanquake force-pushed on Apr 16, 2026
  244. fanquake force-pushed on Apr 16, 2026
  245. DrahtBot added the label CI failed on Apr 16, 2026
  246. DrahtBot removed the label CI failed on Apr 16, 2026
  247. nkatha23 commented at 9:00 PM on April 17, 2026: none

    Tested the x86_64 binary from the static_bitcoind_307825c release on Fedora 43 (glibc 2.42-11.fc43.x86_64).

    $ file bitcoind
bitcoind: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped

$ ldd bitcoind
	statically linked

$ ./bitcoind --version
Bitcoin Core daemon version v31.99.0-g307825cfa6b0569630d9697f23d94dd04644e417

    SHA256 verified against the published hash.

    DNS / NSS test:

    Started bitcoind with an isolated datadir and checked getnetworkinfo after 30 seconds:

    "connections": 6,
"connections_out": 6,

    IPv4 and IPv6 both reachable, 6 outbound connections established, DNS seeding works correctly with no issues.

    Fedora's nsswitch.conf hosts line for reference:

    hosts: files myhostname mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns

    This is a more complex NSS configuration than the alpine/NixOS cases discussed above, and the static binary handled it without any dlopen failures or connection issues.

  248. fanquake force-pushed on Apr 27, 2026
  249. fanquake force-pushed on Apr 27, 2026
  250. DrahtBot added the label CI failed on Apr 27, 2026
  251. fanquake commented at 12:21 PM on May 6, 2026: member

    -static-pie support for arm32 should land in glibc (https://sourceware.org/bugzilla/show_bug.cgi?id=34098) and gcc (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106356) shortly.

  252. fanquake commented at 3:29 PM on May 15, 2026: member

    I have a WIP branch here: https://github.com/fanquake/bitcoin/tree/split_build_expr, that implements the Guix build splitting, and builds bitcoind + utils -static-pie, while bitcoin-qt and bitcoin-gui remain as they are today:

    file bin/* libexec/*
bin/bitcoin:          ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
bin/bitcoin-cli:      ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
bin/bitcoind:         ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
bin/bitcoin-qt:       ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, stripped
bin/bitcoin-tx:       ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
bin/bitcoin-util:     ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
bin/bitcoin-wallet:   ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
libexec/bitcoin-gui:  ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, stripped
libexec/bitcoin-node: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
libexec/test_bitcoin: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped

    Will clean it up, and will integrate it here.

  253. fanquake force-pushed on May 20, 2026
  254. fanquake commented at 8:59 AM on May 20, 2026: member

    This branch now produces:

    bin/bitcoin:          ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
bin/bitcoin-cli:      ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
bin/bitcoind:         ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
bin/bitcoin-qt:       ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, stripped
bin/bitcoin-tx:       ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
bin/bitcoin-util:     ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
bin/bitcoin-wallet:   ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
libexec/bitcoin-gui:  ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, stripped
libexec/bitcoin-node: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped
libexec/test_bitcoin: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped

    bin/bitcoin:          ELF 64-bit LSB pie executable, ARM aarch64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.7.0, stripped
bin/bitcoin-cli:      ELF 64-bit LSB pie executable, ARM aarch64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.7.0, stripped
bin/bitcoind:         ELF 64-bit LSB pie executable, ARM aarch64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.7.0, stripped
bin/bitcoin-qt:       ELF 64-bit LSB pie executable, ARM aarch64, version 1 (GNU/Linux), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, for GNU/Linux 3.7.0, stripped
bin/bitcoin-tx:       ELF 64-bit LSB pie executable, ARM aarch64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.7.0, stripped
bin/bitcoin-util:     ELF 64-bit LSB pie executable, ARM aarch64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.7.0, stripped
bin/bitcoin-wallet:   ELF 64-bit LSB pie executable, ARM aarch64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.7.0, stripped
libexec/bitcoin-gui:  ELF 64-bit LSB pie executable, ARM aarch64, version 1 (GNU/Linux), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, for GNU/Linux 3.7.0, stripped
libexec/bitcoin-node: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.7.0, stripped
libexec/test_bitcoin: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.7.0, stripped

    bin/bitcoin:          ELF 64-bit LSB pie executable, UCB RISC-V, RVC, double-float ABI, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 4.15.0, stripped
bin/bitcoin-cli:      ELF 64-bit LSB pie executable, UCB RISC-V, RVC, double-float ABI, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 4.15.0, stripped
bin/bitcoind:         ELF 64-bit LSB pie executable, UCB RISC-V, RVC, double-float ABI, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 4.15.0, stripped
bin/bitcoin-qt:       ELF 64-bit LSB pie executable, UCB RISC-V, RVC, double-float ABI, version 1 (GNU/Linux), dynamically linked, interpreter /lib/ld-linux-riscv64-lp64d.so.1, for GNU/Linux 4.15.0, stripped
bin/bitcoin-tx:       ELF 64-bit LSB pie executable, UCB RISC-V, RVC, double-float ABI, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 4.15.0, stripped
bin/bitcoin-util:     ELF 64-bit LSB pie executable, UCB RISC-V, RVC, double-float ABI, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 4.15.0, stripped
bin/bitcoin-wallet:   ELF 64-bit LSB pie executable, UCB RISC-V, RVC, double-float ABI, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 4.15.0, stripped
libexec/bitcoin-gui:  ELF 64-bit LSB pie executable, UCB RISC-V, RVC, double-float ABI, version 1 (GNU/Linux), dynamically linked, interpreter /lib/ld-linux-riscv64-lp64d.so.1, for GNU/Linux 4.15.0, stripped
libexec/bitcoin-node: ELF 64-bit LSB pie executable, UCB RISC-V, RVC, double-float ABI, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 4.15.0, stripped
libexec/test_bitcoin: ELF 64-bit LSB pie executable, UCB RISC-V, RVC, double-float ABI, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 4.15.0, stripped

    Looking for approach ACKs on the Guix build splitting. If there are some, I will cleanup/split out some changes.

  255. fanquake commented at 2:15 PM on May 21, 2026: member

    A commit here with the gcc/glibc patching for 32-bit arm: https://github.com/fanquake/bitcoin/commit/3429ff7145e3657c7223afa83e509dacb720d2a2. Haven't pushed this here, as there's a IPC related build issue. The glibc change will land in glibc 2.44: https://sourceware.org/git/?p=glibc.git;a=commit;h=c2d6afb4a010a46e0fc73bb4619db9c3796a3077.

  256. willcl-ark commented at 9:30 AM on May 22, 2026: member

    Approach ACK

    I think this is a worthwhile goal for a number of reasons.

    As I understand it the approach options are roughly:

    • don't split and have a hellish build script and guix manifest, with all the different toolchains etc. in one place (spaghetti ++)
    • split as you have done into seperate manifests and build scripts (and necessarily "duplicate" a few lines)

    Of these, the latter seems vastly preferable, and seems to align with the direction of the project better.

  257. hebasto commented at 1:09 PM on May 22, 2026: member

    Concept ACK.

  258. hebasto commented at 3:20 PM on May 22, 2026: member

    Briefly tested bitcoind from bitcoin-6472ac76aff1.tar.gz in the scratch Docker container. Looks good.

  259. hebasto commented at 3:28 PM on May 22, 2026: member

    What should we do about the following warnings:

    [ 80%] Linking CXX executable ../bin/bitcoind
/gnu/store/y3l77wfcqmghgc3f9mf7s93jfiyq6vnb-binutils-cross-x86_64-linux-gnu-2.46.0/bin/x86_64-linux-gnu-ld: /bitcoin/depends/x86_64-linux-gnu/lib/libzmq.a(ipc_listener.cpp.o): in function `zmq::ipc_listener_t::filter(int)':ipc_listener.cpp:(.text+0x211): warning: Using 'getgrgid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/gnu/store/y3l77wfcqmghgc3f9mf7s93jfiyq6vnb-binutils-cross-x86_64-linux-gnu-2.46.0/bin/x86_64-linux-gnu-ld: /bitcoin/depends/x86_64-linux-gnu/lib/libzmq.a(ip_resolver.cpp.o): in function `zmq::ip_resolver_t::resolve_getaddrinfo(zmq::ip_addr_t*, char const*)':ip_resolver.cpp:(.text+0x31c): warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/gnu/store/y3l77wfcqmghgc3f9mf7s93jfiyq6vnb-binutils-cross-x86_64-linux-gnu-2.46.0/bin/x86_64-linux-gnu-ld: /bitcoin/depends/x86_64-linux-gnu/lib/libevent_core.a(evutil.c.o): in function `evutil_getaddrinfo_common_':evutil.c:(.text+0x1d2c): warning: Using 'getprotobynumber' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/gnu/store/y3l77wfcqmghgc3f9mf7s93jfiyq6vnb-binutils-cross-x86_64-linux-gnu-2.46.0/bin/x86_64-linux-gnu-ld: /bitcoin/depends/x86_64-linux-gnu/lib/libzmq.a(ipc_listener.cpp.o): in function `zmq::ipc_listener_t::filter(int)':ipc_listener.cpp:(.text+0x1ec): warning: Using 'getpwuid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/gnu/store/y3l77wfcqmghgc3f9mf7s93jfiyq6vnb-binutils-cross-x86_64-linux-gnu-2.46.0/bin/x86_64-linux-gnu-ld: /bitcoin/depends/x86_64-linux-gnu/lib/libevent_core.a(evutil.c.o): in function `evutil_getaddrinfo_common_':evutil.c:(.text+0x1ead): warning: Using 'getservbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/gnu/store/y3l77wfcqmghgc3f9mf7s93jfiyq6vnb-binutils-cross-x86_64-linux-gnu-2.46.0/bin/x86_64-linux-gnu-ld: /bitcoin/depends/x86_64-linux-gnu/lib/libzmq.a(ipc_listener.cpp.o): in function `zmq::ipc_listener_t::filter(int)':ipc_listener.cpp:(.text+0x211): warning: Using 'getgrgid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/gnu/store/y3l77wfcqmghgc3f9mf7s93jfiyq6vnb-binutils-cross-x86_64-linux-gnu-2.46.0/bin/x86_64-linux-gnu-ld: /bitcoin/depends/x86_64-linux-gnu/lib/libzmq.a(ip_resolver.cpp.o): in function `zmq::ip_resolver_t::resolve_getaddrinfo(zmq::ip_addr_t*, char const*)':ip_resolver.cpp:(.text+0x31c): warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/gnu/store/y3l77wfcqmghgc3f9mf7s93jfiyq6vnb-binutils-cross-x86_64-linux-gnu-2.46.0/bin/x86_64-linux-gnu-ld: /bitcoin/depends/x86_64-linux-gnu/lib/libevent_core.a(evutil.c.o): in function `evutil_getaddrinfo_common_':evutil.c:(.text+0x1d2c): warning: Using 'getprotobynumber' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/gnu/store/y3l77wfcqmghgc3f9mf7s93jfiyq6vnb-binutils-cross-x86_64-linux-gnu-2.46.0/bin/x86_64-linux-gnu-ld: /bitcoin/depends/x86_64-linux-gnu/lib/libzmq.a(ipc_listener.cpp.o): in function `zmq::ipc_listener_t::filter(int)':ipc_listener.cpp:(.text+0x1ec): warning: Using 'getpwuid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/gnu/store/y3l77wfcqmghgc3f9mf7s93jfiyq6vnb-binutils-cross-x86_64-linux-gnu-2.46.0/bin/x86_64-linux-gnu-ld: /bitcoin/depends/x86_64-linux-gnu/lib/libevent_core.a(evutil.c.o): in function `evutil_getaddrinfo_common_':evutil.c:(.text+0x1ead): warning: Using 'getservbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking

    ?

  260. hebasto commented at 2:17 PM on May 24, 2026: member

    338fd2d71b975d16f9a047eb4cd848640c02a385

    Instead of dropping -Werror=dev, we can use the approach suggested here::

    set(CMAKE_CXX_LINK_OPTIONS_PIE -fPIE -static-pie)

    cc @purpleKarrot

  261. fanquake commented at 8:49 AM on May 26, 2026: member

    Instead of dropping -Werror=dev, we can use the approach suggested here::

    I'm not sure; we don't want to hardcode -static-pie anywhere, nor do we want to extract, and then patch the tarball.

  262. fanquake force-pushed on May 27, 2026
  263. fanquake commented at 11:34 AM on May 27, 2026: member

    Reworked/re-ordered some commits, and put this on top of #34948.

  264. fanquake force-pushed on May 28, 2026
  265. fanquake force-pushed on May 30, 2026
  266. fanquake force-pushed on Jun 4, 2026
  267. fanquake commented at 9:16 AM on June 4, 2026: member

    Split off the first change here into #35459.

  268. hebasto referenced this in commit 4b91316643 on Jun 9, 2026
  269. DrahtBot added the label Needs rebase on Jun 9, 2026
  270. fanquake force-pushed on Jun 9, 2026
  271. DrahtBot removed the label Needs rebase on Jun 9, 2026
  272. fanquake commented at 3:03 PM on June 10, 2026: member

    Split the next change off into #35499.

  273. fanquake commented at 2:08 PM on June 11, 2026: member

    What should we do about the following warnings:

    I've been looking at the related code in glibc, and I think these warnings might actually no-longer be correct. Will try and upstream some changes, starting here: https://sourceware.org/pipermail/libc-alpha/2026-June/177956.html.

  274. rustaceanrob referenced this in commit f9055d93e3 on Jun 12, 2026
  275. hebasto referenced this in commit 6bc2d996b0 on Jun 15, 2026
  276. fanquake force-pushed on Jun 15, 2026
  277. fanquake force-pushed on Jun 15, 2026
  278. fanquake force-pushed on Jun 15, 2026
  279. fanquake force-pushed on Jun 15, 2026
  280. DrahtBot removed the label CI failed on Jun 15, 2026
  281. willcl-ark commented at 9:50 AM on June 16, 2026: member

    As we progress toward the changes in this PR slowly (2 or 3 sub-changes are now merged), I wanted to make sure we had carefully considered the higher-level pros and cons of releasing static binaries on Linux.

    My own view is that static PIE binaries are an overall win, but I think we have to be mindful of the security, compatibility, and maintenance differences that come with them.

    Benefits

    For me the biggest win is improved portability. We will no longer rely on the host's linux-vdso, libpthread, libm, libc.

    This lets the binaries run in scratch/distroless containers, old distributions, unusual host environments, and similar setups. It also eliminates host library mismatch issues, where a host might have older, newer, patched, or otherwise oddly configured libraries.

    Another effect is that the release binary is less beholden to a particular distro's update cadence, loader path, ABI quirks, or package layout. Currently we use quite an old glibc to remain compatible with older distros, which also requires custom toolchain work inside Guix.

    Being able to reason about the entire set of shipped code also seems like a win, instead of "our binary plus whatever shared libraries happen to be available on a user's machine". A knock-on effect is reduced exposure to broken or malicious host library injection/configuration.

    Risks

    Users will no longer be able to patch a bundled library issue by updating their system package. If there is a vulnerability in a statically shipped library, we must be aware of it and ship a patch release if necessary, because "update your OS" will not fix the guix-built (and shipped) binary. IMO this is the big one here: it shifts some responsibility from distro package updates to the Bitcoin Core release process for the binaries we ship.

    I think this is acceptable, and could even be a net win, so long as we are aware of it and "monitor the situation" properly. It might make sense to have some process which tracks CVEs and important bugfixes for the libraries that we are using. At minimum, we should know that someone is actually doing this; if everybody leaves it to everybody else then we risk ending up with nobody doing it.

    NSS has already come up for me in review here, and I wonder whether we have fully considered the effects. Dynamic glibc can load NSS modules such as LDAP, SSSD, mDNS, etc. as needed, but a static binary cannot rely on arbitrary host NSS modules being available. AFAIK we mostly care about this through getaddrinfo(), but users with unusual setups like -addnode=my-node.corp.example or -connect=bitcoin-node.local, where those names resolve only through custom NSS-backed hostname lookup, may see behavior changes with this PR.

    I think we are all aware this will increase binary size a little and change debugging somewhat, so I will not go into those here.

    It is also possible that users may prefer to use their own distro's hardened or otherwise changed libraries. I do not think this is a major issue though; those users can still use distro packages or compile the code themselves.

    Comments

    Overall I think most of this is known implicitly by the contributors involved, but I wanted to flag the items I felt were important. In particular, the change in ownership/management of library vulnerabilities seems worth highlighting so that we, as a group, are clear about what is different here.

  282. tobtoht commented at 10:14 AM on June 16, 2026: contributor

    We will no longer rely on the host's libstdc++, libgcc, libevent (soon to be gone hopefully anyway), libzmq, etc.

    All of these libraries are already statically linked. Glibc (and adjacent libraries libm and libpthread) are the only dynamically linked libraries. Updating the e.g. the libzmq system package does not affect behavior of Bitcoin release binaries.

    IMO this is the big one here: it shifts some responsibility from distro package updates to the Bitcoin Core release process for the binaries we ship.

    This was already the case.

  283. willcl-ark commented at 11:18 AM on June 16, 2026: member

    All of these libraries are already statically linked. Glibc (and adjacent libraries libm and libpthread) are the only dynamically linked libraries. Updating the e.g. the libzmq system package does not affect behavior of Bitcoin release binaries.

    right sorry, wrote out the wrong group of libraries here! Edited my comment.

  284. fanquake force-pushed on Jun 17, 2026
  285. fanquake commented at 8:07 PM on June 19, 2026: member

    Two minor changes landed in glibc https://sourceware.org/git/?p=glibc.git;a=commit;h=82b710c1900944ea122a3880f542215948fc023d / https://sourceware.org/git/?p=glibc.git;a=commit;h=21694014388ad278aa03241800d1f0c0a7127ad1 (next step here might be to remove --enable-static-nss outright, as the build no-longer differs if that flag is passed), and llvm-bolt has been fixed to work with -static-pie binaries: https://github.com/llvm/llvm-project/issues/201371 / https://github.com/llvm/llvm-project/pull/204475.

  286. fanquake force-pushed on Jun 19, 2026
  287. DrahtBot added the label CI failed on Jun 20, 2026
  288. fanquake force-pushed on Jun 22, 2026
  289. DrahtBot removed the label CI failed on Jun 22, 2026
  290. fanquake force-pushed on Jun 26, 2026
  291. fanquake commented at 12:54 PM on June 26, 2026: member

    next step here might be to remove --enable-static-nss outright, as the build no-longer differs if that flag is passed)

    Done in https://sourceware.org/git/?p=glibc.git;a=commit;h=ead80441e694fa52ac2fc36b11f21e35abe393ea.

  292. fanquake force-pushed on Jul 2, 2026
  293. DrahtBot added the label CI failed on Jul 2, 2026
  294. fanquake force-pushed on Jul 2, 2026
  295. DrahtBot removed the label CI failed on Jul 2, 2026
  296. fanquake force-pushed on Jul 2, 2026
  297. fanquake force-pushed on Jul 2, 2026
  298. DrahtBot added the label CI failed on Jul 2, 2026
  299. DrahtBot removed the label CI failed on Jul 2, 2026
  300. fanquake force-pushed on Jul 18, 2026
  301. hebasto referenced this in commit d673ca765a on Jul 21, 2026
  302. DrahtBot added the label Needs rebase on Jul 21, 2026
  303. fanquake force-pushed on Jul 21, 2026
  304. bitcoin deleted a comment on Jul 21, 2026
  305. bitcoin deleted a comment on Jul 21, 2026
  306. fanquake commented at 2:49 PM on July 21, 2026: member

    Rebased after #35537. I've dropped the commits for the other hosts (they are available here: https://github.com/fanquake/bitcoin/tree/fully_static_bitcoind_extra_hosts), and just left x86_64 for now, to simplify review and testing. It is straight-forward to add more hosts later.

  307. fanquake marked this as ready for review on Jul 21, 2026
  308. DrahtBot removed the label Needs rebase on Jul 21, 2026
  309. in contrib/guix/security-check.py:132 in ffb539f6d4 outdated 
     128 | @@ -129,7 +129,7 @@ def check_ELF_FORTIFY(binary) -> bool:
 129 |  
 130 |      chk_funcs = set()
 131 |  
 132 | -    for sym in binary.imported_symbols:
 133 | +    for sym in binary.symbols:
    willcl-ark commented at 8:18 AM on July 22, 2026:

    In ffb539f6d45ded6492a22c4fed1e0ebe1e48b7af

    Hmmm, I don't think switching from binary.imported_symbols to binary.symbols provides a valid FORTIFY check for static binaries any more.

    We have two thigns going on here:

    1. glibc is built with FORTIFY, as requested through --enable-fortify-source.
    2. Bitcoin Core is compiled with _FORTIFY_SOURCE=3, allowing all (eligible) calls in Bitcoin Core translation units to be fortified.

    After static linking though, binary.symbols contains the _chk implementations pulled in from libc.a, including symbols originating from glibc's own fortification. Their presence doesn't demonstrate that Bitcoin Core was compiled with FORTIFY or emitted any fortified calls, as is thought is being checked here.

    For example, a program compiled with:

    gcc -static-pie -O2 -U_FORTIFY_SOURCE test.c -o test

    still contains definitions such as __memcpy_chk, __fprintf_chk, and __asprintf_chk. The revised check_ELF_FORTIFY()therefore returnsTrue` for an application compiled with FORTIFY disabled.

    The glibc guix package configuration can enforce fortification for glibc OK IMO, but the Bitcoin Core fortify check on a static build seems much more tricky...

    We could inspect Bitcoin Core object files before static linking, or use a compiled-time assertion (yuck), or perhaps somethign else I didn't think about yet, but scanning all symbols in the final static executable cannot I think distinguish them from libc.

    fanquake commented at 3:26 PM on July 29, 2026:

    Yea. We needed some change here, because static bins wont have imported symbols, and would otherwise always fail the check as-is. For now I've opted to just return True for any static bin; I'm not sure if a more involved approach is worthwhile, will think about it some more. I do think that some of these checks are loosing their significance given the point we are reaching with our toolchain construction.

  310. willcl-ark commented at 8:33 AM on July 22, 2026: member

    next step here might be to remove --enable-static-nss outright, as the build no-longer differs if that flag is passed)

    Done in sourceware.org/git?p=glibc.git;a=commit;h=ead80441e694fa52ac2fc36b11f21e35abe393ea.

    I think the removal of external NSS modules on the x64 linux binary might warrant a release note as it can change stuff for the user and might require setup modification.

    Also doc/INSTALL_linux.md can probably be updated slightly too with a new distinction:

    Bitcoin Core requires glibc (GNU C Library) 2.31 or newer.

  311. fanquake force-pushed on Jul 23, 2026
  312. fanquake force-pushed on Jul 24, 2026
  313. fanquake force-pushed on Jul 25, 2026
  314. fanquake force-pushed on Jul 25, 2026
  315. DrahtBot added the label CI failed on Jul 25, 2026
  316. bitcoin deleted a comment on Jul 25, 2026
  317. fanquake commented at 10:48 AM on July 25, 2026: member

    glibc 2.44 has been branched off, so the glibc added here now points to that branch: https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.44/master.

  318. DrahtBot removed the label CI failed on Jul 25, 2026
  319. DrahtBot added the label Needs rebase on Jul 26, 2026
  320. fanquake force-pushed on Jul 27, 2026
  321. DrahtBot removed the label Needs rebase on Jul 27, 2026
  322. DrahtBot added the label Needs rebase on Jul 27, 2026
  323. fanquake force-pushed on Jul 27, 2026
  324. DrahtBot removed the label Needs rebase on Jul 27, 2026
  325. fanquake force-pushed on Jul 29, 2026
  326. fanquake force-pushed on Jul 29, 2026
  327. DrahtBot added the label CI failed on Jul 29, 2026
  328. DrahtBot removed the label CI failed on Jul 29, 2026
  329. fanquake force-pushed on Jul 30, 2026
  330. 151henry151 commented at 4:22 PM on August 2, 2026: contributor

    I Guix-built tip f2e1a8f3e16e50de469e62d8aa015c1a2e98fd08 to check reproducibility, static-pie shape, and the NSS fail-closed behavior under the nodlopen patch (Debian 13, guix 1.5.0; unmodified ./contrib/guix/guix-build, HOSTS=x86_64-linux-gnu and HOSTS=aarch64-linux-gnu as separate runs):

    3c9d5a452e88095e55d56333370d9bb8985c4d1e83daec204ef0b5d2a5c66e69  bitcoin-f2e1a8f3e16e-x86_64-linux-gnu.tar.gz
6f2825f1ac2188f1dae003e478c1f15989d4f37d405b71f8ea8dc78615f781a5  bitcoin-f2e1a8f3e16e-aarch64-linux-gnu.tar.gz

    For both HOSTS, bitcoind and the other CLI tools are static-pie (DYN/PIE/BIND_NOW, no PT_INTERP); bitcoin-qt stays dynamic on the glibc-2.31 path. Runtime below is x86_64 only (aarch64 is hash + ELF). Guix-shipped x86_64 test_bitcoin passes.

    On NSS: with hosts: files resolve (no dns) and nameserver 127.0.0.53, DNS seeding fails closed — 0 addresses found from DNS seeds, dnsseed thread exits, no abort, no libnss_* opens. After the usual ~60s empty-addrman delay, fixed seeds still load (Added 1024 fixed seeds…) and the node forms outbound peers. Control with hosts: files dns gets DNS seed addresses normally. Fedora’s default nsswitch (… resolve … dns) likewise never opens libnss_*. Wallet create and zmqpubhashtx smoke OK. The same static-pie binary also peers on Alpine / distroless / centos:7 Docker userlands (portability of the artifact, not a kernel-floor claim).

    Limits: no IBD, no bare-metal old kernel, no aarch64 runtime, no GUI.

    The getaddrinfo / getgrgid / getpwuid “requires shared libraries” warnings are still emitted at Guix link time (the latter two from ipc_listener.cpp); under nodlopen they do not match runtime for hosts lookup (no host NSS module loads). Worth deciding whether those warnings should be annotated or suppressed so future builders do not rediscover them.

    This supports the intended NSS fail-closed behavior and that bootstrap via fixed seeds still works when DNS seeding cannot. It doesn’t speak to docs/release notes for the NSS change, or to the intended kernel floor.

  331. fanquake commented at 11:07 AM on August 3, 2026: member

    cfb9f5f7701378353f2a6d60a09afee35c5a6ddd is now also part of #35870.

  332. fanquake referenced this in commit 101400b28f on Aug 3, 2026
  333. fanquake referenced this in commit 5e0be539c6 on Aug 4, 2026
  334. fanquake force-pushed on Aug 4, 2026
  335. fanquake force-pushed on Aug 4, 2026
  336. DrahtBot added the label CI failed on Aug 4, 2026
  337. bitcoin deleted a comment on Aug 4, 2026
  338. DrahtBot removed the label CI failed on Aug 4, 2026
  339. fanquake force-pushed on Aug 4, 2026
  340. fanquake force-pushed on Aug 5, 2026
  341. guix: split linux toolchain for static builds
    Co-authored-by: willcl-ark <will8clark@gmail.com>
    ac13e5879c
  342. guix: add helper to generate /gnu/store mappings a129f58183
  343. guix: add glibc 2.44
    https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.44/master

Store path patch kills paths like:
/gnu/store/kv58f3znb62s7ygalb6xk3ipnfmq6qgv-glibc-cross-x86_64-linux-gnu-2.44/lib/gconv/gconv-modules.cache
/gnu/store/kv58f3znb62s7ygalb6xk3ipnfmq6qgv-glibc-cross-x86_64-linux-gnu-2.44/share/locale
/gnu/store/0v9fwaigryb9qrzqbwwifj3k64li3bmg-bash-static-5.2.37/bin/bash
/gnu/store/0v9fwaigryb9qrzqbwwifj3k64li3bmg-bash-static-5.2.37/bin/sh
/gnu/store/kv58f3znb62s7ygalb6xk3ipnfmq6qgv-glibc-cross-x86_64-linux-gnu-2.44/libexec/getconf
/gnu/store/kv58f3znb62s7ygalb6xk3ipnfmq6qgv-glibc-cross-x86_64-linux-gnu-2.44/lib/gconv
/gnu/store/kv58f3znb62s7ygalb6xk3ipnfmq6qgv-glibc-cross-x86_64-linux-gnu-2.44/share/locale
/gnu/store/kv58f3znb62s7ygalb6xk3ipnfmq6qgv-glibc-cross-x86_64-linux-gnu-2.44/share/zoneinfo
/gnu/store/kv58f3znb62s7ygalb6xk3ipnfmq6qgv-glibc-cross-x86_64-linux-gnu-2.44/lib/
    5ce3b51b15
  344. guix: adapt symbol and security checks for static ELF 46010b92f6
  345. guix: build x86_64-linux bitcoind & utils statically
    -static-pie
Produce a static position independent executable on targets that support it.
A static position independent executable is similar to a static executable,
but can be loaded at any address without a dynamic linker.

See https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html
    d43925621e
  346. guix: build aarch64-linux bitcoind fully statically
    -static-pie
Produce a static position independent executable on targets that support it.
A static position independent executable is similar to a static executable,
but can be loaded at any address without a dynamic linker.

See https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html
    8ed465e123
  347. fanquake force-pushed on Aug 6, 2026
  348. doc: add release note for #25573 ff01e5af94
  349. DrahtBot added the label CI failed on Aug 6, 2026
  350. fanquake commented at 11:06 AM on August 6, 2026: member

    Guix Build (x86_64 and aarch64):

    1888fa5d48bb53b438e3ac7973a8914e82a51893c50479e28dc84ece4f54a943  guix-build-ff01e5af948d/output/aarch64-linux-gnu/SHA256SUMS.part
22b757235729757bf4a225de4b34eca4d20704ad7e1fd6b48ab6902ef6fad407  guix-build-ff01e5af948d/output/aarch64-linux-gnu/bitcoin-ff01e5af948d-aarch64-linux-gnu-debug.tar.gz
1f3461c39b1776cbbaa6d216847beb6670df931121d1d4da9fbaaf6a3aad7398  guix-build-ff01e5af948d/output/aarch64-linux-gnu/bitcoin-ff01e5af948d-aarch64-linux-gnu.tar.gz
190e5a140d4aa719072a7052343338e9942ecbd16d6e4fc871250296c9a4312c  guix-build-ff01e5af948d/output/arm-linux-gnueabihf/SHA256SUMS.part
5d95d6f452b5a58eeef74af8513b4c718934f3bafa5c439347c188651b3802d6  guix-build-ff01e5af948d/output/arm-linux-gnueabihf/bitcoin-ff01e5af948d-arm-linux-gnueabihf-debug.tar.gz
05045c92d9ee12d1ba327eb319597aa1247cc46d55b480decf4b25e05f8825fd  guix-build-ff01e5af948d/output/arm-linux-gnueabihf/bitcoin-ff01e5af948d-arm-linux-gnueabihf.tar.gz
fd089395212778703a42d2624179c7ee7bdc859ac1b45911305c2f5a3a5c6c1e  guix-build-ff01e5af948d/output/arm64-apple-darwin/SHA256SUMS.part
d63b5bfc70bf41a431a7a6d4b50a3ebe29377732dc2a0ff34a81579674b6cc75  guix-build-ff01e5af948d/output/arm64-apple-darwin/bitcoin-ff01e5af948d-arm64-apple-darwin-codesigning.tar.gz
0c603699da0c4193724b0303bc17e5f1cd5c742a6f6b423b58e93d2d45c7ce57  guix-build-ff01e5af948d/output/arm64-apple-darwin/bitcoin-ff01e5af948d-arm64-apple-darwin-unsigned.tar.gz
57ab8c7c258c901a2fd908d7e12e2657820f90a9724c50e9a7f9adc95093bc0f  guix-build-ff01e5af948d/output/arm64-apple-darwin/bitcoin-ff01e5af948d-arm64-apple-darwin-unsigned.zip
00cc2357b102dd4e1c41bf9fc0c28cc4d43ec1074b7035defc09e4c81f910322  guix-build-ff01e5af948d/output/dist-archive/bitcoin-ff01e5af948d.tar.gz
bd9c1279ee3f14d30c6a8faade8333e120d35252acc146e09851f8c6d478af67  guix-build-ff01e5af948d/output/powerpc64-linux-gnu/SHA256SUMS.part
afc9338f53ad94d18e70a18342eebb7ec0a794332082baa6ee96cd182b5c020d  guix-build-ff01e5af948d/output/powerpc64-linux-gnu/bitcoin-ff01e5af948d-powerpc64-linux-gnu-debug.tar.gz
ebd0811a011ba39d02784dddcc1dcca01041460365d8c363f8980e0a9262ea81  guix-build-ff01e5af948d/output/powerpc64-linux-gnu/bitcoin-ff01e5af948d-powerpc64-linux-gnu.tar.gz
a86ab388c5b215cee68b0dc94d26ea2937d929b9e795a5106299c0223485cf78  guix-build-ff01e5af948d/output/riscv64-linux-gnu/SHA256SUMS.part
fb4a63775a48f24e3ff3ae47899042062d48bed9e04f326757955f350c7ee8bf  guix-build-ff01e5af948d/output/riscv64-linux-gnu/bitcoin-ff01e5af948d-riscv64-linux-gnu-debug.tar.gz
0fbb0dcd8c10ff4262506a26cd21929f710efce6a43b76c175e967ea32c7888e  guix-build-ff01e5af948d/output/riscv64-linux-gnu/bitcoin-ff01e5af948d-riscv64-linux-gnu.tar.gz
41ef0e621c8b81222a0b2ccf1ffc8e6a76b6d71a089c3eab19e95bce69b2385c  guix-build-ff01e5af948d/output/x86_64-apple-darwin/SHA256SUMS.part
f198e20602692c3981882df2dc704c09482c06f6f9620bdf80bdc4802bc8a757  guix-build-ff01e5af948d/output/x86_64-apple-darwin/bitcoin-ff01e5af948d-x86_64-apple-darwin-codesigning.tar.gz
5b94a6cd915caae58a60498d0347d50170f0c697f3816cc2b405998f134a2035  guix-build-ff01e5af948d/output/x86_64-apple-darwin/bitcoin-ff01e5af948d-x86_64-apple-darwin-unsigned.tar.gz
5418fa47e6796d484e4d0bcc411cf155e300fa040af42b44077fa4d7efc1d386  guix-build-ff01e5af948d/output/x86_64-apple-darwin/bitcoin-ff01e5af948d-x86_64-apple-darwin-unsigned.zip
ee40b9f39d5e56b35b8c0e1a5c5bd65b151e34598052e3cedc2abb4da4ee9dd9  guix-build-ff01e5af948d/output/x86_64-linux-gnu/SHA256SUMS.part
9d886b556d04658019f9882b7e10b3be26a91c5dbcdeedd4813fcaf769a7a750  guix-build-ff01e5af948d/output/x86_64-linux-gnu/bitcoin-ff01e5af948d-x86_64-linux-gnu-debug.tar.gz
5abdd153b2fc41f56c341b51c9175196f503d310dde64e109c781e8f05f019de  guix-build-ff01e5af948d/output/x86_64-linux-gnu/bitcoin-ff01e5af948d-x86_64-linux-gnu.tar.gz
f324cc0d4187f0f575247fe7585b7e14779f0f3a13de42b8b1766d1de31b2f45  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/SHA256SUMS.part
aba0f3798c6dd780e9c015bc42955dc188e2ee34ec98f7d5593bc328ba99ba8d  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/bitcoin-ff01e5af948d-win64-codesigning.tar.gz
a7efb4381a0beff3c4d03cc2ebffbc477647799d278952dbf2abad47eef62c14  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/bitcoin-ff01e5af948d-win64-debug.zip
5c71637a17bf4c2fdee6a4c4798716880a669fd2bd4ad6ce590f7242a3eab53c  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/bitcoin-ff01e5af948d-win64-setup-unsigned.exe
10f70f17a08c1d5100e77c6c65279115cf0f694bd7f6251ef5264be78bcf7195  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/bitcoin-ff01e5af948d-win64-unsigned.zip
  351. willcl-ark commented at 11:12 AM on August 6, 2026: member

    For other builders, the needed repo is on sourceware who are blocking many requests (a la #35853) so it may take a few retries to build the new glibc as this involves cloning a sourceware repo.

  352. DrahtBot removed the label CI failed on Aug 6, 2026
  353. willcl-ark commented at 2:19 PM on August 6, 2026: member

    matching

    x86_64
1888fa5d48bb53b438e3ac7973a8914e82a51893c50479e28dc84ece4f54a943  guix-build-ff01e5af948d/output/aarch64-linux-gnu/SHA256SUMS.part
22b757235729757bf4a225de4b34eca4d20704ad7e1fd6b48ab6902ef6fad407  guix-build-ff01e5af948d/output/aarch64-linux-gnu/bitcoin-ff01e5af948d-aarch64-linux-gnu-debug.tar.gz
1f3461c39b1776cbbaa6d216847beb6670df931121d1d4da9fbaaf6a3aad7398  guix-build-ff01e5af948d/output/aarch64-linux-gnu/bitcoin-ff01e5af948d-aarch64-linux-gnu.tar.gz
190e5a140d4aa719072a7052343338e9942ecbd16d6e4fc871250296c9a4312c  guix-build-ff01e5af948d/output/arm-linux-gnueabihf/SHA256SUMS.part
5d95d6f452b5a58eeef74af8513b4c718934f3bafa5c439347c188651b3802d6  guix-build-ff01e5af948d/output/arm-linux-gnueabihf/bitcoin-ff01e5af948d-arm-linux-gnueabihf-debug.tar.gz
05045c92d9ee12d1ba327eb319597aa1247cc46d55b480decf4b25e05f8825fd  guix-build-ff01e5af948d/output/arm-linux-gnueabihf/bitcoin-ff01e5af948d-arm-linux-gnueabihf.tar.gz
fd089395212778703a42d2624179c7ee7bdc859ac1b45911305c2f5a3a5c6c1e  guix-build-ff01e5af948d/output/arm64-apple-darwin/SHA256SUMS.part
d63b5bfc70bf41a431a7a6d4b50a3ebe29377732dc2a0ff34a81579674b6cc75  guix-build-ff01e5af948d/output/arm64-apple-darwin/bitcoin-ff01e5af948d-arm64-apple-darwin-codesigning.tar.gz
0c603699da0c4193724b0303bc17e5f1cd5c742a6f6b423b58e93d2d45c7ce57  guix-build-ff01e5af948d/output/arm64-apple-darwin/bitcoin-ff01e5af948d-arm64-apple-darwin-unsigned.tar.gz
57ab8c7c258c901a2fd908d7e12e2657820f90a9724c50e9a7f9adc95093bc0f  guix-build-ff01e5af948d/output/arm64-apple-darwin/bitcoin-ff01e5af948d-arm64-apple-darwin-unsigned.zip
00cc2357b102dd4e1c41bf9fc0c28cc4d43ec1074b7035defc09e4c81f910322  guix-build-ff01e5af948d/output/dist-archive/bitcoin-ff01e5af948d.tar.gz
bd9c1279ee3f14d30c6a8faade8333e120d35252acc146e09851f8c6d478af67  guix-build-ff01e5af948d/output/powerpc64-linux-gnu/SHA256SUMS.part
afc9338f53ad94d18e70a18342eebb7ec0a794332082baa6ee96cd182b5c020d  guix-build-ff01e5af948d/output/powerpc64-linux-gnu/bitcoin-ff01e5af948d-powerpc64-linux-gnu-debug.tar.gz
ebd0811a011ba39d02784dddcc1dcca01041460365d8c363f8980e0a9262ea81  guix-build-ff01e5af948d/output/powerpc64-linux-gnu/bitcoin-ff01e5af948d-powerpc64-linux-gnu.tar.gz
a86ab388c5b215cee68b0dc94d26ea2937d929b9e795a5106299c0223485cf78  guix-build-ff01e5af948d/output/riscv64-linux-gnu/SHA256SUMS.part
fb4a63775a48f24e3ff3ae47899042062d48bed9e04f326757955f350c7ee8bf  guix-build-ff01e5af948d/output/riscv64-linux-gnu/bitcoin-ff01e5af948d-riscv64-linux-gnu-debug.tar.gz
0fbb0dcd8c10ff4262506a26cd21929f710efce6a43b76c175e967ea32c7888e  guix-build-ff01e5af948d/output/riscv64-linux-gnu/bitcoin-ff01e5af948d-riscv64-linux-gnu.tar.gz
41ef0e621c8b81222a0b2ccf1ffc8e6a76b6d71a089c3eab19e95bce69b2385c  guix-build-ff01e5af948d/output/x86_64-apple-darwin/SHA256SUMS.part
f198e20602692c3981882df2dc704c09482c06f6f9620bdf80bdc4802bc8a757  guix-build-ff01e5af948d/output/x86_64-apple-darwin/bitcoin-ff01e5af948d-x86_64-apple-darwin-codesigning.tar.gz
5b94a6cd915caae58a60498d0347d50170f0c697f3816cc2b405998f134a2035  guix-build-ff01e5af948d/output/x86_64-apple-darwin/bitcoin-ff01e5af948d-x86_64-apple-darwin-unsigned.tar.gz
5418fa47e6796d484e4d0bcc411cf155e300fa040af42b44077fa4d7efc1d386  guix-build-ff01e5af948d/output/x86_64-apple-darwin/bitcoin-ff01e5af948d-x86_64-apple-darwin-unsigned.zip
ee40b9f39d5e56b35b8c0e1a5c5bd65b151e34598052e3cedc2abb4da4ee9dd9  guix-build-ff01e5af948d/output/x86_64-linux-gnu/SHA256SUMS.part
9d886b556d04658019f9882b7e10b3be26a91c5dbcdeedd4813fcaf769a7a750  guix-build-ff01e5af948d/output/x86_64-linux-gnu/bitcoin-ff01e5af948d-x86_64-linux-gnu-debug.tar.gz
5abdd153b2fc41f56c341b51c9175196f503d310dde64e109c781e8f05f019de  guix-build-ff01e5af948d/output/x86_64-linux-gnu/bitcoin-ff01e5af948d-x86_64-linux-gnu.tar.gz
f324cc0d4187f0f575247fe7585b7e14779f0f3a13de42b8b1766d1de31b2f45  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/SHA256SUMS.part
aba0f3798c6dd780e9c015bc42955dc188e2ee34ec98f7d5593bc328ba99ba8d  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/bitcoin-ff01e5af948d-win64-codesigning.tar.gz
a7efb4381a0beff3c4d03cc2ebffbc477647799d278952dbf2abad47eef62c14  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/bitcoin-ff01e5af948d-win64-debug.zip
5c71637a17bf4c2fdee6a4c4798716880a669fd2bd4ad6ce590f7242a3eab53c  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/bitcoin-ff01e5af948d-win64-setup-unsigned.exe
10f70f17a08c1d5100e77c6c65279115cf0f694bd7f6251ef5264be78bcf7195  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/bitcoin-ff01e5af948d-win64-unsigned.zip
  354. hebasto commented at 2:47 PM on August 7, 2026: member

    What's the minimum supported Linux kernel version for the resulting fully-static bitcoind?

  355. sedited commented at 9:31 PM on August 8, 2026: contributor

    Guix build:

    1888fa5d48bb53b438e3ac7973a8914e82a51893c50479e28dc84ece4f54a943  guix-build-ff01e5af948d/output/aarch64-linux-gnu/SHA256SUMS.part
22b757235729757bf4a225de4b34eca4d20704ad7e1fd6b48ab6902ef6fad407  guix-build-ff01e5af948d/output/aarch64-linux-gnu/bitcoin-ff01e5af948d-aarch64-linux-gnu-debug.tar.gz
1f3461c39b1776cbbaa6d216847beb6670df931121d1d4da9fbaaf6a3aad7398  guix-build-ff01e5af948d/output/aarch64-linux-gnu/bitcoin-ff01e5af948d-aarch64-linux-gnu.tar.gz
190e5a140d4aa719072a7052343338e9942ecbd16d6e4fc871250296c9a4312c  guix-build-ff01e5af948d/output/arm-linux-gnueabihf/SHA256SUMS.part
5d95d6f452b5a58eeef74af8513b4c718934f3bafa5c439347c188651b3802d6  guix-build-ff01e5af948d/output/arm-linux-gnueabihf/bitcoin-ff01e5af948d-arm-linux-gnueabihf-debug.tar.gz
05045c92d9ee12d1ba327eb319597aa1247cc46d55b480decf4b25e05f8825fd  guix-build-ff01e5af948d/output/arm-linux-gnueabihf/bitcoin-ff01e5af948d-arm-linux-gnueabihf.tar.gz
fd089395212778703a42d2624179c7ee7bdc859ac1b45911305c2f5a3a5c6c1e  guix-build-ff01e5af948d/output/arm64-apple-darwin/SHA256SUMS.part
d63b5bfc70bf41a431a7a6d4b50a3ebe29377732dc2a0ff34a81579674b6cc75  guix-build-ff01e5af948d/output/arm64-apple-darwin/bitcoin-ff01e5af948d-arm64-apple-darwin-codesigning.tar.gz
0c603699da0c4193724b0303bc17e5f1cd5c742a6f6b423b58e93d2d45c7ce57  guix-build-ff01e5af948d/output/arm64-apple-darwin/bitcoin-ff01e5af948d-arm64-apple-darwin-unsigned.tar.gz
57ab8c7c258c901a2fd908d7e12e2657820f90a9724c50e9a7f9adc95093bc0f  guix-build-ff01e5af948d/output/arm64-apple-darwin/bitcoin-ff01e5af948d-arm64-apple-darwin-unsigned.zip
00cc2357b102dd4e1c41bf9fc0c28cc4d43ec1074b7035defc09e4c81f910322  guix-build-ff01e5af948d/output/dist-archive/bitcoin-ff01e5af948d.tar.gz
bd9c1279ee3f14d30c6a8faade8333e120d35252acc146e09851f8c6d478af67  guix-build-ff01e5af948d/output/powerpc64-linux-gnu/SHA256SUMS.part
afc9338f53ad94d18e70a18342eebb7ec0a794332082baa6ee96cd182b5c020d  guix-build-ff01e5af948d/output/powerpc64-linux-gnu/bitcoin-ff01e5af948d-powerpc64-linux-gnu-debug.tar.gz
ebd0811a011ba39d02784dddcc1dcca01041460365d8c363f8980e0a9262ea81  guix-build-ff01e5af948d/output/powerpc64-linux-gnu/bitcoin-ff01e5af948d-powerpc64-linux-gnu.tar.gz
a86ab388c5b215cee68b0dc94d26ea2937d929b9e795a5106299c0223485cf78  guix-build-ff01e5af948d/output/riscv64-linux-gnu/SHA256SUMS.part
fb4a63775a48f24e3ff3ae47899042062d48bed9e04f326757955f350c7ee8bf  guix-build-ff01e5af948d/output/riscv64-linux-gnu/bitcoin-ff01e5af948d-riscv64-linux-gnu-debug.tar.gz
0fbb0dcd8c10ff4262506a26cd21929f710efce6a43b76c175e967ea32c7888e  guix-build-ff01e5af948d/output/riscv64-linux-gnu/bitcoin-ff01e5af948d-riscv64-linux-gnu.tar.gz
41ef0e621c8b81222a0b2ccf1ffc8e6a76b6d71a089c3eab19e95bce69b2385c  guix-build-ff01e5af948d/output/x86_64-apple-darwin/SHA256SUMS.part
f198e20602692c3981882df2dc704c09482c06f6f9620bdf80bdc4802bc8a757  guix-build-ff01e5af948d/output/x86_64-apple-darwin/bitcoin-ff01e5af948d-x86_64-apple-darwin-codesigning.tar.gz
5b94a6cd915caae58a60498d0347d50170f0c697f3816cc2b405998f134a2035  guix-build-ff01e5af948d/output/x86_64-apple-darwin/bitcoin-ff01e5af948d-x86_64-apple-darwin-unsigned.tar.gz
5418fa47e6796d484e4d0bcc411cf155e300fa040af42b44077fa4d7efc1d386  guix-build-ff01e5af948d/output/x86_64-apple-darwin/bitcoin-ff01e5af948d-x86_64-apple-darwin-unsigned.zip
ee40b9f39d5e56b35b8c0e1a5c5bd65b151e34598052e3cedc2abb4da4ee9dd9  guix-build-ff01e5af948d/output/x86_64-linux-gnu/SHA256SUMS.part
9d886b556d04658019f9882b7e10b3be26a91c5dbcdeedd4813fcaf769a7a750  guix-build-ff01e5af948d/output/x86_64-linux-gnu/bitcoin-ff01e5af948d-x86_64-linux-gnu-debug.tar.gz
5abdd153b2fc41f56c341b51c9175196f503d310dde64e109c781e8f05f019de  guix-build-ff01e5af948d/output/x86_64-linux-gnu/bitcoin-ff01e5af948d-x86_64-linux-gnu.tar.gz
f324cc0d4187f0f575247fe7585b7e14779f0f3a13de42b8b1766d1de31b2f45  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/SHA256SUMS.part
aba0f3798c6dd780e9c015bc42955dc188e2ee34ec98f7d5593bc328ba99ba8d  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/bitcoin-ff01e5af948d-win64-codesigning.tar.gz
a7efb4381a0beff3c4d03cc2ebffbc477647799d278952dbf2abad47eef62c14  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/bitcoin-ff01e5af948d-win64-debug.zip
5c71637a17bf4c2fdee6a4c4798716880a669fd2bd4ad6ce590f7242a3eab53c  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/bitcoin-ff01e5af948d-win64-setup-unsigned.exe
10f70f17a08c1d5100e77c6c65279115cf0f694bd7f6251ef5264be78bcf7195  guix-build-ff01e5af948d/output/x86_64-w64-mingw32/bitcoin-ff01e5af948d-win64-unsigned.zip
  356. sedited commented at 9:50 PM on August 8, 2026: contributor

    Also ran bitcoin_test and bitcoind on arm ubuntu 26.04 and armbian v25.11.2 for RockPro 64 running Armbian Linux 6.12.58-current-rockchip64.

  357. fanquake commented at 12:51 PM on August 10, 2026: member

    What's the minimum supported Linux kernel version for the resulting fully-static bitcoind?

    This shouldn't be changed here, and remain as 3.2.0 for x86_64 and 3.7.0 for aarc64.

Contributors
fanquakeDrahtBottheuniluke-jrFrank-GERdergoeggem3dwardswillcl-arksipaw0xltnkatha23hebastotobtoht151henry151sedited


theunim3dwards

Labels
Build system
Linked (view graph)
#19075 build: Investigate aarch64 pointer authentication#23203 [POC] build: static musl libc based bitcoind#25484 Guix: enable toolchain hardening by default#33775 guix: use GCC 14.3.0 over 13.3.0#33780 guix: disable libsanitizer in Linux GCC build#33821 guix: build glibc with `--enable-static-pie`#35098 guix: Compile GUI separately from other binaries#35459 guix: add setup.sh#35499 guix: add `package.sh`#35537 guix: split builds into Linux, Linux GUI and macOS/Windows
github-metadata-mirror

This is a metadata mirror of the GitHub repository bitcoin/bitcoin. This site is not affiliated with GitHub. Content is generated from a GitHub metadata backup.
generated: 2026-08-10 21:53 UTC
This site is hosted by @0xB10C
More mirrored repositories can be found on mirror.b10c.me