guix: produce a `-static-pie` bitcoind #25573

pull fanquake wants to merge 12 commits into bitcoin:master from fanquake:fully_static_bitcoind changing 8 files +172 −36
  1. fanquake commented at 4:49 PM on July 8, 2022: member

    Use Guix to produce a -static-pie bitcoind using GCC 14.3.0 and glibc 2.43. Using glibc for static builds, would be less of a leap compared to switching to musl libc (POC in #23203).

    -static-pie

    Produce a static position independent executable on targets that support it. A static position independent executable is similar to a static executable, but can be loaded at any address without a dynamic linker.

    # file bitcoind
	ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped

# ldd bitcoind
	statically linked

    Fixes #19075.

  2. fanquake added the label Build system on Jul 8, 2022
  3. fanquake marked this as a draft on Jul 8, 2022
  4. DrahtBot commented at 10:29 PM on July 8, 2022: contributor

    <!--e57a25ab6845829454e8d69fc972939a-->

    The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

    <!--006a51241073e994b41acfe9ec718e94-->

    Code Coverage & Benchmarks

    For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/25573.

    <!--021abf342d371248e50ceaed478a90ca-->

    Reviews

    See the guideline for information on the review process.

    Type Reviewers
    Concept ACK dergoegge, w0xlt

    If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

    <!--174a7506f384e20aa4161008e828411d-->

    Conflicts

    Reviewers, this pull request conflicts with the following ones:

    • #35098 (guix: Compile GUI separately from other binaries by hebasto)
    • #34948 (guix: Split manifest into build and codesign manifests by hebasto)
    • #34411 ([POC] Full Libevent removal by fanquake)
    • #34228 (guix: Set depends-specific SOURCE_DATE_EPOCH for depends build by hebasto)
    • #32162 (depends: Switch from multilib to platform-specific toolchains by hebasto)

    If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

    <!--5faf32d7da4f0f540f40219e4f7537a3-->

  5. fanquake force-pushed on Jul 13, 2022
  6. fanquake commented at 5:46 PM on July 13, 2022: member

    Rebased, and made small changes to fixup the linter and improve the security/symbol checks.

  7. theuni commented at 9:00 PM on July 13, 2022: member

    This is amazing!

    Using glibc for static builds, would be less of a leap compared to switching to musl libc (POC in #23203).

    Hard agree. Static musl builds would be very cool but tricky to audit for parity and thus pretty unlikely to ever become official/supported imo. This is a MUCH more palatable change.

  8. fanquake force-pushed on Jul 14, 2022
  9. fanquake commented at 10:41 AM on July 14, 2022: member

    Added an additional patch to disable building various features/libs in GCC that we don't need. i.e libquadmath, libsanitizer, gcov, libada and native language support. This should speed up compiling GCC, and slightly reduces the size of the pthread patch. I'm not currently disabling these features via the available configure flags, because they get passed through to GMP, which cannot handle them.

    I've also updated -flto usage to be -flto=auto, as that seems to now be the preferred invocation, and it mitigates GCC warning output. i.e:

    lto-wrapper: warning: using serial compilation of 84 LTRANS jobs
lto-wrapper: note: see the '-flto' option documentation for more information

    I've also split the ELF PIE check into it's own func, so we can special-case x86_64, and re-added the list of allowed ELF libs, but special-cased x86_64 to only pass if the list is empty.

  10. luke-jr commented at 5:00 PM on July 16, 2022: member

    How does this handle resolvers? eg, static glibc 2.33 applications break on systems with glibc 2.34...

  11. DrahtBot added the label Needs rebase on Jul 19, 2022
  12. fanquake force-pushed on Jul 19, 2022
  13. DrahtBot removed the label Needs rebase on Jul 19, 2022
  14. DrahtBot added the label Needs rebase on Jul 30, 2022
  15. Frank-GER commented at 4:47 PM on August 4, 2022: none

    Which OS did you build on?

    On Ubuntu 20.04 after build: file bitcoind bitcoind: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, for GNU/Linux 3.2.0, stripped

    Trying to run it, it crashes after seconds: addcon thread start Loading addresses from DNS seed dnsseed.emzy.de. bitcoind: dl-call-libc-early-init.c:37: _dl_call_libc_early_init: Assertion `sym != NULL' failed. Aborted (core dumped)

    Any ideas?

  16. fanquake commented at 8:05 AM on August 5, 2022: member

    Which OS did you build on?

    The base OS shouldn't matter, because the build is performed with Guix. However I've been performing these builds on Ubuntu 22.04.

    Any ideas?

    How did you actually build bitcoind? Something like HOSTS="x86_64-linux-gnu" ./contrib/guix/guix-build?

  17. fanquake force-pushed on Aug 5, 2022
  18. fanquake commented at 8:39 AM on August 5, 2022: member

    Rebased on master. Added a commit to use LIEF master, which reduces the number of changes in our scripts, as support for -static-pie ELF binaries has been added: https://github.com/lief-project/LIEF/issues/747. Will switch to a new release when one is available.

  19. DrahtBot removed the label Needs rebase on Aug 5, 2022
  20. Frank-GER commented at 5:12 PM on August 5, 2022: none

    How did you actually build bitcoind? Something like HOSTS="x86_64-linux-gnu" ./contrib/guix/guix-build?

    Yes, that's what I used to build it. https://github.com/fanquake/bitcoin/commits/fully_static_bitcoind produces the exact same problem when building on Ubuntu 20.04

  21. fanquake commented at 5:32 PM on August 5, 2022: member

    https://github.com/fanquake/bitcoin/commits/fully_static_bitcoind produces the exact same problem when building on Ubuntu 20.04

    I have just re-tested building the changes here (ef0edd55f3bc1e3f229134ec7ecac632de52eea7), and this produces a -static-pie binary as expected:

    guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, with debug_info, not stripped

    It's not clear to me that you are actually running a Guix build.

  22. Frank-GER commented at 6:22 PM on August 5, 2022: none

    the build I was testing: ~/bitcoin/guix-build-caa066465973/distsrc-caa066465973-x86_64-linux-gnu/src$ file bitcoind bitcoind: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, for GNU/Linux 3.2.0, with debug_info, not stripped

    just building again, fresh cloned with commit ef0edd5 export HOSTS='x86_64-linux-gnu' ./contrib/guix/guix-build

    $ file guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, for GNU/Linux 3.2.0, with debug_info, not stripped

    $ ldd ./guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind statically linked

    $ ./bitcoind ... 2022-08-05T19:10:46Z init message: Starting network threads… 2022-08-05T19:10:46Z net thread start 2022-08-05T19:10:46Z dnsseed thread start 2022-08-05T19:10:46Z Loading addresses from DNS seed seed.bitcoinstats.com. 2022-08-05T19:10:46Z opencon thread start 2022-08-05T19:10:46Z msghand thread start 2022-08-05T19:10:46Z addcon thread start 2022-08-05T19:10:46Z init message: Done loading bitcoind: dl-call-libc-early-init.c:37: _dl_call_libc_early_init: Assertion `sym != NULL' failed. Aborted (core dumped)

    build and run on Ubuntu 20.04 there is no other bitcoind on that OS

  23. Frank-GER commented at 2:27 PM on August 8, 2022: none

    building the same on Ubuntu 22.04: file guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, with debug_info, not stripped

    ldd guix-build-ef0edd55f3bc/distsrc-ef0edd55f3bc-x86_64-linux-gnu/src/bitcoind statically linked

    Running it on Ubuntu22 it works.

    Taking this bitcoind to Ubuntu 20 it shows: file ./bitcoind ./bitcoind: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, for GNU/Linux 3.2.0, with debug_info, not stripped

    and crashes with the above mentioned message: bitcoind: dl-call-libc-early-init.c:37: _dl_call_libc_early_init: Assertion `sym != NULL' failed. Aborted (core dumped)

    Checksums are the same for both builds (on Ubuntu 20 and 22) Ubuntu 20 sees it as dynamic linked, Ubuntu 22 as static-pie linked. On Ubuntu 20 it crashes, on Ubuntu 22 it works.

    Same bitcoind on Debian 10: file ./bitcoind ./bitcoind: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, for GNU/Linux 3.2.0, with debug_info, not stripped ldd ./bitcoind statically linked Gets past that point where it crashes on Ubuntu 20 and starts syncing

  24. fanquake force-pushed on Aug 24, 2022
  25. fanquake commented at 3:34 PM on August 24, 2022: member

    Pushed a number of changes, and rebased on master. Switched from glibc 2.35 to 2.36. Added infra for aarch64 -static-pie builds. More fine-grained / logical commits. Updated to the latest version of LIEF (master).

  26. fanquake force-pushed on Sep 5, 2022
  27. fanquake force-pushed on Sep 7, 2022
  28. DrahtBot added the label Needs rebase on Sep 13, 2022
  29. fanquake force-pushed on Sep 13, 2022
  30. fanquake removed the label Needs rebase on Sep 13, 2022
  31. fanquake force-pushed on Jan 13, 2023
  32. fanquake force-pushed on Jan 25, 2023
  33. DrahtBot added the label Needs rebase on Feb 17, 2023
  34. fanquake force-pushed on Feb 17, 2023
  35. fanquake force-pushed on Feb 17, 2023
  36. fanquake commented at 11:22 AM on February 17, 2023: member

    Rebased past #27029.

  37. DrahtBot removed the label Needs rebase on Feb 17, 2023
  38. DrahtBot added the label Needs rebase on Mar 27, 2023
  39. fanquake force-pushed on Mar 27, 2023
  40. DrahtBot removed the label Needs rebase on Mar 27, 2023
  41. fanquake force-pushed on May 22, 2023
  42. DrahtBot added the label CI failed on May 30, 2023
  43. DrahtBot removed the label CI failed on May 31, 2023
  44. DrahtBot added the label Needs rebase on Jun 28, 2023
  45. fanquake force-pushed on Jun 30, 2023
  46. DrahtBot removed the label Needs rebase on Jun 30, 2023
  47. fanquake renamed this:
    [POC] guix: produce a fully -static-pie x86_64 bitcoind using GCC and glibc
    [POC] guix: produce a fully `-static-pie` bitcoind
    on Jul 27, 2023
  48. DrahtBot added the label Needs rebase on Aug 22, 2023
  49. fanquake force-pushed on Aug 23, 2023
  50. DrahtBot removed the label Needs rebase on Aug 23, 2023
  51. DrahtBot added the label CI failed on Aug 23, 2023
  52. DrahtBot added the label Needs rebase on Aug 24, 2023
  53. fanquake force-pushed on Aug 24, 2023
  54. DrahtBot removed the label Needs rebase on Aug 24, 2023
  55. DrahtBot removed the label CI failed on Aug 24, 2023
  56. fanquake force-pushed on Aug 26, 2023
  57. fanquake force-pushed on Aug 27, 2023
  58. fanquake force-pushed on Sep 8, 2023
  59. DrahtBot added the label Needs rebase on Nov 13, 2023
  60. fanquake force-pushed on Nov 13, 2023
  61. DrahtBot removed the label Needs rebase on Nov 13, 2023
  62. fanquake commented at 3:37 PM on November 27, 2023: member

    GCC now has -static-pie for RISC-V: https://gcc.gnu.org/pipermail/gcc-patches/2023-October/632219.html. Looks like support in glibc will also be available soon: https://sourceware.org/pipermail/libc-alpha/2023-October/152132.html.

  63. DrahtBot added the label CI failed on Jan 14, 2024
  64. fanquake commented at 9:57 AM on January 15, 2024: member

    Looks like support in glibc will also be available soon: https://sourceware.org/pipermail/libc-alpha/2023-October/152132.html.

    This has now landed: https://sourceware.org/git/?p=glibc.git;a=commit;h=e0590f41fe1e7a54169e8f8828efe62b5064139e.

  65. DrahtBot added the label Needs rebase on Jan 16, 2024
  66. fanquake force-pushed on Jan 16, 2024
  67. DrahtBot removed the label Needs rebase on Jan 16, 2024
  68. DrahtBot removed the label CI failed on Jan 16, 2024
  69. fanquake force-pushed on Feb 16, 2024
  70. DrahtBot added the label CI failed on Feb 28, 2024
  71. DrahtBot removed the label CI failed on Mar 4, 2024
  72. DrahtBot added the label Needs rebase on Mar 14, 2024
  73. fanquake force-pushed on Mar 15, 2024
  74. fanquake commented at 5:17 PM on March 15, 2024: member

    Rebased. Simplified somewhat. Switched to GCC 13.2.0 and glibc 2.39.

  75. DrahtBot removed the label Needs rebase on Mar 15, 2024
  76. DrahtBot added the label Needs rebase on Mar 26, 2024
  77. fanquake force-pushed on Mar 26, 2024
  78. DrahtBot removed the label Needs rebase on Mar 26, 2024
  79. fanquake force-pushed on Apr 15, 2024
  80. DrahtBot added the label Needs rebase on Apr 17, 2024
  81. fanquake force-pushed on May 2, 2024
  82. DrahtBot removed the label Needs rebase on May 2, 2024
  83. DrahtBot commented at 5:22 AM on May 2, 2024: contributor

    <!--85328a0da195eb286784d51f73fa0af9-->

    🚧 At least one of the CI tasks failed. Make sure to run all tests locally, according to the documentation.

    Possibly this is due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.

    Leave a comment here, if you need help tracking down a confusing failure.

    <sub>Debug: https://github.com/bitcoin/bitcoin/runs/24492691529</sub>

  84. DrahtBot added the label CI failed on May 2, 2024
  85. DrahtBot added the label Needs rebase on Jun 8, 2024
  86. fanquake force-pushed on Jul 1, 2024
  87. fanquake force-pushed on Jul 1, 2024
  88. DrahtBot removed the label Needs rebase on Jul 1, 2024
  89. DrahtBot removed the label CI failed on Jul 1, 2024
  90. DrahtBot added the label CI failed on Jul 15, 2024
  91. DrahtBot removed the label CI failed on Jul 20, 2024
  92. fanquake force-pushed on Jul 25, 2024
  93. DrahtBot added the label Needs rebase on Aug 28, 2024
  94. fanquake force-pushed on Aug 28, 2024
  95. DrahtBot removed the label Needs rebase on Aug 28, 2024
  96. fanquake force-pushed on Sep 19, 2024
  97. DrahtBot added the label Needs rebase on Dec 20, 2024
  98. fanquake force-pushed on Jan 20, 2025
  99. DrahtBot removed the label Needs rebase on Jan 20, 2025
  100. fanquake force-pushed on Feb 5, 2025
  101. DrahtBot added the label CI failed on Feb 5, 2025
  102. DrahtBot removed the label CI failed on Feb 5, 2025
  103. fanquake force-pushed on Feb 12, 2025
  104. DrahtBot added the label CI failed on Feb 12, 2025
  105. DrahtBot added the label Needs rebase on Feb 19, 2025
  106. fanquake force-pushed on Feb 19, 2025
  107. DrahtBot removed the label Needs rebase on Feb 19, 2025
  108. DrahtBot removed the label CI failed on Feb 19, 2025
  109. fanquake force-pushed on Feb 27, 2025
  110. fanquake force-pushed on Mar 12, 2025
  111. fanquake force-pushed on Mar 20, 2025
  112. fanquake force-pushed on Apr 11, 2025
  113. DrahtBot added the label Needs rebase on May 12, 2025
  114. fanquake force-pushed on May 12, 2025
  115. DrahtBot removed the label Needs rebase on May 12, 2025
  116. fanquake force-pushed on May 14, 2025
  117. fanquake force-pushed on May 14, 2025
  118. DrahtBot added the label Needs rebase on May 27, 2025
  119. fanquake force-pushed on May 28, 2025
  120. DrahtBot removed the label Needs rebase on May 28, 2025
  121. DrahtBot added the label Needs rebase on Jun 11, 2025
  122. fanquake force-pushed on Jun 11, 2025
  123. DrahtBot removed the label Needs rebase on Jun 11, 2025
  124. achow101 requested review from theuni on Oct 22, 2025
  125. achow101 requested review from willcl-ark on Oct 22, 2025
  126. dergoegge commented at 3:08 PM on October 22, 2025: member

    Concept ACK

  127. achow101 requested review from m3dwards on Oct 22, 2025
  128. fanquake force-pushed on Oct 28, 2025
  129. fanquake force-pushed on Oct 28, 2025
  130. willcl-ark referenced this in commit 0074e4aa14 on Oct 28, 2025
  131. willcl-ark referenced this in commit 3f8848d5d2 on Oct 28, 2025
  132. willcl-ark referenced this in commit 1944d38c16 on Oct 29, 2025
  133. willcl-ark referenced this in commit 11ca259f4d on Oct 29, 2025
  134. willcl-ark referenced this in commit 0430ebf3a8 on Oct 29, 2025
  135. willcl-ark referenced this in commit cbe8ae4b33 on Oct 29, 2025
  136. willcl-ark referenced this in commit 1146ab21ac on Oct 29, 2025
  137. fanquake force-pushed on Oct 29, 2025
  138. fanquake force-pushed on Oct 29, 2025
  139. fanquake referenced this in commit be853e9f7a on Nov 3, 2025
  140. fanquake referenced this in commit 9bcdd81636 on Nov 4, 2025
  141. fanquake referenced this in commit 701fb7c8e2 on Nov 4, 2025
  142. fanquake force-pushed on Nov 4, 2025
  143. fanquake referenced this in commit 5c41fa2918 on Nov 4, 2025
  144. fanquake referenced this in commit ffd7ca3c46 on Nov 5, 2025
  145. fanquake referenced this in commit 8649f7dcf7 on Nov 5, 2025
  146. fanquake force-pushed on Nov 5, 2025
  147. DrahtBot added the label CI failed on Nov 5, 2025
  148. fanquake force-pushed on Nov 5, 2025
  149. DrahtBot removed the label CI failed on Nov 5, 2025
  150. fanquake referenced this in commit 5b51244f21 on Nov 6, 2025
  151. fanquake force-pushed on Nov 6, 2025
  152. fanquake renamed this:
    [POC] guix: produce a fully `-static-pie` bitcoind
    guix: produce a fully `-static-pie` bitcoind
    on Nov 6, 2025
  153. fanquake renamed this:
    guix: produce a fully `-static-pie` bitcoind
    guix: produce a `-static-pie` bitcoind
    on Nov 6, 2025
  154. fanquake referenced this in commit a6417a24f6 on Nov 7, 2025
  155. m3dwards commented at 4:38 PM on November 7, 2025: contributor

    This is very cool.

    Have I got the potential trade-offs correct here?

    Positives:

    • More portable - especially running a modern binary on an older linux
    • Enable very small docker images

    Downsides:

    • Static glibc can struggle with resolvers and locale (although I don't think locale is an issue here) potentially undermining the portability benefit. I don't know if --enable-static-nss solves this? But as referenced in this line it's been broken for a long time.
    • Binary would be bigger
  156. fanquake referenced this in commit 6efb234510 on Nov 10, 2025
  157. fanquake referenced this in commit ce204ecace on Nov 10, 2025
  158. fanquake referenced this in commit 746c540845 on Nov 11, 2025
  159. fanquake referenced this in commit 4568773763 on Nov 11, 2025
  160. fanquake force-pushed on Nov 11, 2025
  161. fanquake commented at 12:20 PM on November 11, 2025: member

    Binary would be bigger

    Yes ~2mb. I've added a comparison of bitcoind size for master vs this change, to the PR description.

  162. fanquake referenced this in commit 0716bb53f0 on Nov 11, 2025
  163. fanquake referenced this in commit 94b5b3816c on Nov 11, 2025
  164. fanquake referenced this in commit 86fffd9380 on Nov 12, 2025
  165. fanquake referenced this in commit 2b6e451075 on Nov 12, 2025
  166. fanquake force-pushed on Nov 12, 2025
  167. fanquake referenced this in commit e40362b4ff on Nov 13, 2025
  168. fanquake referenced this in commit 81be7e5bef on Nov 14, 2025
  169. fanquake referenced this in commit ce6769c0e3 on Nov 14, 2025
  170. fanquake referenced this in commit 26c6dd1ca5 on Nov 14, 2025
  171. fanquake force-pushed on Nov 14, 2025
  172. DrahtBot added the label Needs rebase on Nov 17, 2025
  173. fanquake referenced this in commit 680f587b10 on Nov 17, 2025
  174. fanquake force-pushed on Nov 17, 2025
  175. willcl-ark commented at 12:35 PM on November 17, 2025: member

    ;; --enable-static-nss isn't used yet, because it has been broken ;; since 2.33: https://sourceware.org/bugzilla/show_bug.cgi?id=27959.

    What are the exact implications of this? I guix-built this branch and loaded it into a scratch docker container and the dns seeds were connected to and loaded fine. Is this coming from my host system perhaps, even inside a scratch container?

    I also tested the binary on alpine and it appeared to "fallback" to using libnss without issue...

  176. fanquake referenced this in commit f21d5bd923 on Nov 17, 2025
  177. DrahtBot removed the label Needs rebase on Nov 17, 2025
  178. fanquake referenced this in commit 59304910cb on Nov 17, 2025
  179. willcl-ark commented at 11:48 AM on November 18, 2025: member

    ;; --enable-static-nss isn't used yet, because it has been broken ;; since 2.33: sourceware.org/bugzilla/show_bug.cgi?id=27959.

    What are the exact implications of this? I guix-built this branch and loaded it into a scratch docker container and the dns seeds were connected to and loaded fine. Is this coming from my host system perhaps, even inside a scratch container?

    I also tested the binary on alpine and it appeared to "fallback" to using libnss without issue...

    Some additional context. When run in an alpine container with strace I see:

    <details> <summary>Log</summary>

    x86_64-linux-gnu/bitcoin-84d3c4d14e70/bin on  pr-25573 [$] via ❄️  impure (nix-shell-env) took 2s
❯ docker run --rm -it \
        -v "$PWD/bitcoind:/bitcoind:ro" \
        --entrypoint=sh \
        alpine \
        -lc 'apk add --no-cache strace >/dev/null && strace -f -e trace=%file /bitcoind'
        
<snip>

2025-11-18T11:40:10Z dnsseed thread start
strace: Process 52 attached
2025-11-18T11:40:10Z Loading addresses from DNS seed dnsseed.bluematt.me.
strace: Process 53 attached
2025-11-18T11:40:10Z init message: Done loading
2025-11-18T11:40:10Z opencon thread start
2025-11-18T11:40:10Z addcon thread start
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC2025-11-18T11:40:10Z msghand thread start
) = -1 ENOENT (No such file or directory)
[pid    50] openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 27
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/", {st_mode=S_IFDIR|0755, st_size=4096, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 27
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
[pid    50] openat(AT_FDCWD, "/etc/gai.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
2025-11-18T11:40:10Z Loading addresses from DNS seed dnsseed.emzy.de.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed seed.bitcoin.sipa.be.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed seed.bitcoin.jonasschnelli.ch.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed seed.mainnet.achownodes.xyz.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed seed.bitcoin.sprovoost.nl.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed dnsseed.bitcoin.dashjr-list-of-p2p-nodes.us.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed seed.bitcoin.wiz.biz.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z Loading addresses from DNS seed seed.btc.petertodd.net.
[pid    50] newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=252, ...}, 0) = 0
[pid    50] newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=205, ...}, 0) = 0
[pid    50] openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 27
2025-11-18T11:40:10Z 203 addresses found from DNS seeds
2025-11-18T11:40:10Z dnsseed thread exit

    </details>

    When run on my NixOS host I see:

    <details> <summary>Log</summary>

    x86_64-linux-gnu/bitcoin-84d3c4d14e70/bin on  pr-25573 [$] via ❄️  impure (nix-shell-env) took 11s
❯ strace -f \
        -e trace=open,openat,stat,statx,access,readlink \
        ./bitcoind -datadir=/tmp/b1 -daemon=0 2>&1 | grep -i 'libnss'
[pid 930543] openat(AT_FDCWD, "/nix/store/khwsqzc1s0b92y3l695g95f4773lb2h1-capnproto-1.2.0/lib/libnss_mymachines.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 930543] openat(AT_FDCWD, "/gnu/store/hhrsk659w4k3zs0bin6i4q1lnbr4zxx0-glibc-cross-x86_64-linux-gnu-2.42/lib/libnss_mymachines.so.2", O_RDONLY|O_CLOEXECstrace: Process 930545 attached
[pid 930543] openat(AT_FDCWD, "/nix/store/khwsqzc1s0b92y3l695g95f4773lb2h1-capnproto-1.2.0/lib/libnss_mdns4_minimal.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 930543] openat(AT_FDCWD, "/gnu/store/hhrsk659w4k3zs0bin6i4q1lnbr4zxx0-glibc-cross-x86_64-linux-gnu-2.42/lib/libnss_mdns4_minimal.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 930543] openat(AT_FDCWD, "/nix/store/khwsqzc1s0b92y3l695g95f4773lb2h1-capnproto-1.2.0/lib/libnss_myhostname.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
[pid 930543] openat(AT_FDCWD, "/gnu/store/hhrsk659w4k3zs0bin6i4q1lnbr4zxx0-glibc-cross-x86_64-linux-gnu-2.42/lib/libnss_myhostname.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
^C⏎

    </details>

    Both succeed in retrieving DNS seed addresses.

  180. willcl-ark commented at 2:48 PM on November 18, 2025: member

    Ah OK I think I might understand better now. Both systems I tested on include files and dns backends as part of nsswitch.conf (line starting with hosts: ):

    # alpine Container

x86_64-linux-gnu/bitcoin-84d3c4d14e70/bin on  pr-25573 [$] via ❄️  impure (nix-shell-env)
❯ cat /etc/nsswitch.conf
passwd:    files systemd
group:     files [success=merge] systemd
shadow:    files systemd
sudoers:   files

hosts:     mymachines mdns4_minimal [NOTFOUND=return] files myhostname dns mdns4
networks:  files

ethers:    files
services:  files
protocols: files
rpc:       files

# NixOS host

x86_64-linux-gnu/bitcoin-84d3c4d14e70/bin on  pr-25573 [$] via ❄️  impure (nix-shell-env)
❯ docker run --rm -it --entrypoint=sh alpine -lc 'cat /etc/nsswitch.conf'
# musl itself does not support NSS, however some third-party DNS
# implementations use the nsswitch.conf file to determine what
# policy to follow.
# Editing this file is not recommended.
hosts: files dns

    ...and these backends are actually baked into a static glibc, which allows it to succeed in lookups.

    The (failed) dlopen calls on my Nix host are because my system nsswitch.conf includes extra backends which we try to open the lib for, but fail.

    So it seems to be that --enable-static-nss must be for "statically linking extra lookup backends in" in addition to the baked in defaults.

    If my understanding here is correct, then it seems totally fine to proceed without static nss enabled (while it is broken), as it doesn't break our basic DNS lookup functionality at all, and at worst results in some failing dlopen trys.

  181. fanquake referenced this in commit 5b4c9a1b3b on Nov 19, 2025
  182. fanquake referenced this in commit 9351c2be9b on Nov 20, 2025
  183. fanquake referenced this in commit 61a8f3840a on Nov 20, 2025
  184. fanquake referenced this in commit 23c1c4636d on Nov 25, 2025
  185. fanquake referenced this in commit c767125efa on Nov 25, 2025
  186. fanquake referenced this in commit 19cb502045 on Nov 25, 2025
  187. fanquake referenced this in commit 0ee5642048 on Nov 25, 2025
  188. fanquake referenced this in commit 7a9020d4cc on Nov 26, 2025
  189. fanquake force-pushed on Nov 26, 2025
  190. fanquake referenced this in commit 2c16922fff on Nov 27, 2025
  191. fanquake referenced this in commit 086e749d5d on Nov 27, 2025
  192. fanquake referenced this in commit 26bec5cf2e on Nov 27, 2025
  193. fanquake referenced this in commit 977eeffeb2 on Nov 27, 2025
  194. fanquake referenced this in commit c204201538 on Nov 28, 2025
  195. fanquake force-pushed on Nov 28, 2025
  196. fanquake referenced this in commit 57e7ff7662 on Dec 1, 2025
  197. fanquake referenced this in commit 0e8c03e2b2 on Dec 2, 2025
  198. fanquake referenced this in commit 0d95833544 on Dec 2, 2025
  199. fanquake referenced this in commit 3d6e6f687f on Dec 2, 2025
  200. fanquake referenced this in commit a1f2a6a74e on Dec 2, 2025
  201. fanquake referenced this in commit dc1760ffbc on Dec 3, 2025
  202. fanquake referenced this in commit 492faf7986 on Dec 3, 2025
  203. fanquake referenced this in commit 8c062253ec on Dec 3, 2025
  204. fanquake force-pushed on Dec 3, 2025
  205. fanquake referenced this in commit c40e4f083a on Dec 3, 2025
  206. fanquake referenced this in commit a20549f8a4 on Dec 4, 2025
  207. willcl-ark referenced this in commit be3cb01da7 on Dec 4, 2025
  208. fanquake referenced this in commit 471eceb8e3 on Dec 5, 2025
  209. fanquake referenced this in commit e0b6bd0fac on Dec 5, 2025
  210. fanquake referenced this in commit fd26217722 on Dec 8, 2025
  211. fanquake referenced this in commit 12df342737 on Dec 8, 2025
  212. willcl-ark referenced this in commit 1f15187752 on Dec 9, 2025
  213. willcl-ark referenced this in commit 5b6f06485c on Dec 10, 2025
  214. fanquake referenced this in commit bff7e76491 on Dec 11, 2025
  215. fanquake referenced this in commit b611b1e1cc on Dec 17, 2025
  216. fanquake referenced this in commit a4d7314fc9 on Dec 17, 2025
  217. fanquake referenced this in commit ce101381df on Dec 18, 2025
  218. fanquake referenced this in commit a5f500dca4 on Dec 29, 2025
  219. fanquake referenced this in commit 0269868c83 on Dec 31, 2025
  220. fanquake referenced this in commit 34909799fe on Jan 6, 2026
  221. fanquake referenced this in commit ba7757cda3 on Jan 9, 2026
  222. fanquake force-pushed on Jan 9, 2026
  223. fanquake referenced this in commit a38af7806a on Jan 12, 2026
  224. fanquake referenced this in commit cb7c598668 on Jan 13, 2026
  225. glozow referenced this in commit 8e8d8f29a8 on Jan 13, 2026
  226. fanquake force-pushed on Jan 14, 2026
  227. fanquake force-pushed on Feb 9, 2026
  228. fanquake force-pushed on Feb 9, 2026
  229. DrahtBot added the label CI failed on Feb 9, 2026
  230. DrahtBot removed the label CI failed on Feb 9, 2026
  231. DrahtBot added the label Needs rebase on Feb 24, 2026
  232. fanquake force-pushed on Feb 25, 2026
  233. DrahtBot removed the label Needs rebase on Feb 25, 2026
  234. fanquake force-pushed on Mar 20, 2026
  235. fanquake force-pushed on Apr 1, 2026
  236. fanquake force-pushed on Apr 8, 2026
  237. sipa commented at 3:41 AM on April 8, 2026: member

    me want pie! https://www.youtube.com/watch?v=sb8rWCvnNbk

  238. fanquake force-pushed on Apr 8, 2026
  239. fanquake commented at 8:50 AM on April 8, 2026: member

    Added a few more changes here. Tested the bins back to glibc 2.15 (Ubuntu 12.04).

  240. w0xlt commented at 5:32 PM on April 8, 2026: contributor

    Concept ACK

  241. fanquake force-pushed on Apr 9, 2026
  242. fanquake force-pushed on Apr 13, 2026
  243. fanquake force-pushed on Apr 16, 2026
  244. fanquake force-pushed on Apr 16, 2026
  245. DrahtBot added the label CI failed on Apr 16, 2026
  246. DrahtBot removed the label CI failed on Apr 16, 2026
  247. nkatha23 commented at 9:00 PM on April 17, 2026: none

    Tested the x86_64 binary from the static_bitcoind_307825c release on Fedora 43 (glibc 2.42-11.fc43.x86_64).

    $ file bitcoind
bitcoind: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), static-pie linked, for GNU/Linux 3.2.0, stripped

$ ldd bitcoind
	statically linked

$ ./bitcoind --version
Bitcoin Core daemon version v31.99.0-g307825cfa6b0569630d9697f23d94dd04644e417

    SHA256 verified against the published hash.

    DNS / NSS test:

    Started bitcoind with an isolated datadir and checked getnetworkinfo after 30 seconds:

    "connections": 6,
"connections_out": 6,

    IPv4 and IPv6 both reachable, 6 outbound connections established, DNS seeding works correctly with no issues.

    Fedora's nsswitch.conf hosts line for reference:

    hosts: files myhostname mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns

    This is a more complex NSS configuration than the alpine/NixOS cases discussed above, and the static binary handled it without any dlopen failures or connection issues.

  248. guix: modernise style in *-base-gcc 3f194c7043
  249. guix: disable-lto in *-base-gcc d6c03a40af
  250. guix: disable-nls in *-base-gcc 7b85814098
  251. guix: mirror some arguments from linux-gcc to mingw-w64-gcc f94d7f6ca7
  252. guix: check for fortified functions in all symbols
    -static-pie bins will not have any imported functions.
    2b2977f753
  253. guix: disable Qt cb48d3275d
  254. fanquake force-pushed on Apr 27, 2026
  255. guix: add glibc 2.43
    https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.43/master
    ab018fbad5
  256. guix: build x86_64-linux bitcoind fully statically
    -static-pie
Produce a static position independent executable on targets that support it.
A static position independent executable is similar to a static executable,
but can be loaded at any address without a dynamic linker.

See https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html
    0dad9fbefe
  257. guix: build aarch64-linux bitcoind fully statically
    -static-pie
Produce a static position independent executable on targets that support it.
A static position independent executable is similar to a static executable,
but can be loaded at any address without a dynamic linker.

See https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html
    907ee93472
  258. guix: build riscv64-linux bitcoind fully statically
    -static-pie
Produce a static position independent executable on targets that support it.
A static position independent executable is similar to a static executable,
but can be loaded at any address without a dynamic linker.

See https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html
    1f66be5bb9
  259. guix: drop -Werror=dev
    Workaround CMake and static-pie.
    09c50c164b
  260. build: drop usage of getprotoby* in libevent
    Libevent should also be removed entirely, in the near future:
https://github.com/bitcoin/bitcoin/issues/31194.
    6b9495d268
  261. fanquake force-pushed on Apr 27, 2026
  262. DrahtBot added the label CI failed on Apr 27, 2026
Contributors
fanquakeDrahtBottheuniluke-jrFrank-GERdergoeggem3dwardswillcl-arksipaw0xltnkatha23


theunim3dwardswillcl-ark

Labels
Build systemCI failed
Linked (view graph)
#19075 build: Investigate aarch64 pointer authentication#23203 [POC] build: static musl libc based bitcoind#33775 guix: use GCC 14.3.0 over 13.3.0#33780 guix: disable libsanitizer in Linux GCC build#33821 guix: build glibc with `--enable-static-pie`#35098 guix: Compile GUI separately from other binaries
github-metadata-mirror

This is a metadata mirror of the GitHub repository bitcoin/bitcoin. This site is not affiliated with GitHub. Content is generated from a GitHub metadata backup.
generated: 2026-05-02 15:13 UTC
This site is hosted by @0xB10C
More mirrored repositories can be found on mirror.b10c.me