achow101 commented at 10:32 pm on December 2, 2024: member

I have updated signapple to notarize MacOS app bundles without adding any additional dependencies. Further, it can also sign and apply detached signatures to standalone binaries.

As such, we can use signapple to perform the notarization and stapling steps so that MacOS will run the app bundle after it is installed. detached-sig-create.sh is updated to have a notarization step and to download the ticket which will be included in the detached signatures. The workflow is largely unchanged for the MacOS codesigners except for the additional requirement of having an App Store Connect API key and Team UUID, instructions for which can be found at https://github.com/achow101/signapple/blob/master/docs/notarization.md. For guix builders, the workflow is unchanged.

Additionally, the standalone binaries packaged in the MacOS .tar.gz and Windows .zip will now be codesigned. detached-sig-create.sh was updated to handle these, so the workflow for both MacOS and Windows codesigners remains unchanged. For guix builders, the workflow is also unchanged.

Because those binaries will how have codesigned and unsigned versions, the build command is modified to output -unsigned.{tar.gz,zip} archives containing the binaries. Since this happens to conflict with the tarball used for codesigning, the codesigning tarball was renamed to -codesigning.tar.gz. Both MacOS and Windows codesigners will need to adjust their workflows to account for the new name.

Fixes #15774 and #29749

DrahtBot commented at 10:32 pm on December 2, 2024: contributor

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/31407.

Reviews

See the guideline for information on the review process.

Type	Reviewers
Concept ACK	hebasto
Stale ACK	pinheadmz, willcl-ark

If your review is incorrectly listed, please react with 👎 to this comment and the bot will ignore it on the next update.

achow101 added this to the milestone 29.0 on Dec 2, 2024

DrahtBot added the label Build system on Dec 2, 2024

achow101 force-pushed on Dec 2, 2024

DrahtBot commented at 10:47 pm on December 2, 2024: contributor

🚧 At least one of the CI tasks failed. Debug: https://github.com/bitcoin/bitcoin/runs/33817027293

Try to run the tests locally, according to the documentation. However, a CI failure may still happen due to a number of reasons, for example:

Possibly due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.
A sanitizer issue, which can only be found by compiling with the sanitizer and running the affected test.
An intermittent issue.

Leave a comment here, if you need help tracking down a confusing failure.

DrahtBot added the label CI failed on Dec 2, 2024

DrahtBot removed the label CI failed on Dec 2, 2024

achow101 commented at 11:36 pm on December 2, 2024: member

It’s unclear to me whether the standalone binaries need to be notarized too. This is currently not implemented, but should not be that much more complicated to do.

edilmedeiros commented at 2:12 am on December 3, 2024: contributor

It’s unclear to me whether the standalone binaries need to be notarized too. This is currently not implemented, but should not be that much more complicated to do.

Are they being codesigned already?

I was getting the v28 binaries from bitcoincore.org instantly killed in Sonoma 14.6.1 when trying to run them in the terminal today. Took me a while to understand what was happening because the processes are killed without a security message or anything like the “nice” gatekeeper popup. Codesigning each on my own solved the issue.

 0❯ tar xvfz bitcoin-28.0-arm64-apple-darwin.tar.gz
 1x bitcoin-28.0/
 2x bitcoin-28.0/bin/
 3x bitcoin-28.0/bin/bitcoin-cli
 4x bitcoin-28.0/bin/bitcoin-qt
 5x bitcoin-28.0/bin/bitcoin-tx
 6x bitcoin-28.0/bin/bitcoin-util
 7x bitcoin-28.0/bin/bitcoin-wallet
 8x bitcoin-28.0/bin/bitcoind
 9x bitcoin-28.0/bin/test_bitcoin
10x bitcoin-28.0/bitcoin.conf
11x bitcoin-28.0/share/
12x bitcoin-28.0/share/man/
13x bitcoin-28.0/share/man/man1/
14x bitcoin-28.0/share/man/man1/bitcoin-cli.1
15x bitcoin-28.0/share/man/man1/bitcoin-qt.1
16x bitcoin-28.0/share/man/man1/bitcoin-tx.1
17x bitcoin-28.0/share/man/man1/bitcoin-util.1
18x bitcoin-28.0/share/man/man1/bitcoin-wallet.1
19x bitcoin-28.0/share/man/man1/bitcoind.1
20x bitcoin-28.0/share/rpcauth/
21x bitcoin-28.0/share/rpcauth/README.md
22x bitcoin-28.0/share/rpcauth/rpcauth.py
23
24❯ bitcoin-28.0/bin/bitcoind --version
25[1]    36572 killed     bitcoin-28.0/bin/bitcoind --version
26
27❯ codesign --sign - bitcoin-28.0/bin/bitcoind
28
29❯ bitcoin-28.0/bin/bitcoind --version
30Bitcoin Core version v28.0.0
31Copyright (C) 2009-2024 The Bitcoin Core developers
32
33Please contribute if you find Bitcoin Core useful. Visit
34<https://bitcoincore.org/> for further information about the software.
35The source code is available from <https://github.com/bitcoin/bitcoin>.
36
37This is experimental software.
38Distributed under the MIT software license, see the accompanying file COPYING
39or <https://opensource.org/licenses/MIT>

achow101 commented at 2:15 am on December 3, 2024: member

Are they being codesigned already?

This PR codesigns them.

Sjors commented at 12:20 pm on December 3, 2024: member

It’s unclear to me whether the standalone binaries need to be notarized too.

Do you mean the binaries in unsigned.{zip,tar.gz} archives? I think it’s fine not to.

in contrib/guix/guix-codesign:158 in ba67aa681e outdated

156-            echo "$(outdir_for_host "$1")/${DISTNAME}-win64-unsigned.tar.gz"
157+            echo "$(outdir_for_host "$1")/${DISTNAME}-win64-codesigning.tar.gz"
158             ;;
159         *darwin*)
160-            echo "$(outdir_for_host "$1")/${DISTNAME}-${1}-unsigned.tar.gz"
161+            echo "$(outdir_for_host "$1")/${DISTNAME}-${1}-codesigning.tar.gz"

Sjors commented at 12:29 pm on December 3, 2024:

912377ac4999467be7dfd51481c38972fb1475dd: maybe call it -maintainers to reduce confusion with -unsigned?

A more generic term might also be handy in the future if e.g. we want to include an OTS timestamp that commits to the (pre codesigning, pgp signed?) guix hashes (with all architectures).

achow101 commented at 4:52 pm on December 3, 2024:

The codesigners are not necessarily maintainers. I don’t think it’s useful to make this broad when it has been extremely specific for codesigning for more than a decade.

laanwj commented at 10:05 am on February 11, 2025:

Yes that seems something to consider when and if we cross that bridge. Currently an .ots is already generated for the final SHA256SUMS at release time, not sure to move that to another phase in the process.

Sjors commented at 12:50 pm on December 3, 2024: member

In order to properly test this, you would have to provide the detached signatures and staple for this PR.

Reviewers then need to download it from some website. If you obtain the file via SSH from your own guix machine, macOS tries to be smart about it (at least my Intel mac used to do that).

0HOSTS="x86_64-w64-mingw32 x86_64-apple-darwin arm64-apple-darwin" ./contrib/guix/guix-build 
1...
2find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum

Guix hashes for macOS and Windows, before code-sign:

 0arm_64
 1e1d50cc856902e31e966f0e0d50ac732a6d8c7c080e9f9d50ab229d7503bd601  guix-build-ba67aa681e9b/output/arm64-apple-darwin/SHA256SUMS.part
 2462617a5476e946e10be8624d73b531041c8abf4628a35038d65b80534de768a  guix-build-ba67aa681e9b/output/arm64-apple-darwin/bitcoin-ba67aa681e9b-arm64-apple-darwin-codesigning.tar.gz
 32583965a7ecbcf48946bcb7676cf6b39a04cee44b34c6292d81cbb825f0d35df  guix-build-ba67aa681e9b/output/arm64-apple-darwin/bitcoin-ba67aa681e9b-arm64-apple-darwin-unsigned.tar.gz
 496f25391136c5e3f77b6dfb4e027aa1f43ccc91edf0237b9ec0c7b01a64b32f3  guix-build-ba67aa681e9b/output/arm64-apple-darwin/bitcoin-ba67aa681e9b-arm64-apple-darwin-unsigned.zip
 574d95312c8a33c65a1ea55c1d8392c58d77f78251af551926d4e913f12b45cac  guix-build-ba67aa681e9b/output/dist-archive/bitcoin-ba67aa681e9b.tar.gz
 61f457247d24466bc7f8faeb7f8faec80cadfed66ef68354c77a36ceba1127799  guix-build-ba67aa681e9b/output/x86_64-apple-darwin/SHA256SUMS.part
 7eafb67c89ed27e1dd216e2d300829c5bb22fbe6999839189441e3d64080b65f5  guix-build-ba67aa681e9b/output/x86_64-apple-darwin/bitcoin-ba67aa681e9b-x86_64-apple-darwin-codesigning.tar.gz
 80d9f7d7ef1f71b4c3072a0af44b374caf0a4646f4ba143f5440bbcf52c8fe614  guix-build-ba67aa681e9b/output/x86_64-apple-darwin/bitcoin-ba67aa681e9b-x86_64-apple-darwin-unsigned.tar.gz
 9a0337d08f8145ed4c8548086752b8c32766db1a0483573b44f95134cba9f3913  guix-build-ba67aa681e9b/output/x86_64-apple-darwin/bitcoin-ba67aa681e9b-x86_64-apple-darwin-unsigned.zip
10635b1e00cd6792faae60085f4d0ec71bb010756caa40f7241b05e1e3ef6aa18a  guix-build-ba67aa681e9b/output/x86_64-w64-mingw32/SHA256SUMS.part
1196326f5755ee14d74b74addc740e8e89c49ee65e4f56746a018e3aba39025642  guix-build-ba67aa681e9b/output/x86_64-w64-mingw32/bitcoin-ba67aa681e9b-win64-codesigning.tar.gz
120d1f7d39c4fcee02d763d85c7f14fe28233f4fe357192e54a227cb54843a8a0b  guix-build-ba67aa681e9b/output/x86_64-w64-mingw32/bitcoin-ba67aa681e9b-win64-debug.zip
13b3531bbeccd65d52cb73be3edc38f3aa4b1abe6373ad4e153e4c036a78f29b18  guix-build-ba67aa681e9b/output/x86_64-w64-mingw32/bitcoin-ba67aa681e9b-win64-setup-unsigned.exe
14e0a39aad96ac6fa7bf0957119bfca2a527e66f9991a71e84cc5c90864a9c833d  guix-build-ba67aa681e9b/output/x86_64-w64-mingw32/bitcoin-ba67aa681e9b-win64-unsigned.zip

achow101 commented at 4:53 pm on January 30, 2025: member

@fanquake @pinheadmz Can one of you please do a build and make detached sigs for this PR for testing?

in contrib/guix/libexec/build.sh:371 in 764f9d176d outdated

364@@ -382,6 +365,23 @@ mkdir -p "$DISTSRC"
365                     || ( rm -f "${OUTDIR}/${DISTNAME}-win64-codesigning.tar.gz" && exit 1 )
366             )
367             ;;
368+        *darwin*)

sipa commented at 6:47 pm on January 30, 2025:

In commit “build: Include all MacOS binaries for codesigning”

What is the effect of moving this code down? Will it pick up more artifacts that have been produced in between?

achow101 commented at 7:15 pm on January 30, 2025:

Yes, this makes it include the directory containing the binaries in the codesigning tarball.

in doc/release-process.md:170 in ba67aa681e outdated

163@@ -164,17 +164,17 @@ Then open a Pull Request to the [guix.sigs repository](https://github.com/bitcoi
164 
165 In the `guix-build-${VERSION}/output/x86_64-apple-darwin` and `guix-build-${VERSION}/output/arm64-apple-darwin` directories:
166 
167-    tar xf bitcoin-osx-unsigned.tar.gz
168-    ./detached-sig-create.sh /path/to/codesign.p12
169+    tar xf bitcoin-osx-codesigning.tar.gz
170+    ./detached-sig-create.sh /path/to/codesign.p12 /path/to/AuthKey_foo.p8 uuid
171     Enter the keychain password and authorize the signature
172     signature-osx.tar.gz will be created

pinheadmz commented at 5:37 pm on February 3, 2025:

output file is actually signature-osx-executable.tar.gz

achow101 commented at 5:48 pm on February 10, 2025:

Huh. It’s supposed to be either signature-osx-x86_64.tar.gz or signature-osx-arm64.tar.gz. Is file different on Mac vs Linux?

laanwj commented at 10:38 am on February 11, 2025:

Not sure if it’s a difference in the tool or the magic files used by default, but file output seems noticibly different between linux and mac:

mac (file-5.41):

0/bin/ls: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64
1- Mach-O 64-bit executable x86_64] [arm64e:Mach-O 64-bit executable arm64e
2- Mach-O 64-bit executable arm64e]
3/bin/ls (for architecture x86_64):	Mach-O 64-bit executable x86_64
4/bin/ls (for architecture arm64e):	Mach-O 64-bit executable arm64e

linux (file-5.45):

0/tmp/ls: Mach-O universal binary with 2 architectures: [x86_64:\012- Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE>] [\012- arm64e (caps: 0x2):\012- Mach-O 64-bit arm64e (caps: PAC00) executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE>]

linux (file-5.45, usingfile -r to get multiline)

0/tmp/ls: Mach-O universal binary with 2 architectures: [x86_64:
1- Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE>] [
2- arm64e (caps: 0x2):
3- Mach-O 64-bit arm64e (caps: PAC00) executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE>]

pinheadmz commented at 9:22 pm on February 11, 2025:

not an issue anymore on 46e44a35b85830a60cf622e039db19ccf1989008

pinheadmz commented at 6:05 pm on February 3, 2025: member

I’m hitting an error with guix-codesign. I am just focusing on HOSTS=arm64-apple-darwin, guix build of: ba67aa681e9b28a9992636fec4e06b26b3c3422e

SHASUMS.part:

0462617a5476e946e10be8624d73b531041c8abf4628a35038d65b80534de768a  arm64-apple-darwin/bitcoin-ba67aa681e9b-arm64-apple-darwin-codesigning.tar.gz
12583965a7ecbcf48946bcb7676cf6b39a04cee44b34c6292d81cbb825f0d35df  arm64-apple-darwin/bitcoin-ba67aa681e9b-arm64-apple-darwin-unsigned.tar.gz
296f25391136c5e3f77b6dfb4e027aa1f43ccc91edf0237b9ec0c7b01a64b32f3  arm64-apple-darwin/bitcoin-ba67aa681e9b-arm64-apple-darwin-unsigned.zip
374d95312c8a33c65a1ea55c1d8392c58d77f78251af551926d4e913f12b45cac  dist-archive/bitcoin-ba67aa681e9b.tar.gz

Detached code signatures (maybe): signature-osx-executable.tar.gz

However, attaching them is an issue:

 0zip@zip:~/bitcoin$ DETACHED_SIGS_REPO=../bitcoin-detached-sigs HOSTS=arm64-apple-darwin ./contrib/guix/guix-codesign
 1Checking that we can connect to the guix-daemon...
 2
 3Hint: If this hangs, you may want to try turning your guix-daemon off and on
 4      again.
 5
 6INFO: Codesigning ba67aa681e9b for platform triple arm64-apple-darwin:
 7      ...using reference timestamp: 1733177891
 8      ...from worktree directory: '/home/zip/bitcoin'
 9          ...bind-mounted in container to: '/bitcoin'
10      ...in build directory: '/home/zip/bitcoin/guix-build-ba67aa681e9b/distsrc-ba67aa681e9b-arm64-apple-darwin-codesigned'
11          ...bind-mounted in container to: '/distsrc-base/distsrc-ba67aa681e9b-arm64-apple-darwin-codesigned'
12      ...outputting in: '/home/zip/bitcoin/guix-build-ba67aa681e9b/output/arm64-apple-darwin-codesigned'
13          ...bind-mounted in container to: '/outdir-base/arm64-apple-darwin-codesigned'
14      ...using detached signatures in: '../bitcoin-detached-sigs'
15          ...bind-mounted in container to: '/detached-sigs'
16guix shell: error: symlink: No such file or directory: "/home/zip/bitcoin/guix-build-ba67aa681e9b/var/profiles/arm64-apple-darwin-codesigned"

Do I need to have bitcoin-detached-sigs checked out on a branch name that matches the build version?

pinheadmz commented at 6:54 pm on February 3, 2025: member

I got one step further by creating the directory its looking for in the last error:

$ mkdir -p /home/zip/bitcoin/guix-build-ba67aa681e9b/var/profiles/

this broke somewhere new…

 0$ DETACHED_SIGS_REPO=../bitcoin-detached-sigs HOSTS=arm64-apple-darwin FORCE_DIRTY_WORKTREE=1 ./contrib/guix/guix-codesign
 1Checking that we can connect to the guix-daemon...
 2
 3Hint: If this hangs, you may want to try turning your guix-daemon off and on
 4      again.
 5
 6INFO: Codesigning ba67aa681e9b for platform triple arm64-apple-darwin:
 7      ...using reference timestamp: 1733177891
 8      ...from worktree directory: '/home/zip/bitcoin'
 9          ...bind-mounted in container to: '/bitcoin'
10      ...in build directory: '/home/zip/bitcoin/guix-build-ba67aa681e9b/distsrc-ba67aa681e9b-arm64-apple-darwin-codesigned'
11          ...bind-mounted in container to: '/distsrc-base/distsrc-ba67aa681e9b-arm64-apple-darwin-codesigned'
12      ...outputting in: '/home/zip/bitcoin/guix-build-ba67aa681e9b/output/arm64-apple-darwin-codesigned'
13          ...bind-mounted in container to: '/outdir-base/arm64-apple-darwin-codesigned'
14      ...using detached signatures in: '../bitcoin-detached-sigs'
15          ...bind-mounted in container to: '/detached-sigs'
16Required environment variables as seen inside the container:
17    CODESIGNING_TARBALL: /outdir-base/arm64-apple-darwin/bitcoin-ba67aa681e9b-arm64-apple-darwin-codesigning.tar.gz
18    DETACHED_SIGS_REPO: /detached-sigs
19    DIST_ARCHIVE_BASE: /outdir-base/dist-archive
20    DISTNAME: bitcoin-ba67aa681e9b
21    HOST: arm64-apple-darwin
22    SOURCE_DATE_EPOCH: 1733177891
23    DISTSRC: /distsrc-base/distsrc-ba67aa681e9b-arm64-apple-darwin-codesigned
24    OUTDIR: /outdir-base/arm64-apple-darwin-codesigned
25Traceback (most recent call last):
26  File "/gnu/store/b5d90lfah4dplqxb5bi7srxf5w8iv13s-python-signapple-0.2.0-1.a9bf003/bin/.signapple-real", line 5, in <module>
27    sys.exit (mod.main ())
28  File "/gnu/store/b5d90lfah4dplqxb5bi7srxf5w8iv13s-python-signapple-0.2.0-1.a9bf003/lib/python3.10/site-packages/signapple/__init__.py", line 191, in main
29    args.func(args)
30  File "/gnu/store/b5d90lfah4dplqxb5bi7srxf5w8iv13s-python-signapple-0.2.0-1.a9bf003/lib/python3.10/site-packages/signapple/__init__.py", line 38, in apply
31    ret = apply_sig(args.filename, args.sig)
32  File "/gnu/store/b5d90lfah4dplqxb5bi7srxf5w8iv13s-python-signapple-0.2.0-1.a9bf003/lib/python3.10/site-packages/signapple/sign.py", line 1176, in apply_sig
33    shutil.copyfile(sig_file_path, file_out_path)
34  File "/gnu/store/z193j1jnz80h56fbv6nic6mh34b4bb1j-python-3.10.7/lib/python3.10/shutil.py", line 254, in copyfile
35    with open(src, 'rb') as fsrc:
36FileNotFoundError: [Errno 2] No such file or directory: 'codesignatures/osx/arm64-apple-darwin/dist/Bitcoin-Qt.app/'

achow101 force-pushed on Feb 10, 2025

achow101 commented at 9:05 pm on February 10, 2025: member

Pushed a fix for the wrong architecture detection.

Sjors commented at 8:36 am on February 11, 2025: member

Guix hashes for macOS and Windows, before code-sign:

 0bd11279800610b70a1feed4451d9fa3a137ed75f26c794363c5ef82d820c592e  guix-build-46e44a35b858/output/arm64-apple-darwin/SHA256SUMS.part
 13a911d1a009222c042a84864dccd58462ce3167ea5f407830bf98d370fa356e4  guix-build-46e44a35b858/output/arm64-apple-darwin/bitcoin-46e44a35b858-arm64-apple-darwin-codesigning.tar.gz
 22b1c4d096f27ae2a650ce3fe954304c53bb51b7ddac5dd533cabcc862a75f684  guix-build-46e44a35b858/output/arm64-apple-darwin/bitcoin-46e44a35b858-arm64-apple-darwin-unsigned.tar.gz
 318c4fe6b004b0b9685671d1a60b146ce00bafe47591ff337ad3af08d8ea55e42  guix-build-46e44a35b858/output/arm64-apple-darwin/bitcoin-46e44a35b858-arm64-apple-darwin-unsigned.zip
 4e920044a3cf85974b337a5a7e13c35cf8633d5083cb9ab8ba46c3b0f24019a1c  guix-build-46e44a35b858/output/dist-archive/bitcoin-46e44a35b858.tar.gz
 571e501ec189b3d561f6f07d52b6ec3ab28eba81600a8ebbde9437a13ce8818dc  guix-build-46e44a35b858/output/x86_64-apple-darwin/SHA256SUMS.part
 6ccbb4b94720896282ecc6f1a7a4ad8a2de05262b71abbe32bd48ac83bd41f666  guix-build-46e44a35b858/output/x86_64-apple-darwin/bitcoin-46e44a35b858-x86_64-apple-darwin-codesigning.tar.gz
 7c2125e67f68fc5c1c5d1bb835e7ef886a2025a59a5476173bc511646c48ef7cb  guix-build-46e44a35b858/output/x86_64-apple-darwin/bitcoin-46e44a35b858-x86_64-apple-darwin-unsigned.tar.gz
 845cc411f916e6ba617875d30494c8baa6e7974c82b0652449f3422009ff7ca28  guix-build-46e44a35b858/output/x86_64-apple-darwin/bitcoin-46e44a35b858-x86_64-apple-darwin-unsigned.zip
 977e0993c4a93076583f9a90bfac8afb92770363dc624745659339c6a0335497f  guix-build-46e44a35b858/output/x86_64-w64-mingw32/SHA256SUMS.part
10388d2eb388392b5d234ed72fd93ac393e55c2b3c76a5c2796d1c54921c469b7f  guix-build-46e44a35b858/output/x86_64-w64-mingw32/bitcoin-46e44a35b858-win64-codesigning.tar.gz
1121829ed3fd887adf9e4ae337189c984f2b4f91e76d8bf57f644c9d6f600968c4  guix-build-46e44a35b858/output/x86_64-w64-mingw32/bitcoin-46e44a35b858-win64-debug.zip
12184eef2b7fc6eb72f0578b510b817775615474b81b359de4ab0769c009faf75b  guix-build-46e44a35b858/output/x86_64-w64-mingw32/bitcoin-46e44a35b858-win64-setup-unsigned.exe
1308841a37cd886a94553acc723a0e3343dd8e00e7b3dd00169ac8eb1a84b03b46  guix-build-46e44a35b858/output/x86_64-w64-mingw32/bitcoin-46e44a35b858-win64-unsigned.zip

in doc/release-process.md:176 in 46e44a35b8 outdated

175 
176 In the `guix-build-${VERSION}/output/x86_64-w64-mingw32` directory:
177 
178-    tar xf bitcoin-win-unsigned.tar.gz
179-    ./detached-sig-create.sh -key /path/to/codesign.key
180+    tar xf bitcoin-win-codesigning.tar.gz

hebasto commented at 8:45 am on February 11, 2025:

0    tar xf bitcoin-${VERSION}-win64-codesigning.tar.gz

achow101 commented at 1:16 am on February 12, 2025:

If I need to retouch

achow101 commented at 1:48 am on February 12, 2025:

Done

in doc/release-process.md:167 in 46e44a35b8 outdated

163@@ -164,17 +164,17 @@ Then open a Pull Request to the [guix.sigs repository](https://github.com/bitcoi
164 
165 In the `guix-build-${VERSION}/output/x86_64-apple-darwin` and `guix-build-${VERSION}/output/arm64-apple-darwin` directories:
166 
167-    tar xf bitcoin-osx-unsigned.tar.gz
168-    ./detached-sig-create.sh /path/to/codesign.p12
169+    tar xf bitcoin-osx-codesigning.tar.gz

hebasto commented at 9:07 am on February 11, 2025:

0    tar xf bitcoin-${VERSION}-${ARCH}-apple-darwin-codesigning.tar.gz

achow101 commented at 1:16 am on February 12, 2025:

If I need to retouch

achow101 commented at 1:48 am on February 12, 2025:

Done

hebasto commented at 10:29 am on February 11, 2025: member

Concept ACK 46e44a35b85830a60cf622e039db19ccf1989008.

I have reviewed the code and it looks OK. However, I am not entirely confident in 8400ada306063f1412ef3ace57e255783db879ef due to my lack of familiarity with the signapple tool.

Additionally, I did not review the changes to the signapple tool itself.

pinheadmz approved

pinheadmz commented at 9:11 pm on February 11, 2025: member

ACK 46e44a35b85830a60cf622e039db19ccf1989008

Tested on arm64/macos, but did not review code or test other platforms. This updated process closes the referenced issues and successfully creates signed binaries for bitcoind, bitcoin-cli and all other utilities including Bitcoin-Qt.

Detached sigs (`tar xf` and commit locally in `bitcoin-detached-sigs` to test):

signature-osx-arm64.tar.gz

Attestations:

all.SHA256SUMS

0
1504b22387c634bcf78846830b8f53359e54d526b2f0e976631a0bbd293f0353c  bitcoin-46e44a35b858-arm64-apple-darwin.tar.gz
2787fd1bd670ce5b903d174ee715a532365c8cc426278020877ef1616c8befa57  bitcoin-46e44a35b858-arm64-apple-darwin.zip
33a911d1a009222c042a84864dccd58462ce3167ea5f407830bf98d370fa356e4  bitcoin-46e44a35b858-arm64-apple-darwin-codesigning.tar.gz
42b1c4d096f27ae2a650ce3fe954304c53bb51b7ddac5dd533cabcc862a75f684  bitcoin-46e44a35b858-arm64-apple-darwin-unsigned.tar.gz
518c4fe6b004b0b9685671d1a60b146ce00bafe47591ff337ad3af08d8ea55e42  bitcoin-46e44a35b858-arm64-apple-darwin-unsigned.zip
67f92d478c82e193da4578c19e37fa7bebed7b23eb9745ace8679f1503a2d25ed  bitcoin-46e44a35b858-codesignatures-001c1794ae89.tar.gz
7e920044a3cf85974b337a5a7e13c35cf8633d5083cb9ab8ba46c3b0f24019a1c  bitcoin-46e44a35b858.tar.gz

noncodesigned.SHA256SUMS

03a911d1a009222c042a84864dccd58462ce3167ea5f407830bf98d370fa356e4  bitcoin-46e44a35b858-arm64-apple-darwin-codesigning.tar.gz
12b1c4d096f27ae2a650ce3fe954304c53bb51b7ddac5dd533cabcc862a75f684  bitcoin-46e44a35b858-arm64-apple-darwin-unsigned.tar.gz
218c4fe6b004b0b9685671d1a60b146ce00bafe47591ff337ad3af08d8ea55e42  bitcoin-46e44a35b858-arm64-apple-darwin-unsigned.zip
3e920044a3cf85974b337a5a7e13c35cf8633d5083cb9ab8ba46c3b0f24019a1c  bitcoin-46e44a35b858.tar.gz

 0-----BEGIN PGP SIGNED MESSAGE-----
 1Hash: SHA256
 2
 3ACK 46e44a35b85830a60cf622e039db19ccf1989008
 4-----BEGIN PGP SIGNATURE-----
 5
 6iQIzBAEBCAAdFiEE5hdzzW4BBA4vG9eM5+KYS2KJyToFAmervD4ACgkQ5+KYS2KJ
 7yTqW+w//XZDjfkldmMEbEOs8fpwv38eHly9Uha8hVscixHgG6L1QkTfMimomONzD
 8m0N3cOT13sEXJkuyp1ztnZoklQ2FfDcceKiN8Kb455esPtYsNrR5SyMDx3O+HYTF
 92WxSO7ktfjU7G+ZaXgHB/+xGUrXQIWNkP4b1Z+QuHtu3Sc+3TnZS2mtjvpXc1go+
10m8Rnz/hqYn1F1ePn25AMsixfdt99QUw2Z/oti3HDfiG136lHpZt0MbixCk1gDnXs
11NDSloElhUgTLyosBfdU+5KLbjsB1DKz+N2dsQ8rHTpuXcau7HPm5IAdPheSIhS5Z
12OC1z/h9/EhgOYSlAbyURovTYa0Cpz/faGNhWWIw6v+t6UBFX1Sn4fPt7X3S8k0d+
13oya7oDFTyo2NZVyM8l9+dssZaJByUOdJKYloF00g26fRA+ELaX3PxXIB/cFWNiss
14UgPc5C/pfvjq/Cr7Zwb0XdHP8U0lTbu8Aqk93xxfcKx5MVdjTnlI2JF8nbn0/eYQ
15C1GjVdHCwLR/nM6aHatEFy04WFUUeK3r7pUPRY39B/fPS31N29q5UpbvvAqihZLQ
16nVqHCCxCNrL2Ph+PwjqQsvXchz97gizQu6OKbX3DcRWstg6EwRQ3K2CG/k7MAvtw
17NnEtOMWHeXO8qW3MQkZj4IDCjTKU/OKab+jf+F0reSkZ1Oc1E54=
18=NUrf
19-----END PGP SIGNATURE-----

pinheadmz’s public key is on keybase

DrahtBot requested review from hebasto on Feb 11, 2025

pinheadmz commented at 9:15 pm on February 11, 2025: member

Bonus verbose code sign verification of bitcoind:

 0codesign -dv --verbose=4 /Users/matthewzipkin/Desktop/work/bitcoin/guix-build-46e44a35b858/output/arm64-apple-darwin/arm64-apple-darwin-codesigned/bitcoin-46e44a35b858/bin/bitcoind 
 1Executable=/Users/matthewzipkin/Desktop/work/bitcoin/guix-build-46e44a35b858/output/arm64-apple-darwin/arm64-apple-darwin-codesigned/bitcoin-46e44a35b858/bin/bitcoind
 2Identifier=bitcoind
 3Format=Mach-O thin (arm64)
 4CodeDirectory v=20500 size=23284 flags=0x10000(runtime) hashes=722+2 location=embedded
 5VersionPlatform=1
 6VersionMin=851968
 7VersionSDK=917504
 8Hash type=sha256 size=32
 9CandidateCDHash sha256=530f57819a0cd018bee3712eed759e5abe6f3122
10CandidateCDHashFull sha256=530f57819a0cd018bee3712eed759e5abe6f31228ef865bd7ee6dc81c47f248b
11Hash choices=sha256
12CMSDigest=530f57819a0cd018bee3712eed759e5abe6f31228ef865bd7ee6dc81c47f248b
13CMSDigestType=2
14Page size=16384
15CDHash=530f57819a0cd018bee3712eed759e5abe6f3122
16Signature size=9008
17Authority=Developer ID Application: Bitcoin Core Code Signing Association (YZC7WH3MRU)
18Authority=Developer ID Certification Authority
19Authority=Apple Root CA
20Timestamp=Feb 11, 2025 at 3:59:43 PM
21Info.plist=not bound
22TeamIdentifier=YZC7WH3MRU
23Runtime Version=14.0.0
24Sealed Resources=none
25Internal requirements count=1 size=104

achow101 commented at 1:25 am on February 12, 2025: member

Windows code signature: signature-win.tar.gz

It looks like I have a mismatch.

 0$ find guix-build-46e44a35b858/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
 1c92e7d0b4d0d1f929bfe8d61e15a953738725d530fc64eb936634571c17936b7  guix-build-46e44a35b858/output/aarch64-linux-gnu/SHA256SUMS.part
 2ad3992a66f9de8039cabbc9f222f7369f8002fc5350a01b03a3194d574100770  guix-build-46e44a35b858/output/aarch64-linux-gnu/bitcoin-46e44a35b858-aarch64-linux-gnu-debug.tar.gz
 3e009fd02c2cc0db9031570ef32b36fa9e16194759ccbca35f3a8f8dacd0d30b2  guix-build-46e44a35b858/output/aarch64-linux-gnu/bitcoin-46e44a35b858-aarch64-linux-gnu.tar.gz
 4a5ad882af28fe5fbdd8cc5d2267ef93ec34bd374e6cde92b798312014d11d47e  guix-build-46e44a35b858/output/arm-linux-gnueabihf/SHA256SUMS.part
 5b736932c664a8799930e9ed308f318d5911aee2ef8e708ea0467cd89b859d898  guix-build-46e44a35b858/output/arm-linux-gnueabihf/bitcoin-46e44a35b858-arm-linux-gnueabihf-debug.tar.gz
 6c03b4391dedbdbf3a32a1ec7b75193cbbc01dd2ef85e562fbc8eba26039158a3  guix-build-46e44a35b858/output/arm-linux-gnueabihf/bitcoin-46e44a35b858-arm-linux-gnueabihf.tar.gz
 704fbb5179da959e496596c1304a8a14ab4ed198b25dcf4abc62ec7dbaa1ba6a0  guix-build-46e44a35b858/output/arm64-apple-darwin-codesigned/SHA256SUMS.part
 8250ba8b070da5fbdba7010c5a8ef135b422dd6ca5c408b000b1184b5b5bcfa17  guix-build-46e44a35b858/output/arm64-apple-darwin-codesigned/bitcoin-46e44a35b858-arm64-apple-darwin.tar.gz
 9787fd1bd670ce5b903d174ee715a532365c8cc426278020877ef1616c8befa57  guix-build-46e44a35b858/output/arm64-apple-darwin-codesigned/bitcoin-46e44a35b858-arm64-apple-darwin.zip
10bd11279800610b70a1feed4451d9fa3a137ed75f26c794363c5ef82d820c592e  guix-build-46e44a35b858/output/arm64-apple-darwin/SHA256SUMS.part
113a911d1a009222c042a84864dccd58462ce3167ea5f407830bf98d370fa356e4  guix-build-46e44a35b858/output/arm64-apple-darwin/bitcoin-46e44a35b858-arm64-apple-darwin-codesigning.tar.gz
122b1c4d096f27ae2a650ce3fe954304c53bb51b7ddac5dd533cabcc862a75f684  guix-build-46e44a35b858/output/arm64-apple-darwin/bitcoin-46e44a35b858-arm64-apple-darwin-unsigned.tar.gz
1318c4fe6b004b0b9685671d1a60b146ce00bafe47591ff337ad3af08d8ea55e42  guix-build-46e44a35b858/output/arm64-apple-darwin/bitcoin-46e44a35b858-arm64-apple-darwin-unsigned.zip
142927af1efc846fff95b18e0411d6e40f26777e1a86a63023dfd56e6b984aedac  guix-build-46e44a35b858/output/dist-archive/bitcoin-46e44a35b858-codesignatures-5d627c88c523.tar.gz
15e920044a3cf85974b337a5a7e13c35cf8633d5083cb9ab8ba46c3b0f24019a1c  guix-build-46e44a35b858/output/dist-archive/bitcoin-46e44a35b858.tar.gz
1689a4bae02f17b261887dbbc6196d590e0900a83a7d5e3fb4ec747457bd031bb3  guix-build-46e44a35b858/output/powerpc64-linux-gnu/SHA256SUMS.part
17158bba9ccf1c7400a8ce6d32a81df606a05ff1ae6bc63f84a66f7e1eafac8bfd  guix-build-46e44a35b858/output/powerpc64-linux-gnu/bitcoin-46e44a35b858-powerpc64-linux-gnu-debug.tar.gz
181660a1dadc56b2e8c1c77f5534ffd4e1b3a020d6cb7764461e0e58af1846406c  guix-build-46e44a35b858/output/powerpc64-linux-gnu/bitcoin-46e44a35b858-powerpc64-linux-gnu.tar.gz
193bc7d8eee5240d2301df4eed1d55605e01f9cb72acbbaa217fed9c0a581ef0c8  guix-build-46e44a35b858/output/riscv64-linux-gnu/SHA256SUMS.part
207011c630f296440c0f964f341bf0e5037ed46955eb2e6dc5d07502c758e41766  guix-build-46e44a35b858/output/riscv64-linux-gnu/bitcoin-46e44a35b858-riscv64-linux-gnu-debug.tar.gz
219523d9f7bba2c7392cfe2c559d62d8be10a0011f6c8bc0633248ed8152dc1635  guix-build-46e44a35b858/output/riscv64-linux-gnu/bitcoin-46e44a35b858-riscv64-linux-gnu.tar.gz
2271e501ec189b3d561f6f07d52b6ec3ab28eba81600a8ebbde9437a13ce8818dc  guix-build-46e44a35b858/output/x86_64-apple-darwin/SHA256SUMS.part
23ccbb4b94720896282ecc6f1a7a4ad8a2de05262b71abbe32bd48ac83bd41f666  guix-build-46e44a35b858/output/x86_64-apple-darwin/bitcoin-46e44a35b858-x86_64-apple-darwin-codesigning.tar.gz
24c2125e67f68fc5c1c5d1bb835e7ef886a2025a59a5476173bc511646c48ef7cb  guix-build-46e44a35b858/output/x86_64-apple-darwin/bitcoin-46e44a35b858-x86_64-apple-darwin-unsigned.tar.gz
2545cc411f916e6ba617875d30494c8baa6e7974c82b0652449f3422009ff7ca28  guix-build-46e44a35b858/output/x86_64-apple-darwin/bitcoin-46e44a35b858-x86_64-apple-darwin-unsigned.zip
268396003dddb143fe8e08634bd3fffe6088a6edf82def1f0361d0090e9430bbfd  guix-build-46e44a35b858/output/x86_64-linux-gnu/SHA256SUMS.part
27d2fad841094103b4cc3cf2976a743e662956054dba591abd3bbe8be11847d0a8  guix-build-46e44a35b858/output/x86_64-linux-gnu/bitcoin-46e44a35b858-x86_64-linux-gnu-debug.tar.gz
28514ea670e6facefc08d6972b768a4cbdb298b4cf3d9dbaa488ff6a5dce1290df  guix-build-46e44a35b858/output/x86_64-linux-gnu/bitcoin-46e44a35b858-x86_64-linux-gnu.tar.gz
2961f7b6847c48bad5a750f591f3a786b5a41a5812240e6f6f79e8643650ae5211  guix-build-46e44a35b858/output/x86_64-w64-mingw32-codesigned/SHA256SUMS.part
30d3476edbe604a417d1428110ec63c08ace43c0e1b245b4bcbae86ac17ffb2df2  guix-build-46e44a35b858/output/x86_64-w64-mingw32-codesigned/bitcoin-46e44a35b858-win64-setup.exe
319c951956534b39b98ffe32183462c41984eeb872c96dbc9ee4ed1d01ce5effdb  guix-build-46e44a35b858/output/x86_64-w64-mingw32-codesigned/bitcoin-46e44a35b858-win64.zip
3277e0993c4a93076583f9a90bfac8afb92770363dc624745659339c6a0335497f  guix-build-46e44a35b858/output/x86_64-w64-mingw32/SHA256SUMS.part
33388d2eb388392b5d234ed72fd93ac393e55c2b3c76a5c2796d1c54921c469b7f  guix-build-46e44a35b858/output/x86_64-w64-mingw32/bitcoin-46e44a35b858-win64-codesigning.tar.gz
3421829ed3fd887adf9e4ae337189c984f2b4f91e76d8bf57f644c9d6f600968c4  guix-build-46e44a35b858/output/x86_64-w64-mingw32/bitcoin-46e44a35b858-win64-debug.zip
35184eef2b7fc6eb72f0578b510b817775615474b81b359de4ab0769c009faf75b  guix-build-46e44a35b858/output/x86_64-w64-mingw32/bitcoin-46e44a35b858-win64-setup-unsigned.exe
3608841a37cd886a94553acc723a0e3343dd8e00e7b3dd00169ac8eb1a84b03b46  guix-build-46e44a35b858/output/x86_64-w64-mingw32/bitcoin-46e44a35b858-win64-unsigned.zip

Could someone else do a codesigned build so we can compare?

@pinheadmz @fanquake Could one of you also make a x86_64 MacOS codesignature?

guix: Rename unsigned.tar.gz to codesigning.tar.gz

The tarballs used for codesigning are more than merely unsigned, they
also contain scripts and other data for codesigning. Rename them to
codesigning.tar.gz to distinguish from tarballs containing actually just
the unsigned binaries.

c214e5268f

guix: Rename MacOS binaries to unsigned.tar.gz

The MacOS binaries are unsigned and therefore also unusable on MacOS.
Indicate as such by naming the tarball "unsigned".

d9d49cd533

guix: Rename Windows unsigned binaries to unsigned.zip

As codesigned binaries will be published, the unsigned ones should be
clearly marked as such.

4e5c9ceb9d

build: Include all MacOS binaries for codesigning dd4ec840ee

build: Include all Windows binaries for codesigning e8b3c44da6

achow101 force-pushed on Feb 12, 2025

achow101 commented at 1:48 am on February 12, 2025: member

I believe I identified the non-determinism, pushed a fix for that.

achow101 commented at 2:31 am on February 12, 2025: member

Windows code signature for 096525e92cc2f5a4318bae13cedd2cf36b928d5f: signature-win.tar.gz

Non-Codesigned guix hashes

 0$ find guix-build-096525e92cc2/output -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
 1bff1786e0fe30ac2c70eb8abd39af1764eff33aef98c92cccd74b70db0cf63d8  guix-build-096525e92cc2/output/aarch64-linux-gnu/SHA256SUMS.part
 2d7308491e32e076f40e58aaa9092ceae8a16b39e66937af72bdc8b879164f304  guix-build-096525e92cc2/output/aarch64-linux-gnu/bitcoin-096525e92cc2-aarch64-linux-gnu-debug.tar.gz
 30351c42b5adf4759fd8441feb9da561d9066bbbb030d47ffa33b30eba6e9d247  guix-build-096525e92cc2/output/aarch64-linux-gnu/bitcoin-096525e92cc2-aarch64-linux-gnu.tar.gz
 4b37a5e594354549e08d779d2e67cc2d11dd9b8a2356d8cb4ebf8cc42467b5c50  guix-build-096525e92cc2/output/arm-linux-gnueabihf/SHA256SUMS.part
 59a4f902ff10ff24944a314708e59394033e72eb4bfbbacafe0bb4c74f0079be4  guix-build-096525e92cc2/output/arm-linux-gnueabihf/bitcoin-096525e92cc2-arm-linux-gnueabihf-debug.tar.gz
 615f2575345370655a0e5c57ffed9f388999f9795f77ac34e99b68a86116ba721  guix-build-096525e92cc2/output/arm-linux-gnueabihf/bitcoin-096525e92cc2-arm-linux-gnueabihf.tar.gz
 77061af7740406c76b1e942a0b3ba03df1e567b39d05032fea0bf56c20e79b456  guix-build-096525e92cc2/output/arm64-apple-darwin/SHA256SUMS.part
 89ac6138dc86f40b92f83d571b44d0996e3fca52d5a2ae670ed4ed3978c668695  guix-build-096525e92cc2/output/arm64-apple-darwin/bitcoin-096525e92cc2-arm64-apple-darwin-codesigning.tar.gz
 930b530f4982119c135b3667987423b3993e42e925ebb34a74b0e15b7180cad4e  guix-build-096525e92cc2/output/arm64-apple-darwin/bitcoin-096525e92cc2-arm64-apple-darwin-unsigned.tar.gz
102b08474b102d654b1a2e68989d73d108b3c3484d49a1fa2b214287ff28b7abd8  guix-build-096525e92cc2/output/arm64-apple-darwin/bitcoin-096525e92cc2-arm64-apple-darwin-unsigned.zip
11504608f78dc2be04bda41dc212d3cbb09afd270485884b03b426ad596b4b3611  guix-build-096525e92cc2/output/dist-archive/bitcoin-096525e92cc2.tar.gz
1271d6fb70f108b3ad9e602a48962697ddba4c4c063509181634bc2d8ca6f8e0bf  guix-build-096525e92cc2/output/powerpc64-linux-gnu/SHA256SUMS.part
13d7a111456b3d3ed3131c8e0242906742e59aa1143fe3106037d159d39d37e7ef  guix-build-096525e92cc2/output/powerpc64-linux-gnu/bitcoin-096525e92cc2-powerpc64-linux-gnu-debug.tar.gz
14c4d06c303dfd858bf0eda294e8bbcf4f3f0ce9bb011df6745afa74be3f3eb615  guix-build-096525e92cc2/output/powerpc64-linux-gnu/bitcoin-096525e92cc2-powerpc64-linux-gnu.tar.gz
1548bb69da2f4544fe538e8dea8b321bf22dfdcccc67a5c2219e9f014090fdac71  guix-build-096525e92cc2/output/riscv64-linux-gnu/SHA256SUMS.part
16b24748afc5bf792aab5ecf4d33fdcf8802c943011de386b5689943ef586d1f7b  guix-build-096525e92cc2/output/riscv64-linux-gnu/bitcoin-096525e92cc2-riscv64-linux-gnu-debug.tar.gz
1754207d89d1db350f54db43c124f52ea06d099dba06480f292b95c65492ac0c09  guix-build-096525e92cc2/output/riscv64-linux-gnu/bitcoin-096525e92cc2-riscv64-linux-gnu.tar.gz
180b2a78b82c3c64d4e9dc4323581b2d2472f938dbf00726ab324c3b78534273b2  guix-build-096525e92cc2/output/x86_64-apple-darwin/SHA256SUMS.part
199eb6801b9d5bfea3ae9da78213f940fb46d95e444ef59c5104f5a52ad5649b0c  guix-build-096525e92cc2/output/x86_64-apple-darwin/bitcoin-096525e92cc2-x86_64-apple-darwin-codesigning.tar.gz
20d2871b137d4604751071a3d292d9a4907ab686e0d5caddd70339184ba1e01432  guix-build-096525e92cc2/output/x86_64-apple-darwin/bitcoin-096525e92cc2-x86_64-apple-darwin-unsigned.tar.gz
214d02ea03f8419e91f2ba4511e05d1745eccfe2465ee316830155edaa772707c5  guix-build-096525e92cc2/output/x86_64-apple-darwin/bitcoin-096525e92cc2-x86_64-apple-darwin-unsigned.zip
22af8ad1cfec48a5ebf202d72f931929bfea9d0343197b8e849f69075de2f5d170  guix-build-096525e92cc2/output/x86_64-linux-gnu/SHA256SUMS.part
239cc51c4116fa0ee5f0305655a7a4ac84eb881a1a33952b6612bd8855fbe4e903  guix-build-096525e92cc2/output/x86_64-linux-gnu/bitcoin-096525e92cc2-x86_64-linux-gnu-debug.tar.gz
24f4f17391172b15ce57886e55e10e5d8b71729edcc68f9937e45e20b8fdbced13  guix-build-096525e92cc2/output/x86_64-linux-gnu/bitcoin-096525e92cc2-x86_64-linux-gnu.tar.gz
25685edc8de33aa04a0efd956a511ef968957cf6f0a40f0dffea01b6736824b97d  guix-build-096525e92cc2/output/x86_64-w64-mingw32/SHA256SUMS.part
262432dac2e2a366f078cf3629e47501dd35ffd63814e764e241fbfcf9915b22be  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-codesigning.tar.gz
2701693e18af845e1c55f0fa60d763fd94d9a2b6d8c876b84c7d1bd592fe9904d0  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-debug.zip
2876d645f644ab987c1b68b71001a7af24d823deb96cce657a0af06be0afbcb129  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-setup-unsigned.exe
290d9e3e12f89f892dcd2ba0d818ddb28938f1baaafae9a3f884a358ad23ff3aa4  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-unsigned.zip

Windows code signed hashes

0$ find guix-build-096525e92cc2/output -wholename "*codesigned*" -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
1588d29b9259aa65684cdf868e7e7deef2c5aee0f1355f8dfaa2fd34aaf3b9eab  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/SHA256SUMS.part
2404261ab457c31e13511e1268b63e926cc4bed2b8dbcf8ab7d22d4e4fbb423c0  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64-setup.exe
31c6ff7dfd0f410065032cfaa10090842f90ca08e7bb8930a157f54a241195927  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64.zip

pinheadmz commented at 2:42 am on February 12, 2025: member

New sigs for 096525e92cc2f5a4318bae13cedd2cf36b928d5f:

signature-osx-arm64.tar.gz

signature-osx-x86_64.tar.gz

All osx

 0
 1111016205f0a2ac732feb934acb3e8a36d5251f119d8fa9215790310ba46c31d  bitcoin-096525e92cc2-arm64-apple-darwin.tar.gz
 2a1228ddcb27fc5802ff5cab8f99026286070b4938aba08982f8e49d8e01b49cf  bitcoin-096525e92cc2-arm64-apple-darwin.zip
 39ac6138dc86f40b92f83d571b44d0996e3fca52d5a2ae670ed4ed3978c668695  bitcoin-096525e92cc2-arm64-apple-darwin-codesigning.tar.gz
 430b530f4982119c135b3667987423b3993e42e925ebb34a74b0e15b7180cad4e  bitcoin-096525e92cc2-arm64-apple-darwin-unsigned.tar.gz
 52b08474b102d654b1a2e68989d73d108b3c3484d49a1fa2b214287ff28b7abd8  bitcoin-096525e92cc2-arm64-apple-darwin-unsigned.zip
 652ac4e8dff12a625a263641c3b921326cf48f0759e6cd35a08131a672043c01e  bitcoin-096525e92cc2-codesignatures-318c01f40794.tar.gz
 7504608f78dc2be04bda41dc212d3cbb09afd270485884b03b426ad596b4b3611  bitcoin-096525e92cc2.tar.gz
 86afec5020c65f602a8028e5fd1b42d196f04805c2240c56565400d750abe97f5  bitcoin-096525e92cc2-x86_64-apple-darwin.tar.gz
 9c39372f58828349008a4d66d493a7e1b23668cbe1af807aa39888ca24928e599  bitcoin-096525e92cc2-x86_64-apple-darwin.zip
109eb6801b9d5bfea3ae9da78213f940fb46d95e444ef59c5104f5a52ad5649b0c  bitcoin-096525e92cc2-x86_64-apple-darwin-codesigning.tar.gz
11d2871b137d4604751071a3d292d9a4907ab686e0d5caddd70339184ba1e01432  bitcoin-096525e92cc2-x86_64-apple-darwin-unsigned.tar.gz
124d02ea03f8419e91f2ba4511e05d1745eccfe2465ee316830155edaa772707c5  bitcoin-096525e92cc2-x86_64-apple-darwin-unsigned.zip

achow101 commented at 2:58 am on February 12, 2025: member

Looks like everything matches:

0$ find guix-build-096525e92cc2/output -wholename "*codesigned*" -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
1b329c253e4c791d5622adc16ed0c06759ce29309e7d72221c76de4becb58b409  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/SHA256SUMS.part
2111016205f0a2ac732feb934acb3e8a36d5251f119d8fa9215790310ba46c31d  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/bitcoin-096525e92cc2-arm64-apple-darwin.tar.gz
3a1228ddcb27fc5802ff5cab8f99026286070b4938aba08982f8e49d8e01b49cf  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/bitcoin-096525e92cc2-arm64-apple-darwin.zip
4a24460628df8d6df547acbbfd74bd74aafc40ebc689d26ae9956f7ab0f9326e8  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/SHA256SUMS.part
56afec5020c65f602a8028e5fd1b42d196f04805c2240c56565400d750abe97f5  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.tar.gz
6c39372f58828349008a4d66d493a7e1b23668cbe1af807aa39888ca24928e599  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.zip

Sjors commented at 9:04 am on February 12, 2025: member

I’m unable to apply the code signatures. E.g. for arm64:

 0HOSTS="arm64-apple-darwin" ./contrib/guix/guix-codesign 
 1Checking that we can connect to the guix-daemon...
 2
 3Hint: If this hangs, you may want to try turning your guix-daemon off and on
 4      again.
 5
 6INFO: Codesigning 096525e92cc2 for platform triple arm64-apple-darwin:
 7      ...using reference timestamp: 1733177891
 8      ...from worktree directory: '/home/sjors/bitcoin'
 9          ...bind-mounted in container to: '/bitcoin'
10      ...in build directory: '/home/sjors/bitcoin/guix-build-096525e92cc2/distsrc-096525e92cc2-arm64-apple-darwin-codesigned'
11          ...bind-mounted in container to: '/distsrc-base/distsrc-096525e92cc2-arm64-apple-darwin-codesigned'
12      ...outputting in: '/home/sjors/bitcoin/guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned'
13          ...bind-mounted in container to: '/outdir-base/arm64-apple-darwin-codesigned'
14      ...using detached signatures in: '/home/sjors/bitcoin-detached-sigs'
15          ...bind-mounted in container to: '/detached-sigs'
16Required environment variables as seen inside the container:
17    CODESIGNING_TARBALL: /outdir-base/arm64-apple-darwin/bitcoin-096525e92cc2-arm64-apple-darwin-codesigning.tar.gz
18    DETACHED_SIGS_REPO: /detached-sigs
19    DIST_ARCHIVE_BASE: /outdir-base/dist-archive
20    DISTNAME: bitcoin-096525e92cc2
21    HOST: arm64-apple-darwin
22    SOURCE_DATE_EPOCH: 1733177891
23    DISTSRC: /distsrc-base/distsrc-096525e92cc2-arm64-apple-darwin-codesigned
24    OUTDIR: /outdir-base/arm64-apple-darwin-codesigned
25Traceback (most recent call last):
26  File "/gnu/store/jh33r2k4x0kakg4apbb2id0w8xmjxbxk-python-signapple-0.2.0-1.a9bf003/bin/.signapple-real", line 5, in <module>
27    sys.exit (mod.main ())
28  File "/gnu/store/jh33r2k4x0kakg4apbb2id0w8xmjxbxk-python-signapple-0.2.0-1.a9bf003/lib/python3.10/site-packages/signapple/__init__.py", line 191, in main
29    args.func(args)
30  File "/gnu/store/jh33r2k4x0kakg4apbb2id0w8xmjxbxk-python-signapple-0.2.0-1.a9bf003/lib/python3.10/site-packages/signapple/__init__.py", line 38, in apply
31    ret = apply_sig(args.filename, args.sig)
32  File "/gnu/store/jh33r2k4x0kakg4apbb2id0w8xmjxbxk-python-signapple-0.2.0-1.a9bf003/lib/python3.10/site-packages/signapple/sign.py", line 1176, in apply_sig
33    shutil.copyfile(sig_file_path, file_out_path)
34  File "/gnu/store/yvcl464i2vxpcq67xqhvmlkpgfbgibhb-python-3.10.7/lib/python3.10/shutil.py", line 254, in copyfile
35    with open(src, 'rb') as fsrc:
36FileNotFoundError: [Errno 2] No such file or directory: 'codesignatures/osx/arm64-apple-darwin/dist/Bitcoin-Qt.app/'

I put the mac and windows archives in bitcoin-detached-sigs and extractd them with tar xf, which looks like this:

0Untracked files:
1  (use "git add <file>..." to include in what will be committed)
2	osx/arm64-apple-darwin/
3	osx/x86_64-apple-darwin/
4	win/bitcoin-096525e92cc2-win64-setup-unsigned.exe.pem
5	win/bitcoin-096525e92cc2/

It might be easier to have a tag or commit on that repo to checkout.

in contrib/guix/manifest.scm:18 in 096525e92c outdated

14@@ -15,13 +15,14 @@
15              (gnu packages mingw)
16              (gnu packages pkg-config)
17              ((gnu packages python) #:select (python-minimal))
18-             ((gnu packages python-build) #:select (python-tomli))
19+             ((gnu packages python-build) #:select (python-tomli python-poetry-core))

fanquake commented at 9:54 am on February 12, 2025:

Do these new dependencies change what is needed for a no-substitutes/boostrap build?

achow101 commented at 5:16 pm on February 12, 2025:

Other than the dependency itself, I don’t think so. The pypropject-build-system is part of python itself, and IIRC python-poetry-core is pure python as well with no dependencies.

pinheadmz commented at 11:26 am on February 12, 2025: member

@Sjors does this help? https://github.com/pinheadmz/bitcoin-detached-sigs/tree/achow101-macos-notarization-096525e92cc2

fanquake commented at 1:46 pm on February 12, 2025: member

Looks like everything matches:

I’ve run a build, but don’t yet see everything matching:

0find guix-build-096525e92cc2/output -wholename "*codesigned*" -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
1207621cdc43868870f4136e9e6784a2a3e9ba89ec1edc6fa92b315cfa3c4432c  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/SHA256SUMS.part
2111016205f0a2ac732feb934acb3e8a36d5251f119d8fa9215790310ba46c31d  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/bitcoin-096525e92cc2-arm64-apple-darwin.tar.gz
3a1228ddcb27fc5802ff5cab8f99026286070b4938aba08982f8e49d8e01b49cf  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/bitcoin-096525e92cc2-arm64-apple-darwin.zip
443ba7f6be694c1dd60aace1b222dd423e75607483b8933e598412f32f6ae3355  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/SHA256SUMS.part
56afec5020c65f602a8028e5fd1b42d196f04805c2240c56565400d750abe97f5  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.tar.gz
6c39372f58828349008a4d66d493a7e1b23668cbe1af807aa39888ca24928e599  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.zip
7344faf4f5431a5326900d2361ba70fbf93ec07cee808f5f7f83f10b64da93d26  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/SHA256SUMS.part
8404261ab457c31e13511e1268b63e926cc4bed2b8dbcf8ab7d22d4e4fbb423c0  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64-setup.exe
91c6ff7dfd0f410065032cfaa10090842f90ca08e7bb8930a157f54a241195927  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64.zip

Sjors commented at 1:56 pm on February 12, 2025: member

@pinheadmz yes that did the trick.

When running code sign I do get lots of warnings:

0WARNING: Part of the file was not parsed: 4332 bytes

I get the same hashes as @fanquake (built on Ubuntu VM running on an M4 MacBook Pro in Qemu / UTM).

willcl-ark commented at 1:56 pm on February 12, 2025: member

I have also finished a build, using pinheadmz signatures from https://github.com/pinheadmz/bitcoin-detached-sigs/tree/achow101-macos-notarization-096525e92cc2?rgh-link-date=2025-02-12T11%3A26%3A00Z

and get:

0$ find guix-build-096525e92cc2/output -wholename "*codesigned*" -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
1207621cdc43868870f4136e9e6784a2a3e9ba89ec1edc6fa92b315cfa3c4432c  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/SHA256SUMS.part
2111016205f0a2ac732feb934acb3e8a36d5251f119d8fa9215790310ba46c31d  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/bitcoin-096525e92cc2-arm64-apple-darwin.tar.gz
3a1228ddcb27fc5802ff5cab8f99026286070b4938aba08982f8e49d8e01b49cf  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/bitcoin-096525e92cc2-arm64-apple-darwin.zip
443ba7f6be694c1dd60aace1b222dd423e75607483b8933e598412f32f6ae3355  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/SHA256SUMS.part
56afec5020c65f602a8028e5fd1b42d196f04805c2240c56565400d750abe97f5  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.tar.gz
6c39372f58828349008a4d66d493a7e1b23668cbe1af807aa39888ca24928e599  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.zip
7344faf4f5431a5326900d2361ba70fbf93ec07cee808f5f7f83f10b64da93d26  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/SHA256SUMS.part
8404261ab457c31e13511e1268b63e926cc4bed2b8dbcf8ab7d22d4e4fbb423c0  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64-setup.exe
91c6ff7dfd0f410065032cfaa10090842f90ca08e7bb8930a157f54a241195927  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64.zip

pinheadmz commented at 3:34 pm on February 12, 2025: member

all.SHA256SUMS as of 096525e92cc2

 0
 1d7308491e32e076f40e58aaa9092ceae8a16b39e66937af72bdc8b879164f304  bitcoin-096525e92cc2-aarch64-linux-gnu-debug.tar.gz
 20351c42b5adf4759fd8441feb9da561d9066bbbb030d47ffa33b30eba6e9d247  bitcoin-096525e92cc2-aarch64-linux-gnu.tar.gz
 39a4f902ff10ff24944a314708e59394033e72eb4bfbbacafe0bb4c74f0079be4  bitcoin-096525e92cc2-arm-linux-gnueabihf-debug.tar.gz
 415f2575345370655a0e5c57ffed9f388999f9795f77ac34e99b68a86116ba721  bitcoin-096525e92cc2-arm-linux-gnueabihf.tar.gz
 5111016205f0a2ac732feb934acb3e8a36d5251f119d8fa9215790310ba46c31d  bitcoin-096525e92cc2-arm64-apple-darwin.tar.gz
 6a1228ddcb27fc5802ff5cab8f99026286070b4938aba08982f8e49d8e01b49cf  bitcoin-096525e92cc2-arm64-apple-darwin.zip
 79ac6138dc86f40b92f83d571b44d0996e3fca52d5a2ae670ed4ed3978c668695  bitcoin-096525e92cc2-arm64-apple-darwin-codesigning.tar.gz
 830b530f4982119c135b3667987423b3993e42e925ebb34a74b0e15b7180cad4e  bitcoin-096525e92cc2-arm64-apple-darwin-unsigned.tar.gz
 92b08474b102d654b1a2e68989d73d108b3c3484d49a1fa2b214287ff28b7abd8  bitcoin-096525e92cc2-arm64-apple-darwin-unsigned.zip
10a3945e66a68c125d1322abfb6f25e14f2b73ab90c9c57cd84c34757d2983a326  bitcoin-096525e92cc2-codesignatures-5c160ce1a3fb.tar.gz
11504608f78dc2be04bda41dc212d3cbb09afd270485884b03b426ad596b4b3611  bitcoin-096525e92cc2.tar.gz
12d7a111456b3d3ed3131c8e0242906742e59aa1143fe3106037d159d39d37e7ef  bitcoin-096525e92cc2-powerpc64-linux-gnu-debug.tar.gz
13c4d06c303dfd858bf0eda294e8bbcf4f3f0ce9bb011df6745afa74be3f3eb615  bitcoin-096525e92cc2-powerpc64-linux-gnu.tar.gz
14b24748afc5bf792aab5ecf4d33fdcf8802c943011de386b5689943ef586d1f7b  bitcoin-096525e92cc2-riscv64-linux-gnu-debug.tar.gz
1554207d89d1db350f54db43c124f52ea06d099dba06480f292b95c65492ac0c09  bitcoin-096525e92cc2-riscv64-linux-gnu.tar.gz
166afec5020c65f602a8028e5fd1b42d196f04805c2240c56565400d750abe97f5  bitcoin-096525e92cc2-x86_64-apple-darwin.tar.gz
17c39372f58828349008a4d66d493a7e1b23668cbe1af807aa39888ca24928e599  bitcoin-096525e92cc2-x86_64-apple-darwin.zip
189eb6801b9d5bfea3ae9da78213f940fb46d95e444ef59c5104f5a52ad5649b0c  bitcoin-096525e92cc2-x86_64-apple-darwin-codesigning.tar.gz
19d2871b137d4604751071a3d292d9a4907ab686e0d5caddd70339184ba1e01432  bitcoin-096525e92cc2-x86_64-apple-darwin-unsigned.tar.gz
204d02ea03f8419e91f2ba4511e05d1745eccfe2465ee316830155edaa772707c5  bitcoin-096525e92cc2-x86_64-apple-darwin-unsigned.zip
219cc51c4116fa0ee5f0305655a7a4ac84eb881a1a33952b6612bd8855fbe4e903  bitcoin-096525e92cc2-x86_64-linux-gnu-debug.tar.gz
22f4f17391172b15ce57886e55e10e5d8b71729edcc68f9937e45e20b8fdbced13  bitcoin-096525e92cc2-x86_64-linux-gnu.tar.gz
23404261ab457c31e13511e1268b63e926cc4bed2b8dbcf8ab7d22d4e4fbb423c0  bitcoin-096525e92cc2-win64-setup.exe
241c6ff7dfd0f410065032cfaa10090842f90ca08e7bb8930a157f54a241195927  bitcoin-096525e92cc2-win64.zip
252432dac2e2a366f078cf3629e47501dd35ffd63814e764e241fbfcf9915b22be  bitcoin-096525e92cc2-win64-codesigning.tar.gz
2601693e18af845e1c55f0fa60d763fd94d9a2b6d8c876b84c7d1bd592fe9904d0  bitcoin-096525e92cc2-win64-debug.zip
2776d645f644ab987c1b68b71001a7af24d823deb96cce657a0af06be0afbcb129  bitcoin-096525e92cc2-win64-setup-unsigned.exe
280d9e3e12f89f892dcd2ba0d818ddb28938f1baaafae9a3f884a358ad23ff3aa4  bitcoin-096525e92cc2-win64-unsigned.zip

achow101 commented at 5:19 pm on February 12, 2025: member

I’m unable to apply the code signatures. E.g. for arm64:

They need to be committed (locally, committed by anyone with any message).

I’ve run a build, but don’t yet see everything matching:

It looks like the binaries match, but not the SHA256SUMS.part files.

achow101 commented at 5:27 pm on February 12, 2025: member

I’ve run a build, but don’t yet see everything matching:

It looks like the binaries match, but not the SHA256SUMS.part files.

Ah, I think it’s probably that the bitcoin-096525e92cc2-codesignatures-<commit>.tar.gz file is the one that’s different in the SHA256SUMS.part files as I did not use the same codesignatures commit that @pinheadmz made. I was untarring and committing the signatures into my local repos.

achow101 commented at 5:57 pm on February 12, 2025: member

Rebuilt with @pinheadmz’s committed sigs

0$ find guix-build-096525e92cc2/output -wholename "*codesigned*" -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
1207621cdc43868870f4136e9e6784a2a3e9ba89ec1edc6fa92b315cfa3c4432c  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/SHA256SUMS.part
2111016205f0a2ac732feb934acb3e8a36d5251f119d8fa9215790310ba46c31d  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/bitcoin-096525e92cc2-arm64-apple-darwin.tar.gz
3a1228ddcb27fc5802ff5cab8f99026286070b4938aba08982f8e49d8e01b49cf  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/bitcoin-096525e92cc2-arm64-apple-darwin.zip
443ba7f6be694c1dd60aace1b222dd423e75607483b8933e598412f32f6ae3355  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/SHA256SUMS.part
56afec5020c65f602a8028e5fd1b42d196f04805c2240c56565400d750abe97f5  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.tar.gz
6c39372f58828349008a4d66d493a7e1b23668cbe1af807aa39888ca24928e599  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.zip
7344faf4f5431a5326900d2361ba70fbf93ec07cee808f5f7f83f10b64da93d26  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/SHA256SUMS.part
8404261ab457c31e13511e1268b63e926cc4bed2b8dbcf8ab7d22d4e4fbb423c0  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64-setup.exe
91c6ff7dfd0f410065032cfaa10090842f90ca08e7bb8930a157f54a241195927  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64.zip

Sjors commented at 9:56 am on February 13, 2025: member

Uploading the macOS binaries here, so I can test the download flow (which in the past behaved different from the scp flow):

I was able to run the downloaded zip on an macOS 15.3 (M4) without issue. I was also able to use all the binaries in the tar archive without having to self-sign them.

Will try Intel Mac and Windows this weekend if no-one else gets a chance first.

glozow requested review from willcl-ark on Feb 13, 2025

glozow requested review from darosior on Feb 13, 2025

glozow requested review from stickies-v on Feb 13, 2025

glozow requested review from davidgumberg on Feb 13, 2025

darosior commented at 8:10 pm on February 13, 2025: member

Thanks for the upload, i’ll test the Mac ARM this weekend.

willcl-ark approved

willcl-ark commented at 11:56 am on February 14, 2025: member

tACK 096525e92cc2f5a4318bae13cedd2cf36b928d5f

I have not thoroughly reviewed the code changes here, but I did read through all the changes. I was more interested in verifying the result of the changes was correct.

I tested the MacOS binaries on both an M3 and x86_64 (Intel) Macs. Of note however is the fact that the Intel Mac is 2017, and so can only run MacOS 10.13 (where 10.15 is the version giving us trouble with the new mandatory gatekeeper policies).

With that aside I can confirm that the bins (and .app) I built and attached signatures to work without any further interaction from users on both systems.

DrahtBot requested review from pinheadmz on Feb 14, 2025

willcl-ark commented at 11:57 am on February 14, 2025: member

I don’t want to delay getting this particular PR in before 29.0, but I do wonder if we might in the future consider tidying the the guix output directory a little? Currently I see:

 0$ fd -uu -e .tar.gz -e .zip -e .exe | cut -d '/' -f 2- | sort
 1bitcoin-096525e92cc2-aarch64-linux-gnu-debug.tar.gz
 2bitcoin-096525e92cc2-aarch64-linux-gnu.tar.gz
 3bitcoin-096525e92cc2-arm64-apple-darwin-codesigning.tar.gz
 4bitcoin-096525e92cc2-arm64-apple-darwin.tar.gz
 5bitcoin-096525e92cc2-arm64-apple-darwin-unsigned.tar.gz
 6bitcoin-096525e92cc2-arm64-apple-darwin-unsigned.zip
 7bitcoin-096525e92cc2-arm64-apple-darwin.zip
 8bitcoin-096525e92cc2-arm-linux-gnueabihf-debug.tar.gz
 9bitcoin-096525e92cc2-arm-linux-gnueabihf.tar.gz
10bitcoin-096525e92cc2-codesignatures-5c160ce1a3fb.tar.gz
11bitcoin-096525e92cc2-powerpc64-linux-gnu-debug.tar.gz
12bitcoin-096525e92cc2-powerpc64-linux-gnu.tar.gz
13bitcoin-096525e92cc2-riscv64-linux-gnu-debug.tar.gz
14bitcoin-096525e92cc2-riscv64-linux-gnu.tar.gz
15bitcoin-096525e92cc2.tar.gz
16bitcoin-096525e92cc2-win64-codesigning.tar.gz
17bitcoin-096525e92cc2-win64-debug.zip
18bitcoin-096525e92cc2-win64-setup.exe
19bitcoin-096525e92cc2-win64-setup-unsigned.exe
20bitcoin-096525e92cc2-win64-unsigned.zip
21bitcoin-096525e92cc2-win64.zip
22bitcoin-096525e92cc2-x86_64-apple-darwin-codesigning.tar.gz
23bitcoin-096525e92cc2-x86_64-apple-darwin.tar.gz
24bitcoin-096525e92cc2-x86_64-apple-darwin-unsigned.tar.gz
25bitcoin-096525e92cc2-x86_64-apple-darwin-unsigned.zip
26bitcoin-096525e92cc2-x86_64-apple-darwin.zip
27bitcoin-096525e92cc2-x86_64-linux-gnu-debug.tar.gz
28bitcoin-096525e92cc2-x86_64-linux-gnu.tar.gz

If these all appear on bitcoincore.org/bin/ then it’s starting to look a bit overwhelming for a MacOS (or Windows) user to correctly select what they need.

Perhaps, after codesigning we could prune the unsigned and codesigning dirs? This could see us reduce e.g. arm64-apple from:

0bitcoin-096525e92cc2-arm64-apple-darwin-codesigning.tar.gz
1bitcoin-096525e92cc2-arm64-apple-darwin.tar.gz
2bitcoin-096525e92cc2-arm64-apple-darwin-unsigned.tar.gz
3bitcoin-096525e92cc2-arm64-apple-darwin-unsigned.zip
4bitcoin-096525e92cc2-arm64-apple-darwin.zip

to something more comprehend-able:

0bitcoin-096525e92cc2-arm64-apple-darwin.tar.gz
1bitcoin-096525e92cc2-arm64-apple-darwin.zip

Are the *-codesigning.tar.gz and *unsigned* directories required for anything after codesigning? Or is it useful to keep them around in the guix output/distribution for another reason I haven’t considered?

I am imagining we might be able to:

build unsigned, and create non-codesigned signatures
codesign binaries, prune unneeded dirs, and create codesigned signatures

hebasto commented at 1:24 pm on February 14, 2025: member

Uploading the macOS binaries here, so I can test the download flow (which in the past behaved different from the scp flow):

bitcoin-096525e92cc2-arm64-apple-darwin.zip

bitcoin-096525e92cc2-x86_64-apple-darwin.zip

Tested on macOS 15.3 (Intel):

0% shasum -a 256 bitcoin-096525e92cc2-x86_64-apple-darwin.zip 
1c39372f58828349008a4d66d493a7e1b23668cbe1af807aa39888ca24928e599  bitcoin-096525e92cc2-x86_64-apple-darwin.zip
2% unzip bitcoin-096525e92cc2-x86_64-apple-darwin.zip
3% codesign --verify --deep --strict --verbose=2 Bitcoin-Qt.app
4Bitcoin-Qt.app: valid on disk
5Bitcoin-Qt.app: satisfies its Designated Requirement
6% spctl -a -vv Bitcoin-Qt.app                                 
7Bitcoin-Qt.app: accepted
8source=Notarized Developer ID
9origin=Developer ID Application: Bitcoin Core Code Signing Association (YZC7WH3MRU)

hebasto commented at 4:14 pm on February 14, 2025: member

Tested a Windows-specific part:

 0$ env HOSTS=x86_64-w64-mingw32
 1$ ./contrib/guix/guix-build
 2$ ./contrib/guix/guix-codesign
 3$ find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
 4ac50a82cb146e016d5d643460dc4ff7452a70497f2d95f76cee2bcfd82724ab6  guix-build-096525e92cc2/output/dist-archive/bitcoin-096525e92cc2-codesignatures-e252afe1296a.tar.gz
 5504608f78dc2be04bda41dc212d3cbb09afd270485884b03b426ad596b4b3611  guix-build-096525e92cc2/output/dist-archive/bitcoin-096525e92cc2.tar.gz
 652fba117ef288114a9e32a6990cc421055e6b51924510b629674068edfafe5e1  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/SHA256SUMS.part
 7404261ab457c31e13511e1268b63e926cc4bed2b8dbcf8ab7d22d4e4fbb423c0  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64-setup.exe
 81c6ff7dfd0f410065032cfaa10090842f90ca08e7bb8930a157f54a241195927  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64.zip
 9685edc8de33aa04a0efd956a511ef968957cf6f0a40f0dffea01b6736824b97d  guix-build-096525e92cc2/output/x86_64-w64-mingw32/SHA256SUMS.part
102432dac2e2a366f078cf3629e47501dd35ffd63814e764e241fbfcf9915b22be  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-codesigning.tar.gz
1101693e18af845e1c55f0fa60d763fd94d9a2b6d8c876b84c7d1bd592fe9904d0  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-debug.zip
1276d645f644ab987c1b68b71001a7af24d823deb96cce657a0af06be0afbcb129  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-setup-unsigned.exe
130d9e3e12f89f892dcd2ba0d818ddb28938f1baaafae9a3f884a358ad23ff3aa4  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-unsigned.zip

I’m not sure about the guix-build-096525e92cc2/output/dist-archive/bitcoin-096525e92cc2-codesignatures-e252afe1296a.tar.gz artifact in the output.

achow101 commented at 6:00 pm on February 14, 2025: member

If these all appear on bitcoincore.org/bin/ then it’s starting to look a bit overwhelming for a MacOS (or Windows) user to correctly select what they need.

We used to upload only the binaries, but started to upload all of the guix output because the SHA256SUMS lists all of that. Previously, if you downloaded everything for a release and then tried to verify the SHA256SUMS, it would give you an error about missing files, and we thought that might be confusing.

I think it would be reasonable to separate the non-binary stuff to a separate directory with its own SHA256SUMS. That way, we could still upload everything, but it would be less confusing. However, it would require changes to both guix building and attesting, and to the upload process.

Are the *-codesigning.tar.gz and *unsigned* directories required for anything after codesigning? Or is it useful to keep them around in the guix output/distribution for another reason I haven’t considered?

They are not, but they are useful for debugging and/or auditing the build process.

I’m not sure about the guix-build-096525e92cc2/output/dist-archive/bitcoin-096525e92cc2-codesignatures-e252afe1296a.tar.gz artifact in the output.

Not sure about it in what way?

TheCharlatan commented at 6:23 pm on February 14, 2025: contributor

I’m not sure about the guix-build-096525e92cc2/output/dist-archive/bitcoin-096525e92cc2-codesignatures-e252afe1296a.tar.gz artifact in the output.

I think that has always been there?

Can confirm that the app bundle runs fine, and I am reproducing the hashes. Are extra steps such as manual codesigning expected when running the binaries archived in output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.tar.gz?

achow101 commented at 6:26 pm on February 14, 2025: member

Are extra steps such as manual codesigning expected when running the binaries archived in output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.tar.gz?

No, these should all be codesigned now.

Sjors commented at 4:37 pm on February 15, 2025: member

macOS intel is happy too, no more right-clickery.

luke-jr referenced this in commit 4e8c981be8 on Feb 15, 2025

luke-jr referenced this in commit 35aadd0343 on Feb 15, 2025

luke-jr referenced this in commit d8903acc31 on Feb 15, 2025

luke-jr referenced this in commit 1048239ca7 on Feb 15, 2025

hebasto commented at 8:15 am on February 16, 2025: member

I’m not sure about the guix-build-096525e92cc2/output/dist-archive/bitcoin-096525e92cc2-codesignatures-e252afe1296a.tar.gz artifact in the output.

Not sure about it in what way?

Oh, I missed this comment, which resolves my concerns.

hebasto commented at 8:42 am on February 16, 2025: member

Tested a Windows-specific part:

 0$ env HOSTS=x86_64-w64-mingw32
 1$ ./contrib/guix/guix-build
 2$ ./contrib/guix/guix-codesign
 3$ find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
 4ac50a82cb146e016d5d643460dc4ff7452a70497f2d95f76cee2bcfd82724ab6  guix-build-096525e92cc2/output/dist-archive/bitcoin-096525e92cc2-codesignatures-e252afe1296a.tar.gz
 5504608f78dc2be04bda41dc212d3cbb09afd270485884b03b426ad596b4b3611  guix-build-096525e92cc2/output/dist-archive/bitcoin-096525e92cc2.tar.gz
 652fba117ef288114a9e32a6990cc421055e6b51924510b629674068edfafe5e1  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/SHA256SUMS.part
 7404261ab457c31e13511e1268b63e926cc4bed2b8dbcf8ab7d22d4e4fbb423c0  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64-setup.exe
 81c6ff7dfd0f410065032cfaa10090842f90ca08e7bb8930a157f54a241195927  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64.zip
 9685edc8de33aa04a0efd956a511ef968957cf6f0a40f0dffea01b6736824b97d  guix-build-096525e92cc2/output/x86_64-w64-mingw32/SHA256SUMS.part
102432dac2e2a366f078cf3629e47501dd35ffd63814e764e241fbfcf9915b22be  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-codesigning.tar.gz
1101693e18af845e1c55f0fa60d763fd94d9a2b6d8c876b84c7d1bd592fe9904d0  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-debug.zip
1276d645f644ab987c1b68b71001a7af24d823deb96cce657a0af06be0afbcb129  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-setup-unsigned.exe
130d9e3e12f89f892dcd2ba0d818ddb28938f1baaafae9a3f884a358ad23ff3aa4  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-unsigned.zip

I can confirm that all Windows binaries are now properly signed:

image_2025-02-16_08-40-41

hebasto commented at 10:40 am on February 16, 2025: member

I’ve redone the entire process from scratch using these signatures:

 0207621cdc43868870f4136e9e6784a2a3e9ba89ec1edc6fa92b315cfa3c4432c  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/SHA256SUMS.part
 1111016205f0a2ac732feb934acb3e8a36d5251f119d8fa9215790310ba46c31d  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/bitcoin-096525e92cc2-arm64-apple-darwin.tar.gz
 2a1228ddcb27fc5802ff5cab8f99026286070b4938aba08982f8e49d8e01b49cf  guix-build-096525e92cc2/output/arm64-apple-darwin-codesigned/bitcoin-096525e92cc2-arm64-apple-darwin.zip
 37061af7740406c76b1e942a0b3ba03df1e567b39d05032fea0bf56c20e79b456  guix-build-096525e92cc2/output/arm64-apple-darwin/SHA256SUMS.part
 49ac6138dc86f40b92f83d571b44d0996e3fca52d5a2ae670ed4ed3978c668695  guix-build-096525e92cc2/output/arm64-apple-darwin/bitcoin-096525e92cc2-arm64-apple-darwin-codesigning.tar.gz
 530b530f4982119c135b3667987423b3993e42e925ebb34a74b0e15b7180cad4e  guix-build-096525e92cc2/output/arm64-apple-darwin/bitcoin-096525e92cc2-arm64-apple-darwin-unsigned.tar.gz
 62b08474b102d654b1a2e68989d73d108b3c3484d49a1fa2b214287ff28b7abd8  guix-build-096525e92cc2/output/arm64-apple-darwin/bitcoin-096525e92cc2-arm64-apple-darwin-unsigned.zip
 7a3945e66a68c125d1322abfb6f25e14f2b73ab90c9c57cd84c34757d2983a326  guix-build-096525e92cc2/output/dist-archive/bitcoin-096525e92cc2-codesignatures-5c160ce1a3fb.tar.gz
 8504608f78dc2be04bda41dc212d3cbb09afd270485884b03b426ad596b4b3611  guix-build-096525e92cc2/output/dist-archive/bitcoin-096525e92cc2.tar.gz
 943ba7f6be694c1dd60aace1b222dd423e75607483b8933e598412f32f6ae3355  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/SHA256SUMS.part
106afec5020c65f602a8028e5fd1b42d196f04805c2240c56565400d750abe97f5  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.tar.gz
11c39372f58828349008a4d66d493a7e1b23668cbe1af807aa39888ca24928e599  guix-build-096525e92cc2/output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.zip
120b2a78b82c3c64d4e9dc4323581b2d2472f938dbf00726ab324c3b78534273b2  guix-build-096525e92cc2/output/x86_64-apple-darwin/SHA256SUMS.part
139eb6801b9d5bfea3ae9da78213f940fb46d95e444ef59c5104f5a52ad5649b0c  guix-build-096525e92cc2/output/x86_64-apple-darwin/bitcoin-096525e92cc2-x86_64-apple-darwin-codesigning.tar.gz
14d2871b137d4604751071a3d292d9a4907ab686e0d5caddd70339184ba1e01432  guix-build-096525e92cc2/output/x86_64-apple-darwin/bitcoin-096525e92cc2-x86_64-apple-darwin-unsigned.tar.gz
154d02ea03f8419e91f2ba4511e05d1745eccfe2465ee316830155edaa772707c5  guix-build-096525e92cc2/output/x86_64-apple-darwin/bitcoin-096525e92cc2-x86_64-apple-darwin-unsigned.zip
16344faf4f5431a5326900d2361ba70fbf93ec07cee808f5f7f83f10b64da93d26  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/SHA256SUMS.part
17404261ab457c31e13511e1268b63e926cc4bed2b8dbcf8ab7d22d4e4fbb423c0  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64-setup.exe
181c6ff7dfd0f410065032cfaa10090842f90ca08e7bb8930a157f54a241195927  guix-build-096525e92cc2/output/x86_64-w64-mingw32-codesigned/bitcoin-096525e92cc2-win64.zip
19685edc8de33aa04a0efd956a511ef968957cf6f0a40f0dffea01b6736824b97d  guix-build-096525e92cc2/output/x86_64-w64-mingw32/SHA256SUMS.part
202432dac2e2a366f078cf3629e47501dd35ffd63814e764e241fbfcf9915b22be  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-codesigning.tar.gz
2101693e18af845e1c55f0fa60d763fd94d9a2b6d8c876b84c7d1bd592fe9904d0  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-debug.zip
2276d645f644ab987c1b68b71001a7af24d823deb96cce657a0af06be0afbcb129  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-setup-unsigned.exe
230d9e3e12f89f892dcd2ba0d818ddb28938f1baaafae9a3f884a358ad23ff3aa4  guix-build-096525e92cc2/output/x86_64-w64-mingw32/bitcoin-096525e92cc2-win64-unsigned.zip

hebasto commented at 7:01 pm on February 16, 2025: member

macOS intel is happy too, no more right-clickery.

bitcoind as well?

Files downloaded via Safari seem to inevitably receive the com.apple.quarantine attribute. This is easily resolved for GUI applications but can be challenging for CLI tools.

Sjors commented at 6:56 am on February 17, 2025: member

Tar archives, to test bitcoind (too large for Github):

Sjors commented at 7:06 am on February 17, 2025: member

On Apple Silicon downloading through Safari and then extracting in Finder fails:

So does downloading in Safari and then extracting using the command line with tar.

What does work is downloading from a terminal and then extracting:

0curl -o bitcoin.tar.gz "https://download.sprovoost.nl/download.php?id=13&token=8de04067101d0748ccba9cb0e5c568cb&download"

Similarly on Intel downloading through Safari it will refuse to run, but there right-click works.

Maybe the archive itself needs to be signed?

just bitcoind

^ doesn’t work either, so presumably signing the archive won’t help?

0Downloads % codesign -v -vvv --strict --deep bitcoind                                                        
1bitcoind: valid on disk
2bitcoind: satisfies its Designated Requirement

(also if you download bitcoind this way it won’t have the x permission)

For the next release, maybe we should just tell bitcoind users to do:

0xattr -d com.apple.quarantine bin/*

That at least seems better than the current process of self-signing.

It seems that Apple engineers sometimes do answer questions about this, so might be worth asking: https://forums.developer.apple.com/forums/thread/773755

TheCharlatan commented at 8:13 am on February 17, 2025: contributor

Re #31407 (comment)

Are extra steps such as manual codesigning expected when running the binaries archived in output/x86_64-apple-darwin-codesigned/bitcoin-096525e92cc2-x86_64-apple-darwin.tar.gz?

No, these should all be codesigned now.

and re #31407 (comment)

On Apple Silicon downloading through Safari and then extracting in Finder fails: … Similarly on Intel downloading through Safari it will refuse to run, but there right-click works.

Same for me on my intel-based macbook, opening directly fails, right clicking and opening it solves it though.

Sjors commented at 9:44 am on February 17, 2025: member

This is an interesting writeup Hurdles of macOS distribution. It suggests we shouldn’t use --deep. But we only do that in macdeployqtplus for the QT .zip, which works, so no need to mess with it.

Sjors commented at 10:22 am on February 17, 2025: member

It might be worth trying to notarize the binaries (instead of only the GUI bundle). This forum thread suggests it can be done by temporarily zipping them and sending them Apple in that form.

(maybe in a followup)

darosior commented at 3:38 pm on February 17, 2025: member

bitcoin-096525e92cc2-arm64-apple-darwin.zip

Tested this on a Mac M1. I could download it flawlessly through Firefox and perform most of IBD.

I tried downloading it through Safari and likewise other reviewers i encountered an error:

https://github.com/user-attachments/assets/4f244f13-93ba-4071-bca1-4232cb69b69e

The system language was set to French but i guess what matters here is the error ID: -47.

I tried comparing this with downloading Liana, for which i used the rcodesign utility to implement notarization. There it works fine on both Firefox and Safari:

https://github.com/user-attachments/assets/304b06bf-20cd-470f-a4e1-22e9cddf2af0

I also just noticed now that i don’t have access to the Mac anymore that in Liana it used to be an x86 binary in the zip, so it might make a difference. Although i think the Wizardsardine team is now also shipping arm binaries.

darosior commented at 3:41 pm on February 17, 2025: member

Another thing worth mentioning is that the Liana GUI would download and start a bitcoind. This means a notarized application can run non-notarized binaries just fine. This may be helpful to know in considering how we approach notarization here (and in a possible multiprocess future).

achow101 commented at 7:48 pm on February 17, 2025: member

It might be worth trying to notarize the binaries (instead of only the GUI bundle). This forum thread suggests it can be done by temporarily zipping them and sending them Apple in that form.

The binaries can be notarized, but the notarization cannot be stapled, which is why I elected to not notarize them. This means that anyone who runs those binaries will be phoning home to apple, but I guess that will happen regardless of notarization. I believe notarizing the individual binaries will require additional changes to signapple.

I tried downloading it through Safari and likewise other reviewers i encountered an error:

That seems like a different error. Also, I believe others were testing the binaries tarball, not the zipped app bundle.

Sjors commented at 10:12 am on February 18, 2025: member

I was wondering how Homebrew fixes this, well apparently they just ad-hoc sign on your machine: https://github.com/orgs/Homebrew/discussions/4582#discussioncomment-6242807

Here’s a random Rust project that does codesign and notarize, but doesn’t staple: https://www.randomerrata.com/articles/2024/notarize/

Since macOS doesn’t know if a binary is notarized, and it doesn’t have the staple locally, it seems inevitable that it’s going to call home.

How nice of Apple to say this:

We have never combined data from these checks with information about Apple users or their devices. We do not use data from these checks to learn what individual users are using on their devices.

https://support.apple.com/en-qa/102445

If we tell users to do xattr -d com.apple.quarantine bin/*, it would both ensure the binaries work and has a chance of avoiding the “hi Apple I use Bitcoin” call. But I haven’t checked this.

But where would that instruction go? Adding a README would pollute the /usr/local directory for anyone using a script to download and extract. Saying it on the download page is probably the best option, even if not everyone looks there.

achow101 commented at 7:25 pm on February 18, 2025: member

I’ve notarized the arm64 binaries, does running the downloaded the binaries still result in an error?

guix: Update signapple 710d5b5149

achow101 force-pushed on Feb 18, 2025

achow101 commented at 11:25 pm on February 18, 2025: member

Latest push changes detached-sig-create.sh to also notarize the individual binaries. Also updates signapple to latest.

achow101 force-pushed on Feb 18, 2025

DrahtBot added the label CI failed on Feb 18, 2025

DrahtBot commented at 11:50 pm on February 18, 2025: contributor

🚧 At least one of the CI tasks failed. Debug: https://github.com/bitcoin/bitcoin/runs/37434670255

Try to run the tests locally, according to the documentation. However, a CI failure may still happen due to a number of reasons, for example:

Possibly due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.
A sanitizer issue, which can only be found by compiling with the sanitizer and running the affected test.
An intermittent issue.

Leave a comment here, if you need help tracking down a confusing failure.

achow101 force-pushed on Feb 19, 2025

darosior commented at 1:28 am on February 19, 2025: member

I’ve notarized the arm64 binaries, does running the downloaded the binaries still result in an error?

Just tried again the arm64 binary on the Mac M1. Downloading from Safari and running works fine now.

davidgumberg commented at 3:40 am on February 19, 2025: contributor

bitcoin-096525e92cc2-arm64-apple-darwin.zip

Tested this on a Mac M1. I could download it flawlessly through Firefox and perform most of IBD.

I tried downloading it through Safari and likewise other reviewers i encountered an error:

The system language was set to French but i guess what matters here is the error ID: -47.

I don’t know if this had the same cause as what you experienced, but I accidentally reproduced the same error message (in english) and error code -47 when bitcoin core was already running from a copy I downloaded using firefox and then while the firefox copy was running I downloaded and ran it from safari, maybe this is a bug in safari?

Otherwise, downloading through either browser, I tested launching and letting IBD run for a little bit on an arm64 mac (macOS Sonoma 14.6) and everything appears to work.

Unsigned guix hashes

0$ ./contrib/guix/guix-build &>/dev/null && find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum

 03148f70f6c9afaa84006df1d6002e902be9aa7490b198f3700fcf07cef00db82  guix-build-992071ef43c5/output/aarch64-linux-gnu/SHA256SUMS.part
 11dd3ccd947fa6fb6b1952abc9fc979f127a502fd3c1ed1a96866dfb043af7232  guix-build-992071ef43c5/output/aarch64-linux-gnu/bitcoin-992071ef43c5-aarch64-linux-gnu-debug.tar.gz
 2461e02f95c40346aa90cfeb00bff0cd24b02bd40d06770d2942e8df7c2125d3b  guix-build-992071ef43c5/output/aarch64-linux-gnu/bitcoin-992071ef43c5-aarch64-linux-gnu.tar.gz
 3fd0581571da7aad90cf0d1c4ae39685fb388170204ccc116b6791a2b39fa3534  guix-build-992071ef43c5/output/arm-linux-gnueabihf/SHA256SUMS.part
 4cad767a59062c5607e7d2e5188ab2603dd0680776e72e930428a44738c4737f0  guix-build-992071ef43c5/output/arm-linux-gnueabihf/bitcoin-992071ef43c5-arm-linux-gnueabihf-debug.tar.gz
 5e4aac27299623e3f5327ed69816c62f6aff5ff468d77be72f393c0e7af3508d7  guix-build-992071ef43c5/output/arm-linux-gnueabihf/bitcoin-992071ef43c5-arm-linux-gnueabihf.tar.gz
 622fd9d4c55f2cf49208e9a936e591518ff5dfdd7408191c95ed4cf5f109b2ed6  guix-build-992071ef43c5/output/arm64-apple-darwin/SHA256SUMS.part
 73a302ae3d943fadf0c23b285bca9ecdba9dcbe7c8043a899e9dba369ab1365a6  guix-build-992071ef43c5/output/arm64-apple-darwin/bitcoin-992071ef43c5-arm64-apple-darwin-codesigning.tar.gz
 86dd438f1c68b33a26294cea17fab0cbfd98c0e30d2e406c759a2e7c575eea92f  guix-build-992071ef43c5/output/arm64-apple-darwin/bitcoin-992071ef43c5-arm64-apple-darwin-unsigned.tar.gz
 97f41365e82c4290e441309994ca35942560fe98729e79d56c2edca200d36e3ba  guix-build-992071ef43c5/output/arm64-apple-darwin/bitcoin-992071ef43c5-arm64-apple-darwin-unsigned.zip
104068c0c78902df70d0d186de146776d38ccc25de6d76eb1171933a810e4a1dd1  guix-build-992071ef43c5/output/dist-archive/bitcoin-992071ef43c5-codesignatures-28.1.tar.gz
11e089b30572c9a2c4d475ce426c4ee11b6994c05e50716997c60208737a525e2a  guix-build-992071ef43c5/output/dist-archive/bitcoin-992071ef43c5-codesignatures-2b686ddcd809.tar.gz
12f9b09c83c071741b61cc27778c0ef2746ede111d8be4c3907ecaba0494769999  guix-build-992071ef43c5/output/dist-archive/bitcoin-992071ef43c5.tar.gz
1349ffdc4ea0de37dce537f20e84e59f20ca94e722fd2af1fb2ac9df814a87c5ff  guix-build-992071ef43c5/output/powerpc64-linux-gnu/SHA256SUMS.part
14f7646a0439820d0d96698c7cac125c19d3e6a3e630bc9a5b882f1d550e132c78  guix-build-992071ef43c5/output/powerpc64-linux-gnu/bitcoin-992071ef43c5-powerpc64-linux-gnu-debug.tar.gz
157e95684b33dfc26c618a7b92356fa66db4958cefcb878e5511d35c12573a411f  guix-build-992071ef43c5/output/powerpc64-linux-gnu/bitcoin-992071ef43c5-powerpc64-linux-gnu.tar.gz
164a39070b2945a08e6e80cbe98921f6a4eac2e0cfb9ee6a43e07187b2c077a4f4  guix-build-992071ef43c5/output/riscv64-linux-gnu/SHA256SUMS.part
172f50d0afe8df4198991967b171c7e89cb7af46d83dd2bf4c94605de606451c75  guix-build-992071ef43c5/output/riscv64-linux-gnu/bitcoin-992071ef43c5-riscv64-linux-gnu-debug.tar.gz
18de294455f36f88500ac37d88706da51e3cb9a44edb71de7fe9283ed68fc9897e  guix-build-992071ef43c5/output/riscv64-linux-gnu/bitcoin-992071ef43c5-riscv64-linux-gnu.tar.gz
195c4e896948ba93894d468a59de1497bb83438fd934465857a7c73d1171627700  guix-build-992071ef43c5/output/x86_64-apple-darwin/SHA256SUMS.part
20b729d4110b29d21252419feea526956a13b660b2be4b81bf7690a273c8cd1136  guix-build-992071ef43c5/output/x86_64-apple-darwin/bitcoin-992071ef43c5-x86_64-apple-darwin-codesigning.tar.gz
21711ee36ece75a0116b15bf5a2a80da310ed10258c3230f860d59f38e5b016b73  guix-build-992071ef43c5/output/x86_64-apple-darwin/bitcoin-992071ef43c5-x86_64-apple-darwin-unsigned.tar.gz
220a729da581e3089978d06d5711e9fd67aff709f18f3ea02f9a56991b5a798828  guix-build-992071ef43c5/output/x86_64-apple-darwin/bitcoin-992071ef43c5-x86_64-apple-darwin-unsigned.zip
23871e0133496a9bfef8756c3cb049babb3280079702355663dac1d214db9e31a2  guix-build-992071ef43c5/output/x86_64-linux-gnu/SHA256SUMS.part
243ecf82eda8a26087b654e06bdef1ad5d7f172b925dc09f9d56b0ceef30f9e73d  guix-build-992071ef43c5/output/x86_64-linux-gnu/bitcoin-992071ef43c5-x86_64-linux-gnu-debug.tar.gz
25f4a76d751c8ba787dafc011be88e2b833c7d773780037652f02771d84409c509  guix-build-992071ef43c5/output/x86_64-linux-gnu/bitcoin-992071ef43c5-x86_64-linux-gnu.tar.gz
2600d97e0f180286163e583b6f94af591b3b8d74a0d9a7c2c9eabf46c4fa281a9e  guix-build-992071ef43c5/output/x86_64-w64-mingw32/SHA256SUMS.part
270c1db0c4060a06869313aaa50d7ffee776baadd2badb3f1d967125abb7151461  guix-build-992071ef43c5/output/x86_64-w64-mingw32/bitcoin-992071ef43c5-win64-codesigning.tar.gz
28be17bd89304d4686941763a074355c5155f89934766019359f45fd5b07225a88  guix-build-992071ef43c5/output/x86_64-w64-mingw32/bitcoin-992071ef43c5-win64-debug.zip
29caa4d37ffd59d6f6b6ee3914278e6e26c6ac55837ba05e3cc26412e236f7d67f  guix-build-992071ef43c5/output/x86_64-w64-mingw32/bitcoin-992071ef43c5-win64-setup-unsigned.exe
30ad39dd1743fe9c5b1d1c35dfa9d0a8c1ad1a6ace5f701f9fb3b5465bff9a544b  guix-build-992071ef43c5/output/x86_64-w64-mingw32/bitcoin-992071ef43c5-win64-unsigned.zip

Sjors commented at 4:36 pm on February 19, 2025: member

I’ve notarized the arm64 binaries, does running the downloaded the binaries still result in an error?

I’ll try again on the new push, since my system might remember what I did to the previous binaries.

Do you want to push a linter fix, or should I just try the current version? I’ll need new sigs from @pinheadmz anyway.

Compared to your last version, it’s now also doing ${SIGNAPPLE} apply, I guess the codesigner did that manually the last time?

https://github.com/bitcoin/bitcoin/compare/096525e..992071ef43c5a7cbb4992f8273350f6142ceb4ce

contrib: Sign and notarize all MacOS binaries

Signapple has been updated to sign individual binaries, and notarize app
bundles and binaries. When codesigning, all individual binaries will be
codesigned, and both the app bundle and individual binaries will be
notarized.

31d325464d

contrib: Sign all Windows binaries too 3656b828dc

guix: Apply codesignatures to all MacOS binaries aafbd23fd9

guix: Apply all codesignatures to Windows binaries e181bda061

achow101 force-pushed on Feb 19, 2025

achow101 commented at 4:42 pm on February 19, 2025: member

Do you want to push a linter fix

Just pushed.

pinheadmz commented at 4:44 pm on February 19, 2025: member

I’ll need new sigs from @pinheadmz anyway.

building e181bda stay tuned for sigs

pinheadmz commented at 7:03 pm on February 19, 2025: member

I’m having an issue codesigning:

  0
  1--> ./detached-sig-create.sh <...>p12 <...>p8 <...UUID...>
  2
  3WARNING: Part of the file was not parsed: 37428 bytes
  4Enter the passphrase for /Volumes/safe2/bitcoin-core-csk/Archive/cert@bitcoincorecodesigning.org.p12:
  5Enter the passphrase for /Volumes/safe2/bitcoin-core-csk/app_store_connect_api_key/AuthKey_5ZTN3N6A87.p8:
  6WARNING: Part of the file was not parsed: 37428 bytes
  7Code signature created
  8WARNING: Part of the file was not parsed: 37428 bytes
  9WARNING: Part of the file was not parsed: 37428 bytes
 10Code signature applied
 11WARNING: Part of the file was not parsed: 37428 bytes
 12Code signature is valid
 13Notarization ID: fb852fa0-fcc6-405b-8080-56ab24f473f3
 14Uploading...
 15Polling notarization status
 16Polling notarization status
 17Polling notarization status
 18Polling notarization status
 19Polling notarization status
 20WARNING: Part of the file was not parsed: 37428 bytes
 21Stapling
 22Notarization stapled to bundle
 23WARNING: Part of the file was not parsed: 16518 bytes
 24WARNING: Part of the file was not parsed: 16518 bytes
 25Code signature created
 26WARNING: Part of the file was not parsed: 16518 bytes
 27WARNING: Part of the file was not parsed: 16518 bytes
 28Code signature applied
 29WARNING: Part of the file was not parsed: 16518 bytes
 30WARNING: Part of the file was not parsed: 16518 bytes
 31Code signature is valid
 32WARNING: Part of the file was not parsed: 11068 bytes
 33WARNING: Part of the file was not parsed: 11068 bytes
 34Code signature created
 35WARNING: Part of the file was not parsed: 11068 bytes
 36WARNING: Part of the file was not parsed: 11068 bytes
 37Code signature applied
 38WARNING: Part of the file was not parsed: 11068 bytes
 39WARNING: Part of the file was not parsed: 11068 bytes
 40Code signature is valid
 41WARNING: Part of the file was not parsed: 5345 bytes
 42WARNING: Part of the file was not parsed: 5345 bytes
 43Code signature created
 44WARNING: Part of the file was not parsed: 5345 bytes
 45WARNING: Part of the file was not parsed: 5345 bytes
 46Code signature applied
 47WARNING: Part of the file was not parsed: 5345 bytes
 48WARNING: Part of the file was not parsed: 5345 bytes
 49Code signature is valid
 50WARNING: Part of the file was not parsed: 4332 bytes
 51WARNING: Part of the file was not parsed: 4332 bytes
 52Code signature created
 53WARNING: Part of the file was not parsed: 4332 bytes
 54WARNING: Part of the file was not parsed: 4332 bytes
 55Code signature applied
 56WARNING: Part of the file was not parsed: 4332 bytes
 57WARNING: Part of the file was not parsed: 4332 bytes
 58Code signature is valid
 59WARNING: Part of the file was not parsed: 37428 bytes
 60WARNING: Part of the file was not parsed: 37428 bytes
 61Code signature created
 62WARNING: Part of the file was not parsed: 37428 bytes
 63WARNING: Part of the file was not parsed: 37428 bytes
 64Code signature applied
 65WARNING: Part of the file was not parsed: 37428 bytes
 66WARNING: Part of the file was not parsed: 37428 bytes
 67Code signature is valid
 68WARNING: Part of the file was not parsed: 17659 bytes
 69WARNING: Part of the file was not parsed: 17659 bytes
 70Code signature created
 71WARNING: Part of the file was not parsed: 17659 bytes
 72WARNING: Part of the file was not parsed: 17659 bytes
 73Code signature applied
 74WARNING: Part of the file was not parsed: 17659 bytes
 75WARNING: Part of the file was not parsed: 17659 bytes
 76Code signature is valid
 77WARNING: Part of the file was not parsed: 6475 bytes
 78WARNING: Part of the file was not parsed: 6475 bytes
 79Code signature created
 80WARNING: Part of the file was not parsed: 6475 bytes
 81WARNING: Part of the file was not parsed: 6475 bytes
 82Code signature applied
 83WARNING: Part of the file was not parsed: 6475 bytes
 84WARNING: Part of the file was not parsed: 6475 bytes
 85Code signature is valid
 86Traceback (most recent call last):
 87  File "/opt/homebrew/bin/signapple", line 8, in <module>
 88    sys.exit(main())
 89             ^^^^^^
 90  File "/Users/matthewzipkin/Desktop/work/signapple/signapple/__init__.py", line 192, in main
 91    args.func(args)
 92  File "/Users/matthewzipkin/Desktop/work/signapple/signapple/__init__.py", line 52, in do_notarize
 93    notarize(
 94  File "/Users/matthewzipkin/Desktop/work/signapple/signapple/notarize.py", line 344, in notarize
 95    _submit_for_notarization(
 96  File "/Users/matthewzipkin/Desktop/work/signapple/signapple/notarize.py", line 291, in _submit_for_notarization
 97    zipped = shutil.make_archive(
 98             ^^^^^^^^^^^^^^^^^^^^
 99  File "/opt/homebrew/Cellar/python@3.11/3.11.11/Frameworks/Python.framework/Versions/3.11/lib/python3.11/shutil.py", line 1148, in make_archive
100    stmd = os.stat(root_dir).st_mode
101           ^^^^^^^^^^^^^^^^^
102FileNotFoundError: [Errno 2] No such file or directory: ''

DrahtBot removed the label CI failed on Feb 19, 2025

achow101 commented at 8:38 pm on February 19, 2025: member

I’m having an issue codesigning:

Fixed in https://github.com/achow101/signapple/commit/0c087854fd2822ab63512cbfa3b55706239b27c2. Note that this only affects code signers so I will hold off on updating signapple in guix for now.

pinheadmz commented at 8:59 pm on February 19, 2025: member

Updated detached codesigs:

https://github.com/pinheadmz/bitcoin-detached-sigs/tree/achow101-macos-notarization-e181bda

all.SHA256SUMS

 0
 109160970e038df29d6c2ae3da69adf77ac496f65e114e3bbb56272465b9c230a  bitcoin-e181bda061ca-aarch64-linux-gnu-debug.tar.gz
 2f94c5f7734858dfc77717849934112cceef44a80b06fb1c21f41a78733092c6a  bitcoin-e181bda061ca-aarch64-linux-gnu.tar.gz
 344dcd5864d1c529c431f5e80966d4efe74a14330182460ac945852bc67ad7e84  bitcoin-e181bda061ca-arm-linux-gnueabihf-debug.tar.gz
 4cff965267e9a25f8df0d36f04294be555d572dd7336bf5019c47a28f605cc489  bitcoin-e181bda061ca-arm-linux-gnueabihf.tar.gz
 53bec23389e5343dadc16ab3ed2bff897519a335ed970f8288521aa7ee7bdf4be  bitcoin-e181bda061ca-arm64-apple-darwin.tar.gz
 67f0b7259dc451610040e4fb5f1ef8947770a8fed363c64e00b06870bb5c94607  bitcoin-e181bda061ca-arm64-apple-darwin.zip
 700d4136e008ed4e93432d6aa353b1069ec1462b641fcdfd5199345113b8a49d2  bitcoin-e181bda061ca-arm64-apple-darwin-codesigning.tar.gz
 836ec89ca44cfbb912081a50e3b1604df14ac624b30950f006917c546359fd3bc  bitcoin-e181bda061ca-arm64-apple-darwin-unsigned.tar.gz
 98d80e0e513d0c5f5a2230606165de6fd283d55d9ee4cb0eece201012e88e11e1  bitcoin-e181bda061ca-arm64-apple-darwin-unsigned.zip
10ce0666f1527e5cf0f78b6dcddecc0ca9243cff8ff7086ce36d2530c085e7bb19  bitcoin-e181bda061ca-codesignatures-affdd2113f54.tar.gz
11703b6258d896bfef505bcc02d5320b1732f3c391775772d2e6f7efc5544d9ab1  bitcoin-e181bda061ca.tar.gz
1219cae39114674afdde3884fc494b654c3c233a39756a993909391b6dc985fcd6  bitcoin-e181bda061ca-powerpc64-linux-gnu-debug.tar.gz
139c92cb2220d4431d86b63e5ab9c7d3dee64d9690c2ade7ccca396f1a1e48bb16  bitcoin-e181bda061ca-powerpc64-linux-gnu.tar.gz
14a529f947b177769e5e799aaca47cdd70fbb1063d5d0f932b31bc4405647e108f  bitcoin-e181bda061ca-riscv64-linux-gnu-debug.tar.gz
15afc182cc6cfac92e83b83f173aef4ab90e48551bc3bce101959a9d9a2f49c216  bitcoin-e181bda061ca-riscv64-linux-gnu.tar.gz
16c6f7cc3e70bb02ea7103efde9875e450fae51bd6dea0736a1cdedc7a8c9fb6bc  bitcoin-e181bda061ca-x86_64-apple-darwin.tar.gz
176c787dc8e40e9912065dea790a8fa2499555d5fb66d6b19afdf95422891e4894  bitcoin-e181bda061ca-x86_64-apple-darwin.zip
18c6cfcb6ebba64842ca280af3ccc74ad971cb3092ffcc2f18151a36f0a1a17fd4  bitcoin-e181bda061ca-x86_64-apple-darwin-codesigning.tar.gz
19fcd053b24cc47258ea408f26188a3056086e10b1ed83b9c3f3bdc87d83626493  bitcoin-e181bda061ca-x86_64-apple-darwin-unsigned.tar.gz
20e218ad851f8ab73b7461fff21de30a7b726793c92e1d424853fc1e542e177d0c  bitcoin-e181bda061ca-x86_64-apple-darwin-unsigned.zip
2185e59bae13a52da47ecfd84d1f68578167ebef3b1f01195ad2ab3bd95cbc4c79  bitcoin-e181bda061ca-x86_64-linux-gnu-debug.tar.gz
2298a1a05649608451e1ecd6624bc8a29bfde0b807814297c6ed081c3fcdf1d008  bitcoin-e181bda061ca-x86_64-linux-gnu.tar.gz
23ef919b73e8d1658af4f36b66932205946826e8f28fc653d9315ea7bc297023c0  bitcoin-e181bda061ca-win64-setup.exe
2469ad6eaa66fb8154bcdf259c0944bb2bcbc55626e22388fbbf74e7898adf30b8  bitcoin-e181bda061ca-win64.zip
25c7174f6180ecffc72ca92e2832e810c0ba6e01b0e0d93d12e87648489c40d2f7  bitcoin-e181bda061ca-win64-codesigning.tar.gz
26dbef2b4fce7fccba81e26843408a6891e8dbe0065d18e73a0c0aa02caf9ad8b7  bitcoin-e181bda061ca-win64-debug.zip
2740002ea190fbbb1df2808aa30c21004e7291a088cde9a743c1dce396d2671a3b  bitcoin-e181bda061ca-win64-setup-unsigned.exe
289a5a9d4b1379b2ef0909e5bec0359ce90f495d9f3208a22cac9ac6d595da3edc  bitcoin-e181bda061ca-win64-unsigned.zip

pinheadmz commented at 9:08 pm on February 19, 2025: member

Reviewers can also try downloading these signed binaries to see what their browsers think … ?

https://www.dropbox.com/scl/fo/zpz3gjtzz66gtejnqkrfs/AIWbAU_Y3pY_O93cy9Q6vds?rlkey=oucgyfg4sm5p9pa2c0gum2kxa&st=8t07hrcz&dl=0

edit: never mind Screenshot 2025-02-19 at 4 10 35 PM

davidgumberg commented at 9:25 pm on February 19, 2025: contributor

unsigned

bitcoin-e181bda061ca-arm64-apple-darwin-unsigned.zip bitcoin-e181bda061ca-x86_64-apple-darwin-unsigned.zip

codesigned

bitcoin-e181bda061ca-arm64-apple-darwin.zip bitcoin-e181bda061ca-x86_64-apple-darwin.zip

`all.SHA256SUMS`

 009160970e038df29d6c2ae3da69adf77ac496f65e114e3bbb56272465b9c230a  bitcoin-e181bda061ca-aarch64-linux-gnu-debug.tar.gz
 1f94c5f7734858dfc77717849934112cceef44a80b06fb1c21f41a78733092c6a  bitcoin-e181bda061ca-aarch64-linux-gnu.tar.gz
 244dcd5864d1c529c431f5e80966d4efe74a14330182460ac945852bc67ad7e84  bitcoin-e181bda061ca-arm-linux-gnueabihf-debug.tar.gz
 3cff965267e9a25f8df0d36f04294be555d572dd7336bf5019c47a28f605cc489  bitcoin-e181bda061ca-arm-linux-gnueabihf.tar.gz
 43bec23389e5343dadc16ab3ed2bff897519a335ed970f8288521aa7ee7bdf4be  bitcoin-e181bda061ca-arm64-apple-darwin.tar.gz
 57f0b7259dc451610040e4fb5f1ef8947770a8fed363c64e00b06870bb5c94607  bitcoin-e181bda061ca-arm64-apple-darwin.zip
 600d4136e008ed4e93432d6aa353b1069ec1462b641fcdfd5199345113b8a49d2  bitcoin-e181bda061ca-arm64-apple-darwin-codesigning.tar.gz
 736ec89ca44cfbb912081a50e3b1604df14ac624b30950f006917c546359fd3bc  bitcoin-e181bda061ca-arm64-apple-darwin-unsigned.tar.gz
 88d80e0e513d0c5f5a2230606165de6fd283d55d9ee4cb0eece201012e88e11e1  bitcoin-e181bda061ca-arm64-apple-darwin-unsigned.zip
 9ce0666f1527e5cf0f78b6dcddecc0ca9243cff8ff7086ce36d2530c085e7bb19  bitcoin-e181bda061ca-codesignatures-affdd2113f54.tar.gz
10703b6258d896bfef505bcc02d5320b1732f3c391775772d2e6f7efc5544d9ab1  bitcoin-e181bda061ca.tar.gz
1119cae39114674afdde3884fc494b654c3c233a39756a993909391b6dc985fcd6  bitcoin-e181bda061ca-powerpc64-linux-gnu-debug.tar.gz
129c92cb2220d4431d86b63e5ab9c7d3dee64d9690c2ade7ccca396f1a1e48bb16  bitcoin-e181bda061ca-powerpc64-linux-gnu.tar.gz
13a529f947b177769e5e799aaca47cdd70fbb1063d5d0f932b31bc4405647e108f  bitcoin-e181bda061ca-riscv64-linux-gnu-debug.tar.gz
14afc182cc6cfac92e83b83f173aef4ab90e48551bc3bce101959a9d9a2f49c216  bitcoin-e181bda061ca-riscv64-linux-gnu.tar.gz
15c6f7cc3e70bb02ea7103efde9875e450fae51bd6dea0736a1cdedc7a8c9fb6bc  bitcoin-e181bda061ca-x86_64-apple-darwin.tar.gz
166c787dc8e40e9912065dea790a8fa2499555d5fb66d6b19afdf95422891e4894  bitcoin-e181bda061ca-x86_64-apple-darwin.zip
17c6cfcb6ebba64842ca280af3ccc74ad971cb3092ffcc2f18151a36f0a1a17fd4  bitcoin-e181bda061ca-x86_64-apple-darwin-codesigning.tar.gz
18fcd053b24cc47258ea408f26188a3056086e10b1ed83b9c3f3bdc87d83626493  bitcoin-e181bda061ca-x86_64-apple-darwin-unsigned.tar.gz
19e218ad851f8ab73b7461fff21de30a7b726793c92e1d424853fc1e542e177d0c  bitcoin-e181bda061ca-x86_64-apple-darwin-unsigned.zip
2085e59bae13a52da47ecfd84d1f68578167ebef3b1f01195ad2ab3bd95cbc4c79  bitcoin-e181bda061ca-x86_64-linux-gnu-debug.tar.gz
2198a1a05649608451e1ecd6624bc8a29bfde0b807814297c6ed081c3fcdf1d008  bitcoin-e181bda061ca-x86_64-linux-gnu.tar.gz
22ef919b73e8d1658af4f36b66932205946826e8f28fc653d9315ea7bc297023c0  bitcoin-e181bda061ca-win64-setup.exe
2369ad6eaa66fb8154bcdf259c0944bb2bcbc55626e22388fbbf74e7898adf30b8  bitcoin-e181bda061ca-win64.zip
24c7174f6180ecffc72ca92e2832e810c0ba6e01b0e0d93d12e87648489c40d2f7  bitcoin-e181bda061ca-win64-codesigning.tar.gz
25dbef2b4fce7fccba81e26843408a6891e8dbe0065d18e73a0c0aa02caf9ad8b7  bitcoin-e181bda061ca-win64-debug.zip
2640002ea190fbbb1df2808aa30c21004e7291a088cde9a743c1dce396d2671a3b  bitcoin-e181bda061ca-win64-setup-unsigned.exe
279a5a9d4b1379b2ef0909e5bec0359ce90f495d9f3208a22cac9ac6d595da3edc  bitcoin-e181bda061ca-win64-unsigned.zip

`noncodesigned.SHA256SUMS`

 009160970e038df29d6c2ae3da69adf77ac496f65e114e3bbb56272465b9c230a  bitcoin-e181bda061ca-aarch64-linux-gnu-debug.tar.gz
 1f94c5f7734858dfc77717849934112cceef44a80b06fb1c21f41a78733092c6a  bitcoin-e181bda061ca-aarch64-linux-gnu.tar.gz
 244dcd5864d1c529c431f5e80966d4efe74a14330182460ac945852bc67ad7e84  bitcoin-e181bda061ca-arm-linux-gnueabihf-debug.tar.gz
 3cff965267e9a25f8df0d36f04294be555d572dd7336bf5019c47a28f605cc489  bitcoin-e181bda061ca-arm-linux-gnueabihf.tar.gz
 400d4136e008ed4e93432d6aa353b1069ec1462b641fcdfd5199345113b8a49d2  bitcoin-e181bda061ca-arm64-apple-darwin-codesigning.tar.gz
 536ec89ca44cfbb912081a50e3b1604df14ac624b30950f006917c546359fd3bc  bitcoin-e181bda061ca-arm64-apple-darwin-unsigned.tar.gz
 68d80e0e513d0c5f5a2230606165de6fd283d55d9ee4cb0eece201012e88e11e1  bitcoin-e181bda061ca-arm64-apple-darwin-unsigned.zip
 7703b6258d896bfef505bcc02d5320b1732f3c391775772d2e6f7efc5544d9ab1  bitcoin-e181bda061ca.tar.gz
 819cae39114674afdde3884fc494b654c3c233a39756a993909391b6dc985fcd6  bitcoin-e181bda061ca-powerpc64-linux-gnu-debug.tar.gz
 99c92cb2220d4431d86b63e5ab9c7d3dee64d9690c2ade7ccca396f1a1e48bb16  bitcoin-e181bda061ca-powerpc64-linux-gnu.tar.gz
10a529f947b177769e5e799aaca47cdd70fbb1063d5d0f932b31bc4405647e108f  bitcoin-e181bda061ca-riscv64-linux-gnu-debug.tar.gz
11afc182cc6cfac92e83b83f173aef4ab90e48551bc3bce101959a9d9a2f49c216  bitcoin-e181bda061ca-riscv64-linux-gnu.tar.gz
12c6cfcb6ebba64842ca280af3ccc74ad971cb3092ffcc2f18151a36f0a1a17fd4  bitcoin-e181bda061ca-x86_64-apple-darwin-codesigning.tar.gz
13fcd053b24cc47258ea408f26188a3056086e10b1ed83b9c3f3bdc87d83626493  bitcoin-e181bda061ca-x86_64-apple-darwin-unsigned.tar.gz
14e218ad851f8ab73b7461fff21de30a7b726793c92e1d424853fc1e542e177d0c  bitcoin-e181bda061ca-x86_64-apple-darwin-unsigned.zip
1585e59bae13a52da47ecfd84d1f68578167ebef3b1f01195ad2ab3bd95cbc4c79  bitcoin-e181bda061ca-x86_64-linux-gnu-debug.tar.gz
1698a1a05649608451e1ecd6624bc8a29bfde0b807814297c6ed081c3fcdf1d008  bitcoin-e181bda061ca-x86_64-linux-gnu.tar.gz
17c7174f6180ecffc72ca92e2832e810c0ba6e01b0e0d93d12e87648489c40d2f7  bitcoin-e181bda061ca-win64-codesigning.tar.gz
18dbef2b4fce7fccba81e26843408a6891e8dbe0065d18e73a0c0aa02caf9ad8b7  bitcoin-e181bda061ca-win64-debug.zip
1940002ea190fbbb1df2808aa30c21004e7291a088cde9a743c1dce396d2671a3b  bitcoin-e181bda061ca-win64-setup-unsigned.exe
209a5a9d4b1379b2ef0909e5bec0359ce90f495d9f3208a22cac9ac6d595da3edc  bitcoin-e181bda061ca-win64-unsigned.zip

achow101 commented at 9:55 pm on February 19, 2025: member

 0d043dbd79662ee324ab809061405c71ecb4dbd9c1100ea7fcfc72bfb8e775a20  guix-build-e181bda061ca/output/aarch64-linux-gnu/SHA256SUMS.part
 109160970e038df29d6c2ae3da69adf77ac496f65e114e3bbb56272465b9c230a  guix-build-e181bda061ca/output/aarch64-linux-gnu/bitcoin-e181bda061ca-aarch64-linux-gnu-debug.tar.gz
 2f94c5f7734858dfc77717849934112cceef44a80b06fb1c21f41a78733092c6a  guix-build-e181bda061ca/output/aarch64-linux-gnu/bitcoin-e181bda061ca-aarch64-linux-gnu.tar.gz
 3a28ae11a5585624e18c9c85f5c4a0fb095956296817ae93a6292ec86d094e6f3  guix-build-e181bda061ca/output/arm-linux-gnueabihf/SHA256SUMS.part
 444dcd5864d1c529c431f5e80966d4efe74a14330182460ac945852bc67ad7e84  guix-build-e181bda061ca/output/arm-linux-gnueabihf/bitcoin-e181bda061ca-arm-linux-gnueabihf-debug.tar.gz
 5cff965267e9a25f8df0d36f04294be555d572dd7336bf5019c47a28f605cc489  guix-build-e181bda061ca/output/arm-linux-gnueabihf/bitcoin-e181bda061ca-arm-linux-gnueabihf.tar.gz
 62bc98ea18648c64ddfbc4136e421e561090c49c2f497cec71ae2fcdd91a36269  guix-build-e181bda061ca/output/arm64-apple-darwin-codesigned/SHA256SUMS.part
 73bec23389e5343dadc16ab3ed2bff897519a335ed970f8288521aa7ee7bdf4be  guix-build-e181bda061ca/output/arm64-apple-darwin-codesigned/bitcoin-e181bda061ca-arm64-apple-darwin.tar.gz
 87f0b7259dc451610040e4fb5f1ef8947770a8fed363c64e00b06870bb5c94607  guix-build-e181bda061ca/output/arm64-apple-darwin-codesigned/bitcoin-e181bda061ca-arm64-apple-darwin.zip
 953b1abee1897bfd31f8244fd63fe86cad7ba49aafe01b2d8ba05f1fa9ca7ea49  guix-build-e181bda061ca/output/arm64-apple-darwin/SHA256SUMS.part
1000d4136e008ed4e93432d6aa353b1069ec1462b641fcdfd5199345113b8a49d2  guix-build-e181bda061ca/output/arm64-apple-darwin/bitcoin-e181bda061ca-arm64-apple-darwin-codesigning.tar.gz
1136ec89ca44cfbb912081a50e3b1604df14ac624b30950f006917c546359fd3bc  guix-build-e181bda061ca/output/arm64-apple-darwin/bitcoin-e181bda061ca-arm64-apple-darwin-unsigned.tar.gz
128d80e0e513d0c5f5a2230606165de6fd283d55d9ee4cb0eece201012e88e11e1  guix-build-e181bda061ca/output/arm64-apple-darwin/bitcoin-e181bda061ca-arm64-apple-darwin-unsigned.zip
13ce0666f1527e5cf0f78b6dcddecc0ca9243cff8ff7086ce36d2530c085e7bb19  guix-build-e181bda061ca/output/dist-archive/bitcoin-e181bda061ca-codesignatures-affdd2113f54.tar.gz
14703b6258d896bfef505bcc02d5320b1732f3c391775772d2e6f7efc5544d9ab1  guix-build-e181bda061ca/output/dist-archive/bitcoin-e181bda061ca.tar.gz
1532e34ff5601083f706a1638bd140395446c5613a65383a2b3a275e1c9d7236f1  guix-build-e181bda061ca/output/powerpc64-linux-gnu/SHA256SUMS.part
1619cae39114674afdde3884fc494b654c3c233a39756a993909391b6dc985fcd6  guix-build-e181bda061ca/output/powerpc64-linux-gnu/bitcoin-e181bda061ca-powerpc64-linux-gnu-debug.tar.gz
179c92cb2220d4431d86b63e5ab9c7d3dee64d9690c2ade7ccca396f1a1e48bb16  guix-build-e181bda061ca/output/powerpc64-linux-gnu/bitcoin-e181bda061ca-powerpc64-linux-gnu.tar.gz
185a472ba05a65577eb9849b6b478976aa206646e69c67fccb3687e80416596352  guix-build-e181bda061ca/output/riscv64-linux-gnu/SHA256SUMS.part
19a529f947b177769e5e799aaca47cdd70fbb1063d5d0f932b31bc4405647e108f  guix-build-e181bda061ca/output/riscv64-linux-gnu/bitcoin-e181bda061ca-riscv64-linux-gnu-debug.tar.gz
20afc182cc6cfac92e83b83f173aef4ab90e48551bc3bce101959a9d9a2f49c216  guix-build-e181bda061ca/output/riscv64-linux-gnu/bitcoin-e181bda061ca-riscv64-linux-gnu.tar.gz
21d29c36dfcefc7eb08963f0fb4a3126f69d6fe6673f2bc1dc3e338c0300381fe9  guix-build-e181bda061ca/output/x86_64-apple-darwin-codesigned/SHA256SUMS.part
22c6f7cc3e70bb02ea7103efde9875e450fae51bd6dea0736a1cdedc7a8c9fb6bc  guix-build-e181bda061ca/output/x86_64-apple-darwin-codesigned/bitcoin-e181bda061ca-x86_64-apple-darwin.tar.gz
236c787dc8e40e9912065dea790a8fa2499555d5fb66d6b19afdf95422891e4894  guix-build-e181bda061ca/output/x86_64-apple-darwin-codesigned/bitcoin-e181bda061ca-x86_64-apple-darwin.zip
243bc3e3bd4f71ccec939b0bf3e898bfd2b9324a1fe267d6d37e5d4ceb5cbb7f05  guix-build-e181bda061ca/output/x86_64-apple-darwin/SHA256SUMS.part
25c6cfcb6ebba64842ca280af3ccc74ad971cb3092ffcc2f18151a36f0a1a17fd4  guix-build-e181bda061ca/output/x86_64-apple-darwin/bitcoin-e181bda061ca-x86_64-apple-darwin-codesigning.tar.gz
26fcd053b24cc47258ea408f26188a3056086e10b1ed83b9c3f3bdc87d83626493  guix-build-e181bda061ca/output/x86_64-apple-darwin/bitcoin-e181bda061ca-x86_64-apple-darwin-unsigned.tar.gz
27e218ad851f8ab73b7461fff21de30a7b726793c92e1d424853fc1e542e177d0c  guix-build-e181bda061ca/output/x86_64-apple-darwin/bitcoin-e181bda061ca-x86_64-apple-darwin-unsigned.zip
28327038413e7325f9d82687ebe063f4a5ce4dfce3cf95af071b376d96a261a6b5  guix-build-e181bda061ca/output/x86_64-linux-gnu/SHA256SUMS.part
2985e59bae13a52da47ecfd84d1f68578167ebef3b1f01195ad2ab3bd95cbc4c79  guix-build-e181bda061ca/output/x86_64-linux-gnu/bitcoin-e181bda061ca-x86_64-linux-gnu-debug.tar.gz
3098a1a05649608451e1ecd6624bc8a29bfde0b807814297c6ed081c3fcdf1d008  guix-build-e181bda061ca/output/x86_64-linux-gnu/bitcoin-e181bda061ca-x86_64-linux-gnu.tar.gz
3170828d3fcfc3fd36ae088d9b016ebdc5a344910c9c74db874e4f6e9934277eeb  guix-build-e181bda061ca/output/x86_64-w64-mingw32-codesigned/SHA256SUMS.part
32ef919b73e8d1658af4f36b66932205946826e8f28fc653d9315ea7bc297023c0  guix-build-e181bda061ca/output/x86_64-w64-mingw32-codesigned/bitcoin-e181bda061ca-win64-setup.exe
3369ad6eaa66fb8154bcdf259c0944bb2bcbc55626e22388fbbf74e7898adf30b8  guix-build-e181bda061ca/output/x86_64-w64-mingw32-codesigned/bitcoin-e181bda061ca-win64.zip
345b3a716a791387cce1178757b6541a19871aed744e1246ed332857ba3d00dd3f  guix-build-e181bda061ca/output/x86_64-w64-mingw32/SHA256SUMS.part
35c7174f6180ecffc72ca92e2832e810c0ba6e01b0e0d93d12e87648489c40d2f7  guix-build-e181bda061ca/output/x86_64-w64-mingw32/bitcoin-e181bda061ca-win64-codesigning.tar.gz
36dbef2b4fce7fccba81e26843408a6891e8dbe0065d18e73a0c0aa02caf9ad8b7  guix-build-e181bda061ca/output/x86_64-w64-mingw32/bitcoin-e181bda061ca-win64-debug.zip
3740002ea190fbbb1df2808aa30c21004e7291a088cde9a743c1dce396d2671a3b  guix-build-e181bda061ca/output/x86_64-w64-mingw32/bitcoin-e181bda061ca-win64-setup-unsigned.exe
389a5a9d4b1379b2ef0909e5bec0359ce90f495d9f3208a22cac9ac6d595da3edc  guix-build-e181bda061ca/output/x86_64-w64-mingw32/bitcoin-e181bda061ca-win64-unsigned.zip

Sjors commented at 9:07 am on February 20, 2025: member

I only guix-built the macOS hosts, and those hashes match @achow101.

When downloading with Safari:

the zip (GUI) archives work on both my ARM and Intel macs
for the tar.gz archive both M4 and Intel macs still refused to start bitcoind from Finder
- x86 (sha256: c6f7cc3e70bb02ea7103efde9875e450fae51bd6dea0736a1cdedc7a8c9fb6bc)
- arm (sha256: 3bec23389e5343dadc16ab3ed2bff897519a335ed970f8288521aa7ee7bdf4be)
when I run these binaries from the command line they work! 🎉

So the following workflow works, and is probably what most people do: download with Safari, which automatically extracts the gz layer. Then double-click to extract the Tar in Finder. And then start bitcoind from the terminal.

The only confusing bit is that you can’t start bitcoind from finder, which isn’t super useful anyway. Except for bitcoin-qt where this is annoying, however most GUI users will presumably download the zip archive.

Using xattr -dr com.apple.quarantine bitcoin-e181bda061ca/bin/bitcoin-qt frees up the binary so that you can run it from Finder as well. So it seems the binaries still get some level of quarantine, but at least they work from the terminal which is the most important.

Sjors commented at 9:37 am on February 20, 2025: member

@achow101 for 096525e92cc2f5a4318bae13cedd2cf36b928d5f did you only notarize the arm binaries and not x86? As a sanity check I tried that archive again, to see what happens I start binaries from the terminal. bitcoind works and the others refuse. Once I right-click open the other binaries, they start working. Since I right-click opened that version of bitcoind yesterday, that makes sense, and implies the notarization indeed helps.

One more thing worth trying might be to notarize the tar.gz archive. However it seems Finder launches things in a different way than the Terminal, and it might Just Not Work (tm): https://stackoverflow.com/a/75161940

An earlier Apple Forum thread also suggests that the way to notarize these binaries is to put the contents of the tar.gz archive into a zip and then upload: https://developer.apple.com/forums/thread/651759

achow101 commented at 3:52 pm on February 20, 2025: member

for 096525e did you only notarize the arm binaries and not x86?

Yes

One more thing worth trying might be to notarize the tar.gz archive.

Only binaries are notarized, not archives.

An earlier Apple Forum thread also suggests that the way to notarize these binaries is to put the contents of the tar.gz archive into a zip and then upload

That’s what we’re doing.

pinheadmz commented at 4:17 pm on February 20, 2025: member

Can confirm behavior described by @Sjors. Seems like apple is confusing itself?

but binary is signed:

 0--> codesign -vd --verbose=4 /Users/matthewzipkin/Desktop/bitcoin-e181bda061ca/bin/bitcoind 
 1Executable=/Users/matthewzipkin/Desktop/bitcoin-e181bda061ca/bin/bitcoind
 2Identifier=bitcoind
 3Format=Mach-O thin (arm64)
 4CodeDirectory v=20500 size=23284 flags=0x10000(runtime) hashes=722+2 location=embedded
 5VersionPlatform=1
 6VersionMin=851968
 7VersionSDK=917504
 8Hash type=sha256 size=32
 9CandidateCDHash sha256=b1d062a9bd9e4288b54b91045d0d3900b8186af3
10CandidateCDHashFull sha256=b1d062a9bd9e4288b54b91045d0d3900b8186af307a5b41749d47d20d970b603
11Hash choices=sha256
12CMSDigest=b1d062a9bd9e4288b54b91045d0d3900b8186af307a5b41749d47d20d970b603
13CMSDigestType=2
14Page size=16384
15CDHash=b1d062a9bd9e4288b54b91045d0d3900b8186af3
16Signature size=9008
17Authority=Developer ID Application: Bitcoin Core Code Signing Association (YZC7WH3MRU)
18Authority=Developer ID Certification Authority
19Authority=Apple Root CA
20Timestamp=Feb 19, 2025 at 3:35:41 PM
21Info.plist=not bound
22TeamIdentifier=YZC7WH3MRU
23Runtime Version=14.0.0
24Sealed Resources=none
25Internal requirements count=1 size=104

and running the binary from command line is fine:

0--> /Users/matthewzipkin/Desktop/bitcoin-e181bda061ca/bin/bitcoind 
12025-02-20T16:14:29Z Bitcoin Core version v28.99.0-ge181bda061ca63021511be6e286fdf6a5818df49 (release build)
22025-02-20T16:14:29Z Script verification uses 7 additional threads
3...

achow101 commented at 4:45 pm on February 20, 2025: member

According to https://developer.apple.com/forums/thread/706379, starting a command line tool from Finder just doesn’t work in general.

pinheadmz commented at 4:55 pm on February 20, 2025: member

Hm! It does work if I build and codesign remotely then download with SFTP.

Feb-20-2025 11-54-52

Sjors commented at 8:19 am on February 21, 2025: member

@pinheadmz you can even run ad-hoc signed binaries when you scp them.

Sjors commented at 8:33 am on February 21, 2025: member

An earlier Apple Forum thread also suggests that the way to notarize these binaries is to put the contents of the tar.gz archive into a zip and then upload

That’s what we’re doing.

Maybe I’m misreading the find incantation here:

0# Notarize the binaries
1# Binaries cannot have stapled notarizations so this does not actually generate any output
2binaries_dir=$(dirname "$(find . -maxdepth 2 -wholename '*/bin' -type d -exec realpath --relative-to=. {} \;)")
3${SIGNAPPLE} notarize --passphrase "${api_key_pass}" "$2" "$3" "${binaries_dir}"

But it seems that this only picks the binaries. But if I understand the Apple priests correctly, you have to send the whole package.

However I agree that if this works it would contradict this:

According to https://developer.apple.com/forums/thread/706379, starting a command line tool from Finder just doesn’t work in general.

Unless they recently fixed bug 58097824 (or do so in the future; it’s only been open for 5 years). But the step may be unnecessary in any case. Apple’s description of the issue suggest it’s really about individual binaries, not the archive.

Tool Blocked by Gatekeeper If your product includes a command-line tool, you might notice this behaviour: When you double click the tool in Finder, it’s blocked by Gatekeeper. When you run the tool from within Terminal, it works.

This is a known bug in macOS (r. 58097824). The issue is that, when you double click a tool in the Finder, it doesn’t run Gatekeeper’s standard execution logic. Rather, the Finder passes the tool to Terminal as a document and that opens a window (and associated shell) in which to run that document. This triggers Gatekeeper’s document logic, and that logic always blocks the tool.

There are two ways around this:

Embed your tool in an application. If the user runs the application first, Gatekeeper runs its normal application check. If the user allows the app to run, Gatekeeper records that decision and applies it to the app and any code within the app, including your tool.

This might explain what @darosior experienced when bundling bitcoind inside Liana: #31407 (comment)

And it’s potentially good news for a multiprocess future where the GUI might be launching a node process.

Install your tool using an installer package. When the user goes to install the package, Gatekeeper checks it. Assuming that check passes, Gatekeeper does no further checks on the content it installed.

I don’t think we want to go this route.

guix: Notarize MacOS app bundle and codesign all MacOS and Windows binaries #31407

Code Coverage & Benchmarks

Reviews

Detached sigs (tar xf and commit locally in bitcoin-detached-sigs to test):

all.SHA256SUMS

noncodesigned.SHA256SUMS

Non-Codesigned guix hashes

Windows code signed hashes

All osx

all.SHA256SUMS as of 096525e92cc2

Unsigned guix hashes

all.SHA256SUMS

unsigned

codesigned

all.SHA256SUMS

noncodesigned.SHA256SUMS

Detached sigs (`tar xf` and commit locally in `bitcoin-detached-sigs` to test):

`all.SHA256SUMS`

`noncodesigned.SHA256SUMS`