test: use notarized v28.2 binaries and fix macOS detection #32922

pull Sjors wants to merge 4 commits into bitcoin:master from Sjors:2025/07/codesign changing 2 files +18 −12
  1. Sjors commented at 11:15 am on July 8, 2025: member

    Since #31407 macOS guix builds are signed and notarized. This was included in v29 and backported to 28.x.

    This PR bumps the v28.0 previous release binary to v28.2 and adjusts the test that uses it. Additionally it no longer manually code signs binaries >= v28.2.

    While testing on an M4 mac and redownloading all the binaries, I noticed that platform == "arm64-apple-darwin" doesn’t actually work. This initially used args.platform in #26694, but that was changed to just platform in #32219.

    So the first commit switches this to use args.host. I manually tested on Intel macOS 13.7.6 that code-signing still isn’t needed there (when downloading using a script).

    Also documented that you can set HOST.

  2. DrahtBot added the label Tests on Jul 8, 2025
  3. DrahtBot commented at 11:15 am on July 8, 2025: contributor

    The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

    Code Coverage & Benchmarks

    For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/32922.

    Reviews

    See the guideline for information on the review process.

    Type Reviewers
    ACK m3dwards, maflcko

    If your review is incorrectly listed, please react with 👎 to this comment and the bot will ignore it on the next update.

    LLM Linter (✨ experimental)

    Possible typos and grammar issues:

    • mac -> Mac [proper noun capitalization for Apple’s Mac]

    drahtbot_id_4_m

  4. in test/get_previous_releases.py:214 in fbae1cf1ee outdated 
    210@@ -211,8 +211,9 @@ def download_binary(tag, args) -> int:
211 
212     Path(archive).unlink()
213 
214-    if tag >= "v23" and platform == "arm64-apple-darwin":
215-        # Starting with v23 there are arm64 binaries for ARM (e.g. M1, M2) macs, but they have to be signed to run
216+    if tag >= "v23" and tag < "v28.2" and platform == "arm64-apple-darwin":
    maflcko commented at 11:37 am on July 8, 2025:

    the code is still wrong. Usually, it doesn’t make sense to compare two values of completely unrelated types and a type-safe language would prevent this class of issues.

    Also, have you tested this code branch?

    Sjors commented at 11:52 am on July 8, 2025:
    Oh oops, I did test it, but then broke it when switching the commit order.
  5. Sjors force-pushed on Jul 8, 2025
  6. Sjors commented at 11:59 am on July 8, 2025: member
    cc @kdmukai, @m3dwards
  7. test: fix macOS detection 5bd73d96a3
  8. test: replace v28.0 with notarized v28.2 
    Since #31407 guix builds are signed and notarized. This was backported to v28, so bump the version.
    c6dc2c29f8
  9. in test/get_previous_releases.py:214 in 95ab4db5d7 outdated 
    210@@ -211,8 +211,9 @@ def download_binary(tag, args) -> int:
211 
212     Path(archive).unlink()
213 
214-    if tag >= "v23" and platform == "arm64-apple-darwin":
215-        # Starting with v23 there are arm64 binaries for ARM (e.g. M1, M2) macs, but they have to be signed to run
216+    if tag >= "v23" and tag < "v28.2" and platform.system().lower() == "darwin" and platform.machine() == "arm64":
    maflcko commented at 2:20 pm on July 8, 2025:

    Your new code still looks wrong, when someone sets HOST=x86_64-apple-darwin on an arm machine, where signing isn’t needed for that case.

    Why not use args.host and keep the "arm64-apple-darwin" string?

    Sjors commented at 2:31 pm on July 8, 2025:
    I don’t understand the use case. Afaik you can’t run the functional tests on such a cross-compiled build?
    maflcko commented at 3:00 pm on July 8, 2025:
    I don’t have an apple, but i had the impression that rosetta will just run the x86_64 executable on the arm64?
    Sjors commented at 3:09 pm on July 8, 2025:
    Let me try if that actually works…
    Sjors commented at 4:12 pm on July 8, 2025:

    I switched to using args.host.

    With the previous version:

    0cd depends
1gmake HOST=x86_64-apple-darwin
2cd ..
3cmake -B build --toolchain /Users/sjors/dev/bitcoin-rosetta/depends/x86_64-apple-darwin/toolchain.cmake
4cmake --build build

    The result is as expected:

    0file -b build/bin/bitcoin
1Mach-O 64-bit executable x86_64

    Meanwhile if you just call test/get_previous_releases.py, it’s going to download arm binaries:

    0test/get_previous_releases.py
1file -b releases/v28.2/bin/bitcoind
2Mach-O 64-bit executable arm64

    The functional tests pass just fine with this combo.

    But using the undocumented HOST env it will get x86:

    0HOST=x86_64-apple-darwin test/get_previous_releases.py

    Which it will needlessly codesign, though it’s not harmful.

  10. Sjors force-pushed on Jul 8, 2025
  11. Sjors commented at 4:12 pm on July 8, 2025: member

    I switched to args.host, see #32922 (review)

    Also documented that you can set HOST.

  12. in test/get_previous_releases.py:290 in 72c54492ea outdated 
    284@@ -284,7 +285,12 @@ def main(args) -> int:
285 
286 if __name__ == '__main__':
287     parser = argparse.ArgumentParser(
288-        formatter_class=argparse.ArgumentDefaultsHelpFormatter)
289+        formatter_class=argparse.ArgumentDefaultsHelpFormatter,
290+        epilog='''
291+        HOST can be set to any of the `host-platform-triplet`s triplets from
    maflcko commented at 5:47 pm on July 8, 2025: 
    0        HOST can be set to any of the `host-platform-triplet`s from
  13. maflcko approved
  14. maflcko commented at 5:48 pm on July 8, 2025: member
    lgtm
  15. test: stop signing previous releases >= v28.2 609203d507
  16. test: document HOST for get_previous_releases.py 4bb4c86599
  17. in test/get_previous_releases.py:214 in 72c54492ea outdated 
    210@@ -211,8 +211,9 @@ def download_binary(tag, args) -> int:
211 
212     Path(archive).unlink()
213 
214-    if tag >= "v23" and platform == "arm64-apple-darwin":
215-        # Starting with v23 there are arm64 binaries for ARM (e.g. M1, M2) macs, but they have to be signed to run
216+    if tag >= "v23" and tag < "v28.2" and "arm64-apple-darwin":
    maflcko commented at 5:51 pm on July 8, 2025:

    I switched to args.host, see #32922 (review)

    I don’t think you did. The line still looks wrong and is missing args.host.

    Sjors commented at 6:25 pm on July 8, 2025:
    Another rebase screwup, tried again… that should also fix the windows CI failure
  18. Sjors force-pushed on Jul 8, 2025
  19. m3dwards commented at 3:29 pm on July 14, 2025: contributor

    ACK 4bb4c865999bfa0b0cb5aa806cf62dbf982fcfe9

    Tested that the correct binaries were self signed on ARM Mac. Also checked the SHA256 sums for 28.2.

  20. maflcko commented at 8:08 am on July 15, 2025: member

    review ACK 4bb4c865999bfa0b0cb5aa806cf62dbf982fcfe9 🚏

    Signature:

    0untrusted comment: signature from minisign secret key on empty file; verify via: minisign -Vm "${path_to_any_empty_file}" -P RWTRmVTMeKV5noAMqVlsMugDDCyyTSbA3Re5AkUrhvLVln0tSaFWglOw -x "${path_to_this_whole_four_line_signature_blob}"
1RUTRmVTMeKV5npGrKx1nqXCw5zeVHdtdYURB/KlyA/LMFgpNCs+SkW9a8N95d+U4AP1RJMi+krxU1A3Yux4bpwZNLvVBKy0wLgM=
2trusted comment: review ACK 4bb4c865999bfa0b0cb5aa806cf62dbf982fcfe9 🚏
3Pi0ZlqMjZ2h9BG6ZjDVKGx3MQl00wVVrmL/Obc2nPUOTs3OAjcYBntKJqxWMrnhbqbJQrDz9eKwsYLykAUboBA==
  21. fanquake merged this on Jul 15, 2025
  22. fanquake closed this on Jul 15, 2025
  23. Sjors deleted the branch on Jul 15, 2025


Sjors DrahtBot maflcko m3dwards

Labels
Tests

github-metadata-mirror

This is a metadata mirror of the GitHub repository bitcoin/bitcoin. This site is not affiliated with GitHub. Content is generated from a GitHub metadata backup.
generated: 2025-11-22 06:13 UTC
This site is hosted by @0xB10C
More mirrored repositories can be found on mirror.b10c.me