test: use notarized v28.2 binaries and fix macOS detection #32922

pull Sjors wants to merge 4 commits into bitcoin:master from Sjors:2025/07/codesign changing 2 files +18 −12
  1. Sjors commented at 11:15 AM on July 8, 2025: member

    Since #31407 macOS guix builds are signed and notarized. This was included in v29 and backported to 28.x.

    This PR bumps the v28.0 previous release binary to v28.2 and adjusts the test that uses it. Additionally it no longer manually code signs binaries >= v28.2.

    While testing on an M4 mac and redownloading all the binaries, I noticed that platform == "arm64-apple-darwin" doesn't actually work. This initially used args.platform in #26694, but that was changed to just platform in #32219.

    So the first commit switches this to use args.host. I manually tested on Intel macOS 13.7.6 that code-signing still isn't needed there (when downloading using a script).

    Also documented that you can set HOST.

  2. DrahtBot added the label Tests on Jul 8, 2025
  3. DrahtBot commented at 11:15 AM on July 8, 2025: contributor

    <!--e57a25ab6845829454e8d69fc972939a-->

    The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

    <!--006a51241073e994b41acfe9ec718e94-->

    Code Coverage & Benchmarks

    For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/32922.

    <!--021abf342d371248e50ceaed478a90ca-->

    Reviews

    See the guideline for information on the review process.

    Type Reviewers
    ACK m3dwards, maflcko

    If your review is incorrectly listed, please react with 👎 to this comment and the bot will ignore it on the next update.

    <!--5faf32d7da4f0f540f40219e4f7537a3-->

    LLM Linter (✨ experimental)

    Possible typos and grammar issues:

    • mac -> Mac [proper noun capitalization for Apple's Mac]

    <sup>drahtbot_id_4_m</sup>

  4. in test/get_previous_releases.py:214 in fbae1cf1ee outdated 
     210 | @@ -211,8 +211,9 @@ def download_binary(tag, args) -> int:
 211 |  
 212 |      Path(archive).unlink()
 213 |  
 214 | -    if tag >= "v23" and platform == "arm64-apple-darwin":
 215 | -        # Starting with v23 there are arm64 binaries for ARM (e.g. M1, M2) macs, but they have to be signed to run
 216 | +    if tag >= "v23" and tag < "v28.2" and platform == "arm64-apple-darwin":
    maflcko commented at 11:37 AM on July 8, 2025:

    the code is still wrong. Usually, it doesn't make sense to compare two values of completely unrelated types and a type-safe language would prevent this class of issues.

    Also, have you tested this code branch?

    Sjors commented at 11:52 AM on July 8, 2025:

    Oh oops, I did test it, but then broke it when switching the commit order.

  5. Sjors force-pushed on Jul 8, 2025
  6. Sjors commented at 11:59 AM on July 8, 2025: member

    cc @kdmukai, @m3dwards

  7. test: fix macOS detection 5bd73d96a3
  8. test: replace v28.0 with notarized v28.2
    Since #31407 guix builds are signed and notarized. This was backported to v28, so bump the version.
    c6dc2c29f8
  9. in test/get_previous_releases.py:214 in 95ab4db5d7 outdated 
     210 | @@ -211,8 +211,9 @@ def download_binary(tag, args) -> int:
 211 |  
 212 |      Path(archive).unlink()
 213 |  
 214 | -    if tag >= "v23" and platform == "arm64-apple-darwin":
 215 | -        # Starting with v23 there are arm64 binaries for ARM (e.g. M1, M2) macs, but they have to be signed to run
 216 | +    if tag >= "v23" and tag < "v28.2" and platform.system().lower() == "darwin" and platform.machine() == "arm64":
    maflcko commented at 2:20 PM on July 8, 2025:

    Your new code still looks wrong, when someone sets HOST=x86_64-apple-darwin on an arm machine, where signing isn't needed for that case.

    Why not use args.host and keep the "arm64-apple-darwin" string?

    Sjors commented at 2:31 PM on July 8, 2025:

    I don't understand the use case. Afaik you can't run the functional tests on such a cross-compiled build?

    maflcko commented at 3:00 PM on July 8, 2025:

    I don't have an apple, but i had the impression that rosetta will just run the x86_64 executable on the arm64?

    Sjors commented at 3:09 PM on July 8, 2025:

    Let me try if that actually works...

    Sjors commented at 4:12 PM on July 8, 2025:

    I switched to using args.host.

    With the previous version:

    cd depends
gmake HOST=x86_64-apple-darwin
cd ..
cmake -B build --toolchain /Users/sjors/dev/bitcoin-rosetta/depends/x86_64-apple-darwin/toolchain.cmake
cmake --build build

    The result is as expected:

    file -b build/bin/bitcoin
Mach-O 64-bit executable x86_64

    Meanwhile if you just call test/get_previous_releases.py, it's going to download arm binaries:

    test/get_previous_releases.py
file -b releases/v28.2/bin/bitcoind
Mach-O 64-bit executable arm64

    The functional tests pass just fine with this combo.

    But using the undocumented HOST env it will get x86:

    HOST=x86_64-apple-darwin test/get_previous_releases.py

    Which it will needlessly codesign, though it's not harmful.

  10. Sjors force-pushed on Jul 8, 2025
  11. Sjors commented at 4:12 PM on July 8, 2025: member

    I switched to args.host, see #32922 (review)

    Also documented that you can set HOST.

  12. in test/get_previous_releases.py:290 in 72c54492ea outdated 
     284 | @@ -284,7 +285,12 @@ def main(args) -> int:
 285 |  
 286 |  if __name__ == '__main__':
 287 |      parser = argparse.ArgumentParser(
 288 | -        formatter_class=argparse.ArgumentDefaultsHelpFormatter)
 289 | +        formatter_class=argparse.ArgumentDefaultsHelpFormatter,
 290 | +        epilog='''
 291 | +        HOST can be set to any of the `host-platform-triplet`s triplets from
    maflcko commented at 5:47 PM on July 8, 2025: 
            HOST can be set to any of the `host-platform-triplet`s from
  13. maflcko approved
  14. maflcko commented at 5:48 PM on July 8, 2025: member

    lgtm

  15. test: stop signing previous releases >= v28.2 609203d507
  16. test: document HOST for get_previous_releases.py 4bb4c86599
  17. in test/get_previous_releases.py:214 in 72c54492ea outdated 
     210 | @@ -211,8 +211,9 @@ def download_binary(tag, args) -> int:
 211 |  
 212 |      Path(archive).unlink()
 213 |  
 214 | -    if tag >= "v23" and platform == "arm64-apple-darwin":
 215 | -        # Starting with v23 there are arm64 binaries for ARM (e.g. M1, M2) macs, but they have to be signed to run
 216 | +    if tag >= "v23" and tag < "v28.2" and "arm64-apple-darwin":
    maflcko commented at 5:51 PM on July 8, 2025:

    I switched to args.host, see #32922 (review)

    I don't think you did. The line still looks wrong and is missing args.host.

    Sjors commented at 6:25 PM on July 8, 2025:

    Another rebase screwup, tried again... that should also fix the windows CI failure

  18. Sjors force-pushed on Jul 8, 2025
  19. m3dwards commented at 3:29 PM on July 14, 2025: contributor

    ACK 4bb4c865999bfa0b0cb5aa806cf62dbf982fcfe9

    Tested that the correct binaries were self signed on ARM Mac. Also checked the SHA256 sums for 28.2.

  20. maflcko commented at 8:08 AM on July 15, 2025: member

    review ACK 4bb4c865999bfa0b0cb5aa806cf62dbf982fcfe9 🚏

    <details><summary>Show signature</summary>

    Signature:

    untrusted comment: signature from minisign secret key on empty file; verify via: minisign -Vm "${path_to_any_empty_file}" -P RWTRmVTMeKV5noAMqVlsMugDDCyyTSbA3Re5AkUrhvLVln0tSaFWglOw -x "${path_to_this_whole_four_line_signature_blob}"
RUTRmVTMeKV5npGrKx1nqXCw5zeVHdtdYURB/KlyA/LMFgpNCs+SkW9a8N95d+U4AP1RJMi+krxU1A3Yux4bpwZNLvVBKy0wLgM=
trusted comment: review ACK 4bb4c865999bfa0b0cb5aa806cf62dbf982fcfe9 🚏
Pi0ZlqMjZ2h9BG6ZjDVKGx3MQl00wVVrmL/Obc2nPUOTs3OAjcYBntKJqxWMrnhbqbJQrDz9eKwsYLykAUboBA==

    </details>

  21. fanquake merged this on Jul 15, 2025
  22. fanquake closed this on Jul 15, 2025
  23. Sjors deleted the branch on Jul 15, 2025
  24. sedited referenced this in commit 02ded863ba on Jul 28, 2025
  25. sedited referenced this in commit 52d7f32bd6 on Jul 28, 2025
  26. alexanderwiederin referenced this in commit 28fe919bf7 on Aug 6, 2025
  27. sedited referenced this in commit b98d982d79 on Aug 7, 2025
  28. alexanderwiederin referenced this in commit 4152176d02 on Aug 8, 2025
  29. alexanderwiederin referenced this in commit 9ef94c31db on Aug 8, 2025
  30. stringintech referenced this in commit 71275a1b5e on Aug 17, 2025
  31. yuvicc referenced this in commit 22f55cf11d on Aug 26, 2025
  32. bug-castercv502 referenced this in commit 4aa5572aea on Sep 28, 2025
  33. kwvg referenced this in commit 91db092f7c on Oct 28, 2025
  34. stickies-v referenced this in commit a19c56cd7c on Nov 4, 2025
  35. kwvg referenced this in commit defd5367a1 on Dec 1, 2025
  36. kwvg referenced this in commit 4ce5e80211 on Dec 19, 2025
  37. kwvg referenced this in commit cbd2babc3d on Jan 15, 2026
  38. kwvg referenced this in commit 1a658bd90c on Jan 15, 2026
  39. kwvg referenced this in commit e5f86a4ff8 on Jan 15, 2026
  40. kwvg referenced this in commit 3f34ccc483 on Jan 15, 2026
  41. kwvg referenced this in commit e7e73aebe0 on Jan 16, 2026
  42. kwvg referenced this in commit db764a304c on Jan 18, 2026
  43. kwvg referenced this in commit b0b53db032 on Jan 22, 2026
  44. kwvg referenced this in commit 639e0f9167 on Jan 22, 2026
  45. kwvg referenced this in commit 49f815d613 on Jan 23, 2026
  46. PastaPastaPasta referenced this in commit 1ea35a436d on Jan 24, 2026
  47. Kino1994 referenced this in commit 89470ff1d6 on Jun 28, 2026
  48. BigcoinBGC referenced this in commit fdcfcc0bb4 on Jun 30, 2026
  49. bitcoin locked this on Jul 30, 2026
Contributors
SjorsDrahtBotmaflckom3dwards
Labels
Tests
Linked (view graph)
#26694 test: `get_previous_releases.py`: M1/M2 macs can't run unsigned arm64 binaries; self-sign when needed#31407 guix: Notarize MacOS app bundle and codesign all MacOS and Windows binaries#32219 test: enabling wallet migration functional test on windows
github-metadata-mirror

This is a metadata mirror of the GitHub repository bitcoin/bitcoin. This site is not affiliated with GitHub. Content is generated from a GitHub metadata backup.
generated: 2026-08-11 10:51 UTC
This site is hosted by @0xB10C
More mirrored repositories can be found on mirror.b10c.me