guix: warn SOURCE_DATE_EPOCH set in guix-codesign

willcl-ark commented at 9:29 am on July 28, 2025: member

#32678 added a sanity check for this environment variable when running guix-build but missed that guix-codesign also relies on SOURCE_DATE_EPOCH, which can result in non-determinism in the codesigning step: https://github.com/bitcoin-core/guix.sigs/pull/1720#issuecomment-3124332676

To avoid repeating the logic move common functionality into the prelude and call the function in both guix actions.

Currently there is a warning for this in guix-build, but we also need
one in guix-codesign, otherwise the codesigned hashes are not
reproducible.

Move common functionality into prelude and call the function in both
guix actions.

1bed0f734b

DrahtBot added the label Build system on Jul 28, 2025

DrahtBot commented at 9:29 am on July 28, 2025: contributor

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/33073.

Reviews

See the guideline for information on the review process.

Type	Reviewers
ACK	fanquake

If your review is incorrectly listed, please react with 👎 to this comment and the bot will ignore it on the next update.

fanquake added the label Needs backport (29.x) on Jul 28, 2025

fanquake added the label DrahtBot Guix build requested on Jul 28, 2025

willcl-ark commented at 12:16 pm on July 28, 2025: member

My guix build with this change:

 0src/core/bitcoin on  codesign-source-epoch [$] via △ v3.31.6 via 🐍 v3.13.3 via ❄️  impure (nix-shell-env) took 1h33m13s
 1❯ find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
 2b8961023686b6aa3cef95f9f938c1c4b9c1e87945ea60c994dbe56c430faf43e  guix-build-1bed0f734b3f/output/aarch64-linux-gnu/SHA256SUMS.part
 390f9c040b2640cc7840cdb9341170c754b107ef7c681c762e8d69e3641378322  guix-build-1bed0f734b3f/output/aarch64-linux-gnu/bitcoin-1bed0f734b3f-aarch64-linux-gnu-debug.tar.gz
 47ead728efa409a754eea8cd9a41471fc65395e3d8020fd78ba8ad5b8a4dce5ba  guix-build-1bed0f734b3f/output/aarch64-linux-gnu/bitcoin-1bed0f734b3f-aarch64-linux-gnu.tar.gz
 58c849eb48e351606d4f4ed3cd0746b711a8c5f714fa22c961693d90e6908bd5a  guix-build-1bed0f734b3f/output/arm-linux-gnueabihf/SHA256SUMS.part
 6089995052f39a482a42e27792514f20c63be38c8638400ffc81c22b9f9d03563  guix-build-1bed0f734b3f/output/arm-linux-gnueabihf/bitcoin-1bed0f734b3f-arm-linux-gnueabihf-debug.tar.gz
 7ae78a8cb9f90ae71b5d09efb1f4f8b7be342b14e295ffcba42ed08d63cb09652  guix-build-1bed0f734b3f/output/arm-linux-gnueabihf/bitcoin-1bed0f734b3f-arm-linux-gnueabihf.tar.gz
 885a93af77bcf6ec56468c2fdfb29bcc33af4a16764e966a5f81e80dfa6f9137b  guix-build-1bed0f734b3f/output/arm64-apple-darwin/SHA256SUMS.part
 9a486db97880d12e594113864490a5955348a7fdaaecb61a5b0c2add823198a5e  guix-build-1bed0f734b3f/output/arm64-apple-darwin/bitcoin-1bed0f734b3f-arm64-apple-darwin-codesigning.tar.gz
1000ab78b1154abeebcc9b48368517b575e56855b786ba0bb336cd10321b0902d7  guix-build-1bed0f734b3f/output/arm64-apple-darwin/bitcoin-1bed0f734b3f-arm64-apple-darwin-unsigned.tar.gz
11f453b6e8596d3fce62672e21a2a2dcd6d44cbeb0330bd9605c210420e8f5fe5f  guix-build-1bed0f734b3f/output/arm64-apple-darwin/bitcoin-1bed0f734b3f-arm64-apple-darwin-unsigned.zip
125a0ed6f1fb2559db37cecec7ffae4ebd6233ee0ccef60749a00f4a1bb2eb9224  guix-build-1bed0f734b3f/output/dist-archive/bitcoin-1bed0f734b3f.tar.gz
133dcb8a9ca1596b1b81e9c179d188d246a15005087fe4d3af51cad8a99f2a814c  guix-build-1bed0f734b3f/output/powerpc64-linux-gnu/SHA256SUMS.part
148f911910a5bb1ecf3381ed99ee84b1d3cbd12e03e7f367ab63f99f7a18f35cd7  guix-build-1bed0f734b3f/output/powerpc64-linux-gnu/bitcoin-1bed0f734b3f-powerpc64-linux-gnu-debug.tar.gz
15eb26e8a525c2181274d623a8819319b2b6038ffc20504d8c83b223c7a9f24db8  guix-build-1bed0f734b3f/output/powerpc64-linux-gnu/bitcoin-1bed0f734b3f-powerpc64-linux-gnu.tar.gz
16b8042aaa0653fbb01f63087df43a40d5a8b1503e6644c7eeaa9ff878e29ba79d  guix-build-1bed0f734b3f/output/riscv64-linux-gnu/SHA256SUMS.part
17580b3bebd7f538fbc672d2436aae793fce1308ab887e6443a7a4c8a7dd4d2e67  guix-build-1bed0f734b3f/output/riscv64-linux-gnu/bitcoin-1bed0f734b3f-riscv64-linux-gnu-debug.tar.gz
186cb7c20dec2a5d8a54072d7ac24335a287acc7627339b6c7558f8a1af049f3a8  guix-build-1bed0f734b3f/output/riscv64-linux-gnu/bitcoin-1bed0f734b3f-riscv64-linux-gnu.tar.gz
19a7150c3951a8602ff2cefbf9f7337504d4aa3936a52d40c4bc130230a0b76784  guix-build-1bed0f734b3f/output/x86_64-apple-darwin/SHA256SUMS.part
20af94ae599d26d0209d45665190f6eaeebeb3b6d8445cfc8c83cbc99dc7bafe19  guix-build-1bed0f734b3f/output/x86_64-apple-darwin/bitcoin-1bed0f734b3f-x86_64-apple-darwin-codesigning.tar.gz
21bb4457095e8da9ec2289a0f8f49e05fdf257800d3110c6fff85e44562d8f8f1c  guix-build-1bed0f734b3f/output/x86_64-apple-darwin/bitcoin-1bed0f734b3f-x86_64-apple-darwin-unsigned.tar.gz
22839e06f52099438087ba9299c7563c2eb94236c212cdc57f24c1e31e349a8afe  guix-build-1bed0f734b3f/output/x86_64-apple-darwin/bitcoin-1bed0f734b3f-x86_64-apple-darwin-unsigned.zip
2333ff69f4f4828f8f5a20c3a3a4d6cbbb779449a9cc33830d0a627e3eadf889d6  guix-build-1bed0f734b3f/output/x86_64-linux-gnu/SHA256SUMS.part
24232646b93c9ed7d02db7c9ea19f51ab28839e9531fa968ed4c359ba2d3d57f51  guix-build-1bed0f734b3f/output/x86_64-linux-gnu/bitcoin-1bed0f734b3f-x86_64-linux-gnu-debug.tar.gz
25eeb8f20a1c5e999bb8a5f218573b7efb6694d81e2b00705e21c2783b4f0e95a7  guix-build-1bed0f734b3f/output/x86_64-linux-gnu/bitcoin-1bed0f734b3f-x86_64-linux-gnu.tar.gz
26f1b08da31de4cbcb4a370d8aa5911144821c439db921c61d90587c69840a3fce  guix-build-1bed0f734b3f/output/x86_64-w64-mingw32/SHA256SUMS.part
279600573f6d1999b43e4c0c61380096c9a8c0c38bb9373668917fcd79134c5a77  guix-build-1bed0f734b3f/output/x86_64-w64-mingw32/bitcoin-1bed0f734b3f-win64-codesigning.tar.gz
2833ad5f5cd4a5f252b02a3f42b3db458a8c5b6e212cd99dd6a642b2fa2cd5aae9  guix-build-1bed0f734b3f/output/x86_64-w64-mingw32/bitcoin-1bed0f734b3f-win64-debug.zip
2931cdf0efd9864daa1ca4de217fe18f60b5373e617091e784510c92de2512a563  guix-build-1bed0f734b3f/output/x86_64-w64-mingw32/bitcoin-1bed0f734b3f-win64-setup-unsigned.exe
3082bf14fccb233acf0ebf4bf4eafeb3bb4f620ab91e356446e06ea7da5b882f1d  guix-build-1bed0f734b3f/output/x86_64-w64-mingw32/bitcoin-1bed0f734b3f-win64-unsigned.zip

fanquake commented at 4:38 pm on July 28, 2025: member

Guix Build (aarch64):

 0b8961023686b6aa3cef95f9f938c1c4b9c1e87945ea60c994dbe56c430faf43e  guix-build-1bed0f734b3f/output/aarch64-linux-gnu/SHA256SUMS.part
 190f9c040b2640cc7840cdb9341170c754b107ef7c681c762e8d69e3641378322  guix-build-1bed0f734b3f/output/aarch64-linux-gnu/bitcoin-1bed0f734b3f-aarch64-linux-gnu-debug.tar.gz
 27ead728efa409a754eea8cd9a41471fc65395e3d8020fd78ba8ad5b8a4dce5ba  guix-build-1bed0f734b3f/output/aarch64-linux-gnu/bitcoin-1bed0f734b3f-aarch64-linux-gnu.tar.gz
 38c849eb48e351606d4f4ed3cd0746b711a8c5f714fa22c961693d90e6908bd5a  guix-build-1bed0f734b3f/output/arm-linux-gnueabihf/SHA256SUMS.part
 4089995052f39a482a42e27792514f20c63be38c8638400ffc81c22b9f9d03563  guix-build-1bed0f734b3f/output/arm-linux-gnueabihf/bitcoin-1bed0f734b3f-arm-linux-gnueabihf-debug.tar.gz
 5ae78a8cb9f90ae71b5d09efb1f4f8b7be342b14e295ffcba42ed08d63cb09652  guix-build-1bed0f734b3f/output/arm-linux-gnueabihf/bitcoin-1bed0f734b3f-arm-linux-gnueabihf.tar.gz
 685a93af77bcf6ec56468c2fdfb29bcc33af4a16764e966a5f81e80dfa6f9137b  guix-build-1bed0f734b3f/output/arm64-apple-darwin/SHA256SUMS.part
 7a486db97880d12e594113864490a5955348a7fdaaecb61a5b0c2add823198a5e  guix-build-1bed0f734b3f/output/arm64-apple-darwin/bitcoin-1bed0f734b3f-arm64-apple-darwin-codesigning.tar.gz
 800ab78b1154abeebcc9b48368517b575e56855b786ba0bb336cd10321b0902d7  guix-build-1bed0f734b3f/output/arm64-apple-darwin/bitcoin-1bed0f734b3f-arm64-apple-darwin-unsigned.tar.gz
 9f453b6e8596d3fce62672e21a2a2dcd6d44cbeb0330bd9605c210420e8f5fe5f  guix-build-1bed0f734b3f/output/arm64-apple-darwin/bitcoin-1bed0f734b3f-arm64-apple-darwin-unsigned.zip
105a0ed6f1fb2559db37cecec7ffae4ebd6233ee0ccef60749a00f4a1bb2eb9224  guix-build-1bed0f734b3f/output/dist-archive/bitcoin-1bed0f734b3f.tar.gz
113dcb8a9ca1596b1b81e9c179d188d246a15005087fe4d3af51cad8a99f2a814c  guix-build-1bed0f734b3f/output/powerpc64-linux-gnu/SHA256SUMS.part
128f911910a5bb1ecf3381ed99ee84b1d3cbd12e03e7f367ab63f99f7a18f35cd7  guix-build-1bed0f734b3f/output/powerpc64-linux-gnu/bitcoin-1bed0f734b3f-powerpc64-linux-gnu-debug.tar.gz
13eb26e8a525c2181274d623a8819319b2b6038ffc20504d8c83b223c7a9f24db8  guix-build-1bed0f734b3f/output/powerpc64-linux-gnu/bitcoin-1bed0f734b3f-powerpc64-linux-gnu.tar.gz
14b8042aaa0653fbb01f63087df43a40d5a8b1503e6644c7eeaa9ff878e29ba79d  guix-build-1bed0f734b3f/output/riscv64-linux-gnu/SHA256SUMS.part
15580b3bebd7f538fbc672d2436aae793fce1308ab887e6443a7a4c8a7dd4d2e67  guix-build-1bed0f734b3f/output/riscv64-linux-gnu/bitcoin-1bed0f734b3f-riscv64-linux-gnu-debug.tar.gz
166cb7c20dec2a5d8a54072d7ac24335a287acc7627339b6c7558f8a1af049f3a8  guix-build-1bed0f734b3f/output/riscv64-linux-gnu/bitcoin-1bed0f734b3f-riscv64-linux-gnu.tar.gz
17a7150c3951a8602ff2cefbf9f7337504d4aa3936a52d40c4bc130230a0b76784  guix-build-1bed0f734b3f/output/x86_64-apple-darwin/SHA256SUMS.part
18af94ae599d26d0209d45665190f6eaeebeb3b6d8445cfc8c83cbc99dc7bafe19  guix-build-1bed0f734b3f/output/x86_64-apple-darwin/bitcoin-1bed0f734b3f-x86_64-apple-darwin-codesigning.tar.gz
19bb4457095e8da9ec2289a0f8f49e05fdf257800d3110c6fff85e44562d8f8f1c  guix-build-1bed0f734b3f/output/x86_64-apple-darwin/bitcoin-1bed0f734b3f-x86_64-apple-darwin-unsigned.tar.gz
20839e06f52099438087ba9299c7563c2eb94236c212cdc57f24c1e31e349a8afe  guix-build-1bed0f734b3f/output/x86_64-apple-darwin/bitcoin-1bed0f734b3f-x86_64-apple-darwin-unsigned.zip
2133ff69f4f4828f8f5a20c3a3a4d6cbbb779449a9cc33830d0a627e3eadf889d6  guix-build-1bed0f734b3f/output/x86_64-linux-gnu/SHA256SUMS.part
22232646b93c9ed7d02db7c9ea19f51ab28839e9531fa968ed4c359ba2d3d57f51  guix-build-1bed0f734b3f/output/x86_64-linux-gnu/bitcoin-1bed0f734b3f-x86_64-linux-gnu-debug.tar.gz
23eeb8f20a1c5e999bb8a5f218573b7efb6694d81e2b00705e21c2783b4f0e95a7  guix-build-1bed0f734b3f/output/x86_64-linux-gnu/bitcoin-1bed0f734b3f-x86_64-linux-gnu.tar.gz
24f1b08da31de4cbcb4a370d8aa5911144821c439db921c61d90587c69840a3fce  guix-build-1bed0f734b3f/output/x86_64-w64-mingw32/SHA256SUMS.part
259600573f6d1999b43e4c0c61380096c9a8c0c38bb9373668917fcd79134c5a77  guix-build-1bed0f734b3f/output/x86_64-w64-mingw32/bitcoin-1bed0f734b3f-win64-codesigning.tar.gz
2633ad5f5cd4a5f252b02a3f42b3db458a8c5b6e212cd99dd6a642b2fa2cd5aae9  guix-build-1bed0f734b3f/output/x86_64-w64-mingw32/bitcoin-1bed0f734b3f-win64-debug.zip
2731cdf0efd9864daa1ca4de217fe18f60b5373e617091e784510c92de2512a563  guix-build-1bed0f734b3f/output/x86_64-w64-mingw32/bitcoin-1bed0f734b3f-win64-setup-unsigned.exe
2882bf14fccb233acf0ebf4bf4eafeb3bb4f620ab91e356446e06ea7da5b882f1d  guix-build-1bed0f734b3f/output/x86_64-w64-mingw32/bitcoin-1bed0f734b3f-win64-unsigned.zip

DrahtBot commented at 7:39 am on July 29, 2025: contributor

Guix builds (on x86_64) [untrusted test-only build, possibly unsafe, not for production use]

File	commit c8309198f81207b93e05189483a3c5effc5333a6(master)	commit c3fb5cc241c0996ae88cca47061340304bb9ceb3(pull/33073/merge)
*-aarch64-linux-gnu-debug.tar.gz	`b627f86964f908d8...`	`c173b9a4b6377ff1...`
*-aarch64-linux-gnu.tar.gz	`ba64547aada0e613...`	`086bd2bdd9c58c50...`
*-arm-linux-gnueabihf-debug.tar.gz	`8de3c56380cfe798...`	`126dc927aa3621ae...`
*-arm-linux-gnueabihf.tar.gz	`d6d4fb45442ee3a5...`	`04b758f2423ecfc1...`
*-arm64-apple-darwin-codesigning.tar.gz	`25d88e4a44d49dad...`	`c7b1d58970ca4a33...`
*-arm64-apple-darwin-unsigned.tar.gz	`b353c44c71b777fc...`	`91160f78e50029d6...`
*-arm64-apple-darwin-unsigned.zip	`9265c95046dd29c2...`	`6e6cf03358743b0b...`
*-powerpc64-linux-gnu-debug.tar.gz	`8213c6b28fac2f32...`	`6c24aeca7b03cb31...`
*-powerpc64-linux-gnu.tar.gz	`f0ae90357e067e75...`	`0421d5e8b70e7cc9...`
*-riscv64-linux-gnu-debug.tar.gz	`29349202f3424785...`	`a909d8f7f598cf15...`
*-riscv64-linux-gnu.tar.gz	`6886b0cb37e792af...`	`396bf98237127a27...`
*-x86_64-apple-darwin-codesigning.tar.gz	`4651862c176b295d...`	`c9097d15ddfd0c5d...`
*-x86_64-apple-darwin-unsigned.tar.gz	`edbeb3ce95b31a49...`	`d99c7eafa1da319c...`
*-x86_64-apple-darwin-unsigned.zip	`b51618c866ca76a7...`	`6961b9ad59721e4c...`
*-x86_64-linux-gnu-debug.tar.gz	`a999c22217dadf8c...`	`15b013dfd4d14ab2...`
*-x86_64-linux-gnu.tar.gz	`7df6a0e319e59953...`	`43a34e1e31946915...`
*.tar.gz	`1d2ccfb756337a99...`	`bedd66edf51e5fcd...`
SHA256SUMS.part	`08034e5182441ce3...`	`4d94150c8039cedb...`
guix_build.log	`658734d64cfee666...`	`29c9510fe6cdd230...`
guix_build.log.diff		`54e3ea14e00ed5be...`

DrahtBot removed the label DrahtBot Guix build requested on Jul 29, 2025

fanquake approved

fanquake commented at 3:27 pm on July 29, 2025: member

ACK 1bed0f734b3f2dd876193b5cad303bfab1d250d5

fanquake merged this on Jul 29, 2025

fanquake closed this on Jul 29, 2025

fanquake referenced this in commit a18b53f99e on Jul 29, 2025

fanquake removed the label Needs backport (29.x) on Jul 29, 2025

fanquake commented at 3:37 pm on July 29, 2025: member

Backported to 29.x in #33074.

fanquake referenced this in commit 8782e6ce38 on Jul 29, 2025

fanquake commented at 3:54 pm on July 29, 2025: member

Backported to 28.x in #33076.

guix: warn SOURCE_DATE_EPOCH set in guix-codesign #33073

Code Coverage & Benchmarks

Reviews

Guix builds (on x86_64) [untrusted test-only build, possibly unsafe, not for production use]