[32.x] Backports for rc2 #36267

1. 
   fanquake commented at 8:56 AM on September 16, 2026: member

   Backports:

   • #36256
   • #36260
2. guix: Use osslsigncode 2.14

   Versions prior to osslsigncode 2.14 unconditionally perform a full verification
   of the binary after signatures are attached. This verification requires
   having a reasonably up to date root CA file, and since 2.6, CRLs are
   validated which requires network access.
   
   The current manifest is both missing the root CA file, and the guix
   container does not and should not have network access.
   
   Our current guix time-machine has 2.13, while bumping it would give us
   2.14, that seems to be problematic for other packages, see #36233
   and #35855. Instead this copies in the package for osslsigncode 2.14 from
   guix.
   
   Github-Pull: #36256
   Rebased-From: 66eeac216ad5b5b8d42a727aa730d7fc603f55fe

   93229d8cdf
3. guix: Validate codesigned windows binaries

   `osslsigncode attach-signature` doesnot validate the signature at all,
   but we should be doing a signature check after applying to ensure that
   the signature itself is also valid.
   
   To avoid requiring the container to have network access, CRL checks are
   disabled.
   
   The package `nss-certs` is required so that a root CA file is available.
   
   Github-Pull: #36256
   Rebased-From: 59a465ce37829b2305319b378e8e85c9e653f29a

   e3380390c6
4. fanquake added this to the milestone 32.0 on Sep 16, 2026
5. DrahtBot added the label Backport on Sep 16, 2026
6. 
   DrahtBot commented at 8:56 AM on September 16, 2026: contributor

   <!--e57a25ab6845829454e8d69fc972939a-->

   The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

   <!--006a51241073e994b41acfe9ec718e94-->

   Code Coverage & Benchmarks

   For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/36267.

   <!--021abf342d371248e50ceaed478a90ca-->

   Reviews

   See the guideline and AI policy for information on the review process. A summary of reviews will appear here.

   <!--5faf32d7da4f0f540f40219e4f7537a3-->

7. torcontrol: Apply reconnect backoff after dropped connections

   Github-Pull: #36260
   Rebased-From: 4556ef62675400a4702d73c0a3e1dd4c7061a077

   deac114123

Milestone
32.0