Since we bumped to python 3.12, setuptools is no longer provided by default: https://docs.python.org/3.12/whatsnew/3.12.html#ensurepip Declare this explicitly.
Also bypass certvalidator's custom test loader using unittest, until this upstream patch makes it into our Guix time machine commit.
Commits split to allow easy reversion of only the imp test loader patch.
Fixes: #36421
Since we bumpted to python 3.12, setuptools is no longer provided by
default:
https://docs.python.org/3.12/whatsnew/3.12.html#ensurepip
> easy_install, pkg_resources, setuptools and distutils are no longer
> provided by default in environments created with venv or bootstrapped
> with ensurepip, since they are part of the setuptools package. For
> projects relying on these at runtime, the setuptools project should be
> declared as a dependency and installed separately (typically, using
> pip).
<!--e57a25ab6845829454e8d69fc972939a-->
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.
<!--006a51241073e994b41acfe9ec718e94-->
<!--021abf342d371248e50ceaed478a90ca-->
See the guideline and AI policy for information on the review process.
If your review is incorrectly listed, please copy-paste <code><!--meta-tag:bot-skip--></code> into the comment that the bot should ignore.
<!--5faf32d7da4f0f540f40219e4f7537a3-->
Reviewers can test building the codesign manifest without codesigning as per #36421 report:
HOST=x86_64-apple-darwin guix time-machine --url=https://codeberg.org/guix/guix.git --commit=60f6956aeffa7f30285745bd0ea615e9acfc74f8 -- build --manifest=contrib/guix/manifest_codesign.scm --keep-failed
Tested 82a8c8009a2b01c63a9d14c1f6ab3a3c232a27b5 on RISC-V hardware:
$ uname -a
Linux starfive 6.6.20-starfive [#1](/bitcoin-bitcoin/1/) SMP Sun May 5 22:39:25 CST 2024 riscv64 GNU/Linux
$ HOST=x86_64-apple-darwin guix time-machine --url=https://codeberg.org/guix/guix.git --commit=60f6956aeffa7f30285745bd0ea615e9acfc74f8 -- build --manifest=contrib/guix/manifest_codesign.scm --keep-failed
/gnu/store/gxs9c0jdqc43a1crvmr3gj4agnz31ax9-python-signapple-0.2.0-1.3fab3bb
/gnu/store/bj7ym082fay6nydzrlb5kzxkx6154h1x-git-minimal-2.54.0
/gnu/store/y8s5pl8b1jhb8dv417ivv7y2lf0q4m1s-zip-3.0
/gnu/store/z4jrhc9sadxsllvxvqn65fk7szdh6z9j-gzip-1.14
/gnu/store/bfxwpi7kzj7c8qhmkkay5mwjcsynqxs4-tar-1.35
/gnu/store/33m1f69x9g9m4fbg6kvdq2i5x486d159-findutils-4.10.0
/gnu/store/lbk75r1f1amqad62ywf88kg10i957q9b-coreutils-minimal-9.1
/gnu/store/2qfgs05zdmjy915ydfazcc1dlgbgp5p2-bash-minimal-5.2.37-doc
/gnu/store/qf0vnbskv0ryfpmkgs4smh34ms3nb0lk-bash-minimal-5.2.37
82a8c8009a2b01c63a9d14c1f6ab3a3c232a27b5
Does it make sense to rebase https://github.com/achow101/certvalidator/tree/allow-more-criticals onto https://github.com/wbond/certvalidator/tree/master, which already includes a fix for Python 3.12+?
Does it make sense to rebase achow101/certvalidator@
allow-more-criticalsonto wbond/certvalidator@master, which already includes a fix for Python 3.12+?
Yep, doing this and dropping the second commit (82a8c8009a2b01c63a9d14c1f6ab3a3c232a27b5) here would be nicer. @achow101 would you be able to handle the rebase as it's not so easy to submit a PR for? (or perhaps make a new branch)
Rebased that branch.
Python 3.12 removed imp, breaking the pinned Certvalidator test loader.
achow101 rebased allow-more-criticals onto upstream, which includes the
loader fix.
However the runner preloads oscrypto's OpenSSL backend, whose discovered
library names cannot be resolved in the isolated Guix build. Set its
supported OSCRYPTO_USE_OPENSSL variable to absolute library paths from
the existing OpenSSL input so the test suite can run.
Thanks @achow101
I have pushed a new second commit here, but unfortunately that rebase was not totally issue-free on its own :(
https://github.com/wbond/certvalidator/commit/9618d1b03564c9e09af13036146522112bb6006e introduces an early import of oscrypto's OpenSSL backend to print the library version before running tests. This fails in the Guix container because the dynamic loader cannot resolve libcrypto.so.3.
I've therefore set OSCRYPTO_USE_OPENSSL to the absolute library paths from our existing OpenSSL input.
If anyone has a better approach, I'm all ears :)
Approach ACK c04e968b2b8b7c8778910f907ed8c26ba59edd85.
ACK c04e968b2b8b7c8778910f907ed8c26ba59edd85.
ACK c04e968b2b8b7c8778910f907ed8c26ba59edd85
Confirmed the error on master during the codesign step of a guix build (at 4b4cdde064ca).
This branch, guix build with codesigning succeeded. (arm64-apple only)
all.SHA256SUMS:
06dd04f7ed8c1fafcc8972f89bed5aed2181692069f643ae95acce4f6b60ab36 bitcoin-c04e968b2b8b-arm64-apple-darwin.tar.gz
63d2671c87e14079a3b6e89c1e00207008db1db8e0354ac37e0b0c824f90b397 bitcoin-c04e968b2b8b-arm64-apple-darwin.zip
415c893a84fa69dc6e906088c08b0e22b502b27bf08473b7b9198944404e5a60 bitcoin-c04e968b2b8b-arm64-apple-darwin-codesigning.tar.gz
207c01ce82f0393647ac2a9749359ec424592effb4e1f56c8fd17e3cc3c20576 bitcoin-c04e968b2b8b-arm64-apple-darwin-unsigned.tar.gz
23f62699265ad29c2885ee7646509227b5064cde26db1ee5eac585de6fa71af8 bitcoin-c04e968b2b8b-arm64-apple-darwin-unsigned.zip
fda1df960a943de7899c3197e5f6d8ea40751d932ca54f70d8b5484c5b5e81d7 bitcoin-c04e968b2b8b-codesignatures-37a3ef499cad.tar.gz
d945e7acc3750de088b1ca6f53e47836816f71116c1b825cdfaeb09818f7ebf6 bitcoin-c04e968b2b8b.tar.gz
detached signature for arm64-apple-darwin:
https://github.com/pinheadmz/bitcoin-detached-sigs/tree/c04e968b2b
Happy signed: <img width="592" height="460" alt="Image" src="https://github.com/user-attachments/assets/5dc68151-47b8-41ce-a329-8971951ecbe3" />
<details><summary>Show Signature</summary>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
ACK c04e968b2b8b7c8778910f907ed8c26ba59edd85
-----BEGIN PGP SIGNATURE-----
iQJPBAEBCAA5FiEE5hdzzW4BBA4vG9eM5+KYS2KJyToFAmrPLDAbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEOfimEtiick6ahEQAIuyaWqSeQf1DTuz/Fep
GgYiGmcXhZCLXneZsI/HOdrE4x2XRtB50Dsz0uKgnhV7tNPGYj1NPXGLU5F9rI/T
3KLdpWvsUSihTCk0UzGbz3Xe2NyvGabT5eaH7mQVnwMLW6O8PgB9r1CAyTdSsCez
7QkYRHSjjGHqk1t6ba/n/z6zRborSDy3wetpK9MxXM+lfURAAF3h4viDZMksA/+U
9R7+OfUJY9NpZzfk0rRYH7gdT4bnNohjldQWmep3i2YxnM3jGe18ZJMqHTavYx7O
Tndl3OS8YA1RWobZ5neJCnY+CFDdJc9KRLwgzQl1IDESd1uXmvFWIkXxzp0993Ww
V5+LD0eWheTGhzly/vgi1XRKja4LN8HpZM4NsCyiIxSNSo7wwH83lDMOwgMvI/PL
A8xdu2ZmGyHRoKmwKvg8fWWq3grjcwJMdI6YSJ+zjZl6FQ2CR2lgipfXA8VYoQiA
GgvtdLpRqA1LE5p3IO8/xbhgxDXGOW2RZOQkdddItNuEkcmA6n1ZTXl1cPRpTHEE
bkN4DjMTvA4qB6Ztdo1sW+6hFh9/2Ju+HliG0HSVkdlPD1Vr90UIFD3/wtcExlKJ
+6FlrrD1Lgj+3LAuRI+GWGGkNFcIzAbq3jDu6JbkcAE+XiwelLpNm/ojnEnCPKSM
SFd3T/tiZuJOGzGiAtkna03z
=rte3
-----END PGP SIGNATURE-----
pinheadmz's public key is on openpgp.org
</details>