guix: compute --build triplet when lowering, not at load time #36709

jespada commented at 2:53 PM on October 30, 2026: none

Why

building-on in contrib/guix/toolchains.scm reads (%current-system) once, when the module is loaded. guix shell loads the manifest before it applies --system, so the value is the system of the machine that runs the build, not the system that Guix builds for.

So a build with ADDITIONAL_GUIX_ENVIRONMENT_FLAGS="--system=aarch64-linux" on an x86_64 machine (for example with qemu-binfmt-service-type, to get an aarch64 build machine) configures the aarch64 cross toolchain with --build=x86_64-guix-linux-gnu. gcc-cross-sans-libc then fails to configure:

checking for CET support... configure: error: compiler and assembler with CET support are required for --enable-cet

What changes

building-on becomes a procedure, and its three call sites call it. Guix then computes the triplet for each derivation, under the system that the derivation is built for.

How I checked

On master, HOST=x86_64-linux-gnu guix shell -n --system=aarch64-linux -m contrib/guix/linux_static.scm (with toolchains.scm on the load path, as guix-build does) gives gcc-cross-sans-libc with --build=x86_64-guix-linux-gnu. With this PR it gives --build=aarch64-guix-linux-gnu. That is the same derivation that guix build -d --system=aarch64-linux gives on master.
Native builds (no --system): the toolchain derivations from linux_static.scm and manifest_gui.scm are identical on master and with this PR. So this PR does not change release builds.
With this PR, an emulated aarch64 build of x86_64-linux-gnu on x86_64 built the whole cross toolchain and the non-GUI binaries. The GUI environment then failed in the tests of python-pylint (timeout under emulation) and maturin (snapshot mismatch). These packages have no aarch64 substitutes at the pinned Guix commit, and the failures are not related to this change.

DrahtBot added the label Build system on Oct 30, 2026

DrahtBot commented at 2:53 PM on October 30, 2026: contributor

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

External sites

Code coverage & benchmarks: https://corecheck.dev/bitcoin/bitcoin/pulls/36709
Ralph review <img src=https://review.fish.foo/assets/bitcoin/bitcoin/36709.png alt="Ralph review status"> https://git.fish.foo/bitcoin/bitcoin/pulls/36709#author-ralph

Reviews

See the guideline and AI policy for information on the review process.

Type	Reviewers
ACK	hebasto

If your review is incorrectly listed, please copy-paste <code></code> into the comment that the bot should ignore.

Conflicts

Reviewers, this pull request conflicts with the following ones:

#25573 <sub><img src="https://drahtbot.space/ack_count/bitcoin/bitcoin/25573.svg"></sub> (guix: produce a -static-pie bitcoind by fanquake)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

jespada marked this as ready for review on Oct 30, 2026

sedited commented at 3:24 PM on October 30, 2026: contributor

How and why did you run into this?

hebasto commented at 3:33 PM on October 30, 2026: member

Concept ACK.

jespada commented at 3:38 PM on October 30, 2026: none

How and why did you run into this?

I hit it while trying to build #36708 with an aarch64 build machine (QEMU binfmt emulation on an x86_64 box, via ADDITIONAL_GUIX_ENVIRONMENT_FLAGS="--system=aarch64-linux"), to check that the build is reproducible across build architectures. I have a Guix box so I was looking for Guix issues to help with.

DrahtBot added the label Needs rebase on Nov 5, 2026

guix: compute --build triplet when lowering, not at load time

building-on read %current-system when toolchains.scm was loaded. guix
shell loads the manifest before it applies --system, so a
--system=aarch64-linux build on an x86_64 machine configured the aarch64
toolchain with --build=x86_64-guix-linux-gnu, and gcc-cross failed to
configure. Make building-on a procedure so each derivation uses its own
system. Native builds produce the same derivations as before.

d7a8360f4e

jespada force-pushed on Nov 5, 2026

DrahtBot removed the label Needs rebase on Nov 5, 2026

hebasto commented at 11:22 AM on November 7, 2026: member

ACK d7a8360f4ef5ff90b71d87b15ec4c5048b9ea0a9.

My Guix build:

$ uname -m && find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
aarch64
91a491a191ea0f1d7b0d79d05dff3cc42bd3da7b5f8d3d5a1b0cfeeba7871c06  guix-build-d7a8360f4ef5/output/aarch64-linux-gnu/SHA256SUMS.part
f1f4cfe7c8b474ab0fa1f53977e98d7c5c2a21bf805cba2e58ef583188362b1a  guix-build-d7a8360f4ef5/output/aarch64-linux-gnu/bitcoin-d7a8360f4ef5-aarch64-linux-gnu-debug.tar.gz
7dd49b58b70ff587fc307619e4e032834aee70e7d184d68ea3aee8af39efeabf  guix-build-d7a8360f4ef5/output/aarch64-linux-gnu/bitcoin-d7a8360f4ef5-aarch64-linux-gnu.tar.gz
f9ce8636376feecc8f9f739f2637caf57aa70fd421255051fe85d5264a5cc194  guix-build-d7a8360f4ef5/output/arm-linux-gnueabihf/SHA256SUMS.part
e24a061817591fc49cb00ef85f87283be296a28b457290c58b17da888c336c1d  guix-build-d7a8360f4ef5/output/arm-linux-gnueabihf/bitcoin-d7a8360f4ef5-arm-linux-gnueabihf-debug.tar.gz
b166eadc8ce042b7a354ef87ef641e618f9b35515b2a109f887c9af9eaf06a24  guix-build-d7a8360f4ef5/output/arm-linux-gnueabihf/bitcoin-d7a8360f4ef5-arm-linux-gnueabihf.tar.gz
f8f92ea423dff5373bc248318074221ac900f6935cbb0cfe031757fdc8f7696f  guix-build-d7a8360f4ef5/output/arm64-apple-darwin/SHA256SUMS.part
4762f28a99268c8393f98ba2ac296fe797b55c06eef97618c4519fe743f736a5  guix-build-d7a8360f4ef5/output/arm64-apple-darwin/bitcoin-d7a8360f4ef5-arm64-apple-darwin-codesigning.tar.gz
5bd5d1aaab7bf99580c09236cf2294eda1872efd9adfcf002e8321952d156363  guix-build-d7a8360f4ef5/output/arm64-apple-darwin/bitcoin-d7a8360f4ef5-arm64-apple-darwin-unsigned.tar.gz
b134bed7bde1b8c74f633ede6f174a69aa1364d5f7b3cde04a21c5dbed994965  guix-build-d7a8360f4ef5/output/arm64-apple-darwin/bitcoin-d7a8360f4ef5-arm64-apple-darwin-unsigned.zip
df38c7fd1056800d9aa999147f023dafd625ddcb6f7130a953475110702830cb  guix-build-d7a8360f4ef5/output/dist-archive/bitcoin-d7a8360f4ef5.tar.gz
9a185354e3adc402fd5e95530d973b355c6be9b4cfd3cbddcb82526bdafe1a71  guix-build-d7a8360f4ef5/output/powerpc64-linux-gnu/SHA256SUMS.part
2917a3424c03ec1d78c85410c8c315d46fd656168159c16c3a115ce2b06da1e7  guix-build-d7a8360f4ef5/output/powerpc64-linux-gnu/bitcoin-d7a8360f4ef5-powerpc64-linux-gnu-debug.tar.gz
7e7e1b3b898a496827cfc289730b63bf4a769ba6424314f9464672902146401e  guix-build-d7a8360f4ef5/output/powerpc64-linux-gnu/bitcoin-d7a8360f4ef5-powerpc64-linux-gnu.tar.gz
d19566acb20e218ad22b4f0b99af8d2fb75b399ecb1f0f4d3993cc903acf2a1b  guix-build-d7a8360f4ef5/output/riscv64-linux-gnu/SHA256SUMS.part
7576a31e2bceac71f02b800db57b6b1f19ad3f404c80db5c07aaa14392466af5  guix-build-d7a8360f4ef5/output/riscv64-linux-gnu/bitcoin-d7a8360f4ef5-riscv64-linux-gnu-debug.tar.gz
5ac65dc63adf4576d7cbeb46f4846e0ffe7ac7fb1ef21d8a5425e853a3d98605  guix-build-d7a8360f4ef5/output/riscv64-linux-gnu/bitcoin-d7a8360f4ef5-riscv64-linux-gnu.tar.gz
7088fd8d1d5b37bccb9ba942d0fe2c7589d94e9fbbf4cd5ca380b03d088b486d  guix-build-d7a8360f4ef5/output/x86_64-apple-darwin/SHA256SUMS.part
d8b2e5e352c19a0129bf709e6a19f00990e4b11ef12838267516fb05a1cb3b88  guix-build-d7a8360f4ef5/output/x86_64-apple-darwin/bitcoin-d7a8360f4ef5-x86_64-apple-darwin-codesigning.tar.gz
29acba17822404376983cbbffbf0db496b81c51e0c3bba09bec2987452d0b134  guix-build-d7a8360f4ef5/output/x86_64-apple-darwin/bitcoin-d7a8360f4ef5-x86_64-apple-darwin-unsigned.tar.gz
2c4ea6cba004f4c8a004a956314c89c23e6f240af26d254d2041ba67c77c7770  guix-build-d7a8360f4ef5/output/x86_64-apple-darwin/bitcoin-d7a8360f4ef5-x86_64-apple-darwin-unsigned.zip
c197f8f43640af8f973a9d8f9fd481abd7f265efad2e626b4d0fd73d813365e4  guix-build-d7a8360f4ef5/output/x86_64-linux-gnu/SHA256SUMS.part
337fe665a56c0379e7a413fbaec7f65bcdc464e4275e15a25c89db083859088f  guix-build-d7a8360f4ef5/output/x86_64-linux-gnu/bitcoin-d7a8360f4ef5-x86_64-linux-gnu-debug.tar.gz
f5ff0ec1b709ca5d7f03f290865a7c5d17fc074aa9101d58d82a442ccb300999  guix-build-d7a8360f4ef5/output/x86_64-linux-gnu/bitcoin-d7a8360f4ef5-x86_64-linux-gnu.tar.gz
c7ad1779489725c473a43ab4d6477d0debf8e750197ea5486a29a8a371469328  guix-build-d7a8360f4ef5/output/x86_64-w64-mingw32/SHA256SUMS.part
c6bdef8b70041e1938182fbeae8c93fe2f1ab741d4b564d6236865aaa700ca1c  guix-build-d7a8360f4ef5/output/x86_64-w64-mingw32/bitcoin-d7a8360f4ef5-win64-codesigning.tar.gz
8c0236964f5710e876759716d414c60593c6e7815a4d5d261c4413bdcbbb684e  guix-build-d7a8360f4ef5/output/x86_64-w64-mingw32/bitcoin-d7a8360f4ef5-win64-debug.zip
f112496188630e14fe6a7f073629420d2aa1eaef3312abcbd4f09fd61577391b  guix-build-d7a8360f4ef5/output/x86_64-w64-mingw32/bitcoin-d7a8360f4ef5-win64-setup-unsigned.exe
3fc7ffe189433c1cabc5f8ae8a8fb50caaed772ebbac9309ca803cf88754a108  guix-build-d7a8360f4ef5/output/x86_64-w64-mingw32/bitcoin-d7a8360f4ef5-win64-unsigned.zip