Previously, if the builder exported $VERSION in their environment (as
past Gitian-building docs told them to), but their HEAD does not
actually point to v$VERSION, their build outputs will differ from those
of other builders.
This is because the contrib/guix/guix-* scripts only ever act on the
current git worktree, and does not try to check out $VERSION if $VERSION
is set in the environment.
Setting $VERSION only makes the scripts pretend like the current
worktree is $VERSION.
This problem was seen in jonatack's attestation for all.SHA256SUMS,
where only his bitcoin-22.0rc3-osx-signed.dmg differed from everyone
else's.
Here is my deduced sequence of events:
1. Aug 27th: He guix-builds 22.0rc3 and uploads his attestations up to
guix.sigs
2. Aug 30th, sometime after POSIX time 1630310848: he pulls the latest
changes from master in the same worktree where he guix-built 22.0rc3
and ends up at 7be143a960
3. Aug 30th, sometime before POSIX time 1630315907: With his worktree
still on 7be143a960, he guix-codesigns. Normally, this would result
in outputs going in guix-build-7be143a960e2, but he had
VERSION=22.0rc3 in his environment, so the guix-* scripts pretended
like he was building 22.0rc3, and used 22.0rc3's guix-build directory
to locate un-codesigned outputs and dump codesigned ones.
However, our SOURCE_DATE_EPOCH defaults to the POSIX time of HEAD
(7be143a960), which made all timestamps in the resulting codesigned
DMG 1630310848, 7be143a960e2's POSIX timestamp. This differs from the
POSIX timestamp of 22.0rc3, which is 1630348517. Note that the
windows codesigning procedure does not consider SOURCE_DATE_EPOCH.
We resolve this by only allowing VERSION overrides via the FORCE_VERSION
environment variable.
======================================================================
ERROR: test_revocation_mode_soft (tests.test_validate.ValidateTests)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/tmp/guix-build-python-certvalidator-0.1-1.e5bdb4b.drv-0/source/tests/test_validate.py", line 85, in test_revocation_mode_soft
validate_path(context, path)
File "/tmp/guix-build-python-certvalidator-0.1-1.e5bdb4b.drv-0/source/tests/../certvalidator/validate.py", line 50, in validate_path
return _validate_path(validation_context, path)
File "/tmp/guix-build-python-certvalidator-0.1-1.e5bdb4b.drv-0/source/tests/../certvalidator/validate.py", line 358, in _validate_path
raise PathValidationError(pretty_message(
certvalidator.errors.PathValidationError: The path could not be validated because the end-entity certificate expired 2022-01-14 12:00:00Z
Github-Pull: #24057
Rebased-From: 8588591965
We forgot this for rc1. Thanks to Hebasto for fixing the import script.
Tree-SHA512: 127d0989dabf95867f4542e7f3134ef5d5045418b1411582772d60759e16a5090e30c83bffbbc44b2a496ba830a66bdb0d8ba0d2def43f3462a4f15edf64953a
This reverts commit 5e3019570f. That commit
erroneously made changes to translation files by hand, conflicting with
the automated translation pipeline.
Reverting will facilitate merging in upstream translation changes.
The version replacement here is not working anyway, not just that but it
is actively harmful as it removes all `-` from the text. So remove that
line. See discussion in #22681.
Tree-SHA512: 909c6225a50bbda1253bae65c09700a658bd36b5c91c91cea28d1df0aad5dc4adb095e0695259eca377536da34d17741ce453a5c5c50041d1163d94bbbe5355d
The uploaded binaries need to match the same flat directory structure of
the SHA256SUMS file in order for torrent downloaders to be able to
verify the download without moving files. Mention this in the release
process doc.
Github-Pull: bitcoin/bitcoin#22654
Rebased-From: 132cae44f2
The SHA256SUMS file can be used in a sha256sum -c command to verify
downloaded binaries. However users are likely to download just a single
file and not place this file in the correct directory relative to the
SHA256SUMS file for the simple verification command to work. By not
including the directory name in the SHA256SUMS file, it will be easier
for users to verify downloaded binaries.
Co-authored-by: Carl Dong <contact@carldong.me>
Github-Pull: bitcoin/bitcoin#22654
Rebased-From: fb17c99e35
Previously, building from a release source tarball would result in a
version string like v22.0.0-<commithash>, but we expect just v22.0.0.
This commit solves this problem.
Also use PACKAGE_VERSION instead of reconstructing it.
Github-Pull: bitcoin/bitcoin#22685
Rebased-From: 5100deee58
ApproximateBestSubset had an edge case (due to not using
GetSelectionAmount) where it was possible for it to return success but
fail to select enough to cover transaction fees. A test is added that
could trigger this failure prior to the fix being implemented.
Github-Pull: bitcoin/bitcoin#22686
Rebased-From: 92885c4f69
When the fee is not subtracted from the outputs, the amount that has
been reserved for the fee (change_and_fee - change_amount) must be
enough to cover the fee that is needed. It would be a bug to not do so,
so use an assert to make this obvious if such a situation were to occur.
Github-Pull: bitcoin/bitcoin#22686
Rebased-From: d9262324e8
For target value calculations, GetSelectionAmount should be used, not
m_effective_value or m_value.
Specifically, ApproximateBestSubset mistakenly uses m_value when
calculating whether the target value has been met. This has been changed
to use GetSelectionAmount.
Github-Pull: bitcoin/bitcoin#22686
Rebased-From: 2de222c401
This allows us to remove the rfc4880 EOL hacks and release with a
SHA256SUMS.asc file that's a combination of all signer signatures.
Github-Pull: bitcoin/bitcoin#22642
Rebased-From: 90b3e482e9
Previously, if verification fails, the correct message will be printed,
but the exit code would still be 0.
Github-Pull: bitcoin/bitcoin#22643
Rebased-From: d451b60d22
When no external signers are available, the option to enable external
signers should always be disabled. However the encrypt wallet checkbox
can erroneously re-enable the external signer checkbox. To avoid this,
CreateWalletDialog now stores whether signers were available during
setSigners so that future calls to external_signer_checkbox->setEnabled
can account for whether signers are available.
Github-Pull: bitcoin-core/gui#396
Rebased-From: a9b9ca82da
Adding a new item to the m_wallet_selector must follow the establishment
of signal-slot connections.
Github-Pull: bitcoin-core/gui#393
Rebased-From: d54d949598
If the user has set log.showSignature=true in their git config, then the
git log will always output GPG signature information. Since git log is
used to set EPOCH_SOURCE_DATE, this will mistakenly have GPG signature
information in it which causes issues for the build. To avoid this
issue, we override the config and force log.showSignature=false.
Github-Pull: #22531
Rebased-From: 9b313dfef1
guix-attest mistakenly added an extra \r to the line endings in
all.SHA256SUMS, causing guix-verify to erroneously fail.
Co-Authored-By: Carl Dong <contact@carldong.me>
Github-Pull: #22531
Rebased-From: 43225f0a2a
One of the issues observed during the 22.0rc1 release process was that a
codesigner's attestation mismatched non-codesigner attestations because
the guix-codesign step was performed prior to tagging the version in
bitcoin-detached-sigs.
Github-Pull: #22531
Rebased-From: d080c27066
When verifying guix attestations, it is useful to set a particular
signer's manifest as the base to compare against.
Github-Pull: #22531
Rebased-From: 4a466388a0
28c3836b5c PSET: docs: Fix constant names to match those actually used (Jon Griffiths)
7ef6c44225 PSET: docs: Fix the data type of PSBT_ELEMENTS_IN_PEG_IN_WITNESS (Jon Griffiths)
bb20a6c373 PSET: docs: Mark PSBT_ELEMENTS_GLOBAL_TX_MODIFIABLE bit 0 as reserved/unused (Jon Griffiths)
e7d994008e PSET: docs: Fix reference to non-existent PSBT_OUT_VALUE field (Jon Griffiths)
0b1b0b2676 PSET: docs: Document PSBT fields that are conditionally mandatory in PSET (Jon Griffiths)
Pull request description:
Following discussion with achow101
ACKs for top commit:
apoelstra:
utACK 28c3836b5c
Tree-SHA512: 72d4399a749bfb95042d7375e780a0992e1ca850af049de7710e48b8bcdb4cd7703f92882d83ba3131398b8f0aef01ae450721c9dd960bb7c700497a4a7be6fb
