751549b52a9a4cd27389d807ae67f02bbb39cd7f contrib: guix: Additional clarifications re: substitutes (Carl Dong)
cd3e947f50db7cfe05c05b368c25742193729a62 contrib: guix: Various improvements. (Carl Dong)
8dff3e48a9e03299468ed3b342642f01f70da9db contrib: guix: Clarify SOURCE_DATE_EPOCH. (Carl Dong)
3e80ec3ea9691c7c89173de922a113e643fe976b contrib: Add deterministic Guix builds. (Carl Dong)
Pull request description:
~~**This post is kept updated as this project progresses. Use this [latest update link](https://github.com/bitcoin/bitcoin/pull/15277#issuecomment-497303718) to see what's new.**~~
Please read the `README.md`.
-----
### Guix Introduction
This PR enables building bitcoin in Guix containers. [Guix](https://www.gnu.org/software/guix/manual/en/html_node/Features.html) is a transactional package manager much like Nix, but unlike Nix, it has more of a focus on [bootstrappability](https://www.gnu.org/software/guix/manual/en/html_node/Bootstrapping.html) and [reproducibility](https://www.gnu.org/software/guix/blog/tags/reproducible-builds/) which are attractive for security-sensitive projects like bitcoin.
### Guix Build Walkthrough
Please read the `README.md`.
[Old instructions no. 4](https://github.com/bitcoin/bitcoin/pull/15277#issuecomment-497303718)
[Old instructions no. 3](https://github.com/bitcoin/bitcoin/pull/15277#issuecomment-493827011)
[Old instructions no. 2](https://github.com/bitcoin/bitcoin/pull/15277#issuecomment-471658439)
<details>
<summary>Old instructions no. 1</summary>
In this PR, we define a Guix [manifest](https://www.gnu.org/software/guix/manual/en/html_node/Invoking-guix-package.html#profile_002dmanifest) in `contrib/guix/manifest.scm`, which declares what packages we want in our environment.
We can then invoke
```
guix environment --manifest=contrib/guix/manifest.scm --container --pure --no-grafts --no-substitutes
```
To have Guix:
1. Build an environment containing the packages we defined in our `contrib/guix/manifest.scm` manifest from the Guix bootstrap binaries (see [bootstrappability](https://www.gnu.org/software/guix/manual/en/html_node/Bootstrapping.html) for more details).
2. Start a container with that environment that has no network access, and no access to the host's filesystem except to the `pwd` that it was started in.
3. Drop you into a shell in that container.
> Note: if you don't want to wait hours for Guix to build the entire world from scratch, you can eliminate the `--no-substitutes` option to have Guix download from available binary sources. Note that this convenience doesn't necessarily compromise your security, as you can check that a package was built correctly after the fact using `guix build --check <packagename>`
Therefore, we can perform a build of bitcoin much like in Gitian by invoking the following:
```
make -C depends -j"$(nproc)" download && \
cat contrib/guix/build.sh | guix environment --manifest=contrib/guix/manifest.scm --container --pure --no-grafts --no-substitutes
```
We don't include `make -C depends -j"$(nproc)" download` inside `contrib/guix/build.sh` because `contrib/guix/build.sh` is run inside the container, which has no network access (which is a good thing).
</details>
### Rationale
I believe that this represents a substantial improvement for the "supply chain security" of bitcoin because:
1. We no longer have to rely on Ubuntu for our build environment for our releases ([oh the horror](72bd4ab867/contrib/gitian-descriptors/gitian-linux.yml (L10))), because Guix builds everything about the container, we can perform this on almost any Linux distro/system.
2. It is now much easier to determine what trusted binaries are in our supply chain, and even make a nice visualization! (see [bootstrappability](https://www.gnu.org/software/guix/manual/en/html_node/Bootstrapping.html)).
3. There is active effort among Guix folks to minimize the number of trusted binaries even further. OriansJ's [stage0](https://github.com/oriansj/stage0), and janneke's [Mes](https://www.gnu.org/software/mes/) all aim to achieve [reduced binary boostrap](http://joyofsource.com/reduced-binary-seed-bootstrap.html) for Guix. In fact, I believe if OriansJ gets his way, we will end up some day with only a single trusted binary: hex0 (a ~500 byte self-hosting hex assembler).
### Steps to Completion
- [x] Successfully build bitcoin inside the Guix environment
- [x] Make `check-symbols` pass
- [x] Do the above but without nasty hacks
- [x] Solve some of the more innocuous hacks
- [ ] Make it cross-compile (HELP WANTED HERE)
- [x] Linux
- [x] x86_64-linux-gnu
- [x] i686-linux-gnu
- [x] aarch64-linux-gnu
- [x] arm-linux-gnueabihf
- [x] riscv64-linux-gnu
- [ ] OS X
- [ ] x86_64-apple-darwin14
- [ ] Windows
- [ ] x86_64-w64-mingw32
- [ ] Maybe make importer for depends syntax
- [ ] Document build process for future releases
- [ ] Extra: Pin the revision of Guix that we build with with Guix [inferiors](https://www.gnu.org/software/guix/manual/en/html_node/Inferiors.html)
### Help Wanted
[Old content no. 3](https://github.com/bitcoin/bitcoin/pull/15277#issuecomment-483318210)
[Old content no. 2](https://github.com/bitcoin/bitcoin/pull/15277#issuecomment-471658439)
<details>
<summary>Old content no. 1</summary>
As of now, the command described above to perform a build of bitcoin a lot like Gitian works, but fails at the `check-symbols` stage. This is because a few dynamic libraries are linked in that shouldn't be.
Here's what `ldd src/bitcoind` looks like when built in a Guix container:
```
linux-vdso.so.1 (0x00007ffcc2d90000)
libdl.so.2 => /gnu/store/h90vnqw0nwd0hhm1l5dgxsdrigddfmq4-glibc-2.28/lib/libdl.so.2 (0x00007fb7eda09000)
librt.so.1 => /gnu/store/h90vnqw0nwd0hhm1l5dgxsdrigddfmq4-glibc-2.28/lib/librt.so.1 (0x00007fb7ed9ff000)
libstdc++.so.6 => /gnu/store/4sqps8dczv3g7rwbdibfz6rf5jlk7w90-gcc-5.5.0-lib/lib/libstdc++.so.6 (0x00007fb7ed87c000)
libpthread.so.0 => /gnu/store/h90vnqw0nwd0hhm1l5dgxsdrigddfmq4-glibc-2.28/lib/libpthread.so.0 (0x00007fb7ed85b000)
libm.so.6 => /gnu/store/h90vnqw0nwd0hhm1l5dgxsdrigddfmq4-glibc-2.28/lib/libm.so.6 (0x00007fb7ed6da000)
libgcc_s.so.1 => /gnu/store/4sqps8dczv3g7rwbdibfz6rf5jlk7w90-gcc-5.5.0-lib/lib/libgcc_s.so.1 (0x00007fb7ed6bf000)
libc.so.6 => /gnu/store/h90vnqw0nwd0hhm1l5dgxsdrigddfmq4-glibc-2.28/lib/libc.so.6 (0x00007fb7ed506000)
/gnu/store/h90vnqw0nwd0hhm1l5dgxsdrigddfmq4-glibc-2.28/lib/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007fb7ee3a0000)
```
And here's what it looks in one of our releases:
```
linux-vdso.so.1 (0x00007ffff52cd000)
libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007f87726b4000)
librt.so.1 => /usr/lib/librt.so.1 (0x00007f87726aa000)
libm.so.6 => /usr/lib/libm.so.6 (0x00007f8772525000)
libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x00007f877250b000)
libc.so.6 => /usr/lib/libc.so.6 (0x00007f8772347000)
/lib64/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007f8773392000)
```
~~I suspect it is because my script does not apply the gitian-input patches [described in the release process](https://github.com/bitcoin/bitcoin/blob/master/doc/release-process.md#fetch-and-create-inputs-first-time-or-when-dependency-versions-change) but there is no description as to how these patches are applied.~~ It might also be something else entirely.
Edit: It is something else. It appears that the gitian inputs are only used by [`gitian-win-signer.yml`](d6e700e40f/contrib/gitian-descriptors/gitian-win-signer.yml (L14))
</details>
### How to Help
1. Install Guix on your distro either [from source](https://www.gnu.org/software/guix/manual/en/html_node/Requirements.html) or perform a [binary installation](https://www.gnu.org/software/guix/manual/en/html_node/Binary-Installation.html#Binary-Installation)
2. Try out my branch and the command described above!
ACKs for top commit:
MarcoFalke:
Thanks for the replies. ACK 751549b52a9a4cd27389d807ae67f02bbb39cd7f
laanwj:
ACK 751549b52a9a4cd27389d807ae67f02bbb39cd7f
Tree-SHA512: 50e6ab58c6bda9a67125b6271daf7eff0ca57d0efa8941ed3cd951e5bf78b31552fc5e537b1e1bcf2d3cc918c63adf19d685aa117a0f851024dc67e697890a8d
244501fc85a1319857efb227093c0e71c1d5a01e depends: disable unused qt networking features (fanquake)
29d56c62b7f206d42f0908819ff2e1926737f988 depends: -optimized-qmake is now -optimized-tools (fanquake)
ccdda96804088ec3ad01aec5ab0ff8e9b05b161b depends: skip building qt proxies (fanquake)
Pull request description:
Somewhat of a followup to removing BIP70 support in #17165. This removes networking features from our Qt build. This also removes the need to link against the `CFNetwork` and `SystemConfiguration` libraries on macOS.
```diff
src/qt/bitcoin-qt:
/usr/lib/libSystem.B.dylib
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
-/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
/System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
/usr/lib/libc++.1.dylib
-/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
/System/Library/Frameworks/CoreText.framework/Versions/A/CoreText
/System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO
/usr/lib/libobjc.A.dylib
```
> Introduced the -optimized-tools option; supersedes -optimized-qmake.
`optimized-qmake` became `optimized-tools` in Qt 5.6.0. While the former still works, we can use the newer flag.
A diff of the removed symbols is available [here](https://gist.github.com/fanquake/9c8d5961c91f90a2966191367adfb391).
We still need to actually build the network module, because we are using `QLocalServer` & `QLocalSocket` in the payment server.
ACKs for top commit:
Sjors:
Code review ACK 244501fc85a1319857efb227093c0e71c1d5a01e: just a rebase (_updated since I accidentally repeated the previous hash_)
practicalswift:
ACK 244501fc85a1319857efb227093c0e71c1d5a01e -- diff looks correct
promag:
Code review ACK 244501fc85a1319857efb227093c0e71c1d5a01e.
Tree-SHA512: 79734e3c96c40e7e484c86ac4cd4f738c05fcebe4771aeac443883f618a6c766e667909d5f8f14f9bd82f43206387c952458c5fa765cd0830f8beda6e6ac80ae
b95f7f8ac0dc102ece82bb2b97c8123e9da5b806 build, qt, refactor: Drop sed commands for win32-g++/qmake.conf (Hennadii Stepanov)
Pull request description:
Such possibility is [available](https://codereview.qt-project.org/c/qt/qtbase/+/165348) since Qt 5.8.0.
ACKs for top commit:
fanquake:
ACK b95f7f8ac0dc102ece82bb2b97c8123e9da5b806
Tree-SHA512: e56a3d208a6bd5d42c722f8b344010fe7d1b6f7a28486613dfcb03f0403a47cee8476e2366eeaac401a19836cd09f782e8741a1e781ab4d78f72c500a30e4929
* compat: remove bswap_* check on macOS
This was originally added in #9366 to fix the gui build, as
Protobuf would also define these macros. Now that we're no-longer
using Protobuf, remove the additional check.
* build: skip building OpenSSL lib_ssl
* build: remove OpenSSL from Qt build
More info available from:
https://doc.qt.io/qt-5/ssl.html#enabling-and-disabling-ssl-support
* build: remove EVP_MD_CTX_new detection
This was added in #9475 to fix LibreSSL compatibility for
BIP70, so is no longer required.
* build: remove SSL lib detection
* gui: update BIP70 support message
* build: remove BIP70 entries from macOS Info.plist
* gui: remove payment request file handling from OpenURI dialog
* gui: remove BIP70 Support
* build: remove protobuf from depends and contrib
33796a964a8c605ce482959456d1ca78638340d9 build: Add ability to build qt in depends with -stdlib=libc++ (Hennadii Stepanov)
Pull request description:
This PR makes possible to build the `qt` package in depends against `libc++` for x86_64 platform.
Fixes#22344.
Required for #22815.
Also this PR [fixes](https://github.com/bitcoin/bitcoin/pull/23060#discussion_r716077050) the `[no wallet] [bionic]` task on CI:
- on master (a8bbd4cc819633ec50ed0f763b6a75330ae055fb), https://api.cirrus-ci.com/v1/task/5558609250615296/logs/ci.log:
```
Options used to compile and link:
external signer = yes
multiprocess = no
with libs = yes
with wallet = no
with gui / qt = no
```
- this PR, https://api.cirrus-ci.com/v1/task/5502605561430016/logs/ci.log:
```
Options used to compile and link:
external signer = yes
multiprocess = no
with libs = yes
with wallet = no
with gui / qt = yes
```
ACKs for top commit:
fanquake:
ACK 33796a964a8c605ce482959456d1ca78638340d9 - While this sort of string matching is fragile, I think the risk of this causing any actual issues is low.
Tree-SHA512: 586dde2e9864cec7a49aeb4f2b77fb8c4ae96bd10b51f9c6de0cfe8512ad61db15bb7f8d1b0eb6a5a66fd2deee52ac52218f01eb6be107ac12f1a956190de54b
6457361e90c0cf704d086c51d75f51dbdfd374d7 qt: Fix QFileDialog for static builds (Hennadii Stepanov)
Pull request description:
This change partially reverts 248e22bbc0d7bc40ae3584d53a18507c46b0e553 (#16386) and makes `QFileDialog`s work again for static builds.
Fixes https://github.com/bitcoin-core/gui/issues/32.
ACKs for top commit:
fanquake:
ACK 6457361e90c0cf704d086c51d75f51dbdfd374d7. Although it would be good to know exactly _why_ this fixes the issue. At this stage I also don't think this should be a blocker for 0.20.1.
theuni:
ACK 6457361e90c0cf704d086c51d75f51dbdfd374d7
Tree-SHA512: 8ad27e0bcae6debd02f73b7c374743e37d4edd806922b103a2fe494cf2d9930fe9ef3107b5a6c61f3c466cf7462de2641171880398954e7f2c4f417f5bb820d7
248e22bbc0d7bc40ae3584d53a18507c46b0e553 depends: disable unused Qt features (fanquake)
Pull request description:
Related to #16354. Kept separate from #16370, because:
> QT is a monster 😂 - dongcarl in #bitcoin-builds
I've done some basic testing on `macOS 10.14` and `Debian 9.9` so far. Would be good to have someone test on Windows.
I was thinking about adding some inline documentation, i.e info about where to find the lists of Qt features & libraries, as well as breaking the flags up so that it's clearer which libraries we are supplying, which we rely on Qt for etc. Could go towards addressing some of`2` in #16354.
ACKs for top commit:
sipsorcery:
tACK 248e22bbc0d7bc40ae3584d53a18507c46b0e553 (Windows 10 test only)
laanwj:
ACK 248e22bbc0d7bc40ae3584d53a18507c46b0e553
Tree-SHA512: 2cdcea8d268de21d355a7625c4d352f65728df0b8d8cc0f396aca676f42099a819f95652dfbfc665c991ba12c52735c1e9b693df4b12e3ee178fd39356fba8e0
2359a4790d93ffd17b8afc2fea3775dd858ef50d depends: don't use OpenGL in Qt on macOS (fanquake)
ba0cad2702e01860d3539f170343d8d9f9c5b75a build: pass -dead_strip_dylibs to ld on macOS (fanquake)
Pull request description:
Based on #17663. OpenGL on macOS was also deprecated in 10.14.
This also removes the `/System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL` dylib from `bitcoin-qt`.
ACKs for top commit:
laanwj:
ACK 2359a4790d93ffd17b8afc2fea3775dd858ef50d
jonasschnelli:
utACK 2359a4790d93ffd17b8afc2fea3775dd858ef50d
hebasto:
ACK 2359a4790d93ffd17b8afc2fea3775dd858ef50d
Tree-SHA512: 39b0151832c829f6ebdc4910eb28ebbeba64539cd04eba6ce3ec75fc0f231569956ca51a1e0bffc76dd27e85643c65a155320b9b450c49e9841e12b108406d41
6fdf5dab26e87888c3511fecef5d4d612b8247d6 depends: only use dbus with qt on linux (fanquake)
Pull request description:
Since #8210 we've been passing `-dbus-runtime` when configuring Qt, however D-Bus isn't used on macOS or Windows. So rather than blanket passing `-dbus-runtime`, only use D-Bus when building for linux, and disable it for Windows and macOS. This also saves some time building qt in depends (for windows or macOS).
This gist contains a diff of the symbols in a macOS bitcoin-qt after applying this change: https://gist.github.com/fanquake/317e5c9c7d1b5e37a0c1ce8001af18c4.
ACKs for top commit:
laanwj:
ACK 6fdf5dab26e87888c3511fecef5d4d612b8247d6
Tree-SHA512: 7c7df6036f27dae6adb807edf94cd26b4dafa3728976d219a68f7388b6477777b35acebd507320e4469c9f2fcf016b311c82e0b12d50546cb5ab66a1e955e464
3b36395b96c533dde47256b505cf1cbb2844c96e depends: Fix qt.mk for mac arm64 (João Barbosa)
Pull request description:
With f16d4cd8c5412890ee0b73f4ef142b59d130e5d5 `depends/config.guess` gives `aarch64-apple-darwin20.3.0` where before would give `arm-apple-darwin20.3.0`. Fix `qt.mk` accordingly.
ACKs for top commit:
hebasto:
ACK 3b36395b96c533dde47256b505cf1cbb2844c96e, I have reviewed the code and it looks OK, I agree it can be merged.
fanquake:
ACK 3b36395b96c533dde47256b505cf1cbb2844c96e
Tree-SHA512: bd20402d0a6e9a5bb652198de189cf2b4f3f76fd03d0cba8c4d657c60b8a088cf3532efe6c1efbbedd94c00a155e6d180b77f1cd8bc24e0e35764839e8b77e30
a46c8476e9598742e52944b6270b1854c8f500a2 depends: disable unused qt features (fanquake)
73b46eeb7ea78cab051d770e3fe8a0c0fbb43ef9 depends: qt 5.9.7 (fanquake)
095e765975c2204f7e730bc8f0716227e480caa5 depends: expat 2.2.6 (fanquake)
Pull request description:
This PR upgrades `expat` and `qt` in depends. The intention is to upgrade Qt in master to the latest point release of the current Qt LTS. This change can then be back-ported to the 0.17 branch (wether it makes it into 0.17.1 or not).
Then, sometime before the 0.18.0 release, we could move to using Qt 5.12+ in depends (which is also LTS). That discussion, as well as minimum supported Qt versions is in #13478.
### Qt 5.9.7
[Release announcement](https://blog.qt.io/blog/2018/10/23/qt-5-9-7-released/)
[Changelog](https://bugreports.qt.io/browse/QTBUG-70888?filter=20149)
### Expat 2.2.6
* Avoid doing arithmetic with NULL pointers in XML_GetBuffer
* Fix 2.2.5 regression with suspend-resume while parsing a document like <root/>
Full changelog [here](https://github.com/libexpat/libexpat/blob/R_2_2_6/expat/Changes)
a46c8476e9 disables a bunch of qt features we aren't currently using. This speeds up the qt depends build slightly (also decreases the size of the built `qt-5.9.7` tar by about 2%). The disabling is somewhat unintuitive, hence `[wip]` until after a travis run and gitian build.
Tree-SHA512: f3d51d0c7dabe5b7043ef23f264abf2aba3e94e55ffc9d5c323b153b6852d9161368e1591db3ba28f3498f0613bac77d40b855bd0465296f52be03f9230656de
87fe104537eab5ccd8728321fe1c9ba39f7dda78 depends: Use more legible qmake commands in qt package (Hennadii Stepanov)
bf35a8da6ec2791dedf36f459add69ac67b11ff9 depends: Do not set build_subdir for qt package (Hennadii Stepanov)
Pull request description:
Rather than using `cd` to jump all over the place, perform all `(q)make` commands from the top level directory.
Looking at bash like `cd ../../../..` gives me a headache.
Credits to **fanquake**.
This PR is an alternative to #20504 that works without any additional [non-trivial hack](https://github.com/bitcoin/bitcoin/pull/20504#issuecomment-734730336).
ACKs for top commit:
promag:
Tested ACK 87fe104537eab5ccd8728321fe1c9ba39f7dda78.
fanquake:
ACK 87fe104537eab5ccd8728321fe1c9ba39f7dda78
Tree-SHA512: 1d2a13b5358fc7406c5363ddd62fd363dbc0ec5ace68946e4d3e6e8620419afaa64ef2837488aaed226174e01e8897495085540f7126b80f8b2372d21b5b29f9
267f259c0dfbd348340d49e9a89b8684b994e22a depends: Drop workaround for a fixed bug in Qt build system (Hennadii Stepanov)
Pull request description:
This PR drops workaround that was [introduced](1dec09b341) for Qt 5.2.1 for a bug in Qt build system that has been fixed in Qt 5.3.0.
The bug reports:
- https://bugreports.qt.io/browse/QTBUG-35444
- https://bugreports.qt.io/browse/QTBUG-32519
I've noted this change is a part of the #19716, but I think that a separate commit with the documented reason will benefit it.
ACKs for top commit:
laanwj:
Code review ACK 267f259c0dfbd348340d49e9a89b8684b994e22a
jonasschnelli:
code Review ACK 267f259c0dfbd348340d49e9a89b8684b994e22a
practicalswift:
cr ACK 267f259c0dfbd348340d49e9a89b8684b994e22a: patch looks correct
Tree-SHA512: b994f94776b4f8bb2f996095c87c7fef55e74d1e64852a890d664275e3739ec890ee388b10baa15445dd24ec7b971ce57d396cb062dbed933c18b6b69525349f
c23f6f84efa2fe7e7168a5d41341f3a7c5598f70 Add depends qt fix for ARM macs (Jonas Schnelli)
Pull request description:
With this, depends builds fine on macOS 11 on an Apple Silicon Mac (ARM64).
ACKs for top commit:
laanwj:
Code review ACK c23f6f84efa2fe7e7168a5d41341f3a7c5598f70
Tree-SHA512: a8354cec99969cff9e7dab150c335050ddb4b3c93a9f12a4db5e8046f02b11ce692ac17c2b96cbbe7f380c1aa110b15b8d6d48d51bc9c560282c702e99fd8a8d
69bfcac27a83440092bc6e61904ded910ed4baf4 gui: update Qt base translations for macOS release (fanquake)
Pull request description:
These haven't been updated since their addition, so this updates the list that
controls which qt base translations are bundled with the macOS binary, to all the
languages that are available with qt 5.9.8.
This could probably be improved in some way, however qt updates are infrequent,
and I didn't want to spend any more time looking at this. Also given that no-one
seems to have noticed and/or reported this it wouldn't seem high-priority.
Could be backported to 0.20.1.
Master:
This PR:
ACKs for top commit:
hebasto:
ACK 69bfcac27a83440092bc6e61904ded910ed4baf4, tested on macOS 10.15.
Tree-SHA512: df142fb16097deb514e72e005b73aafc4eb4ff0c17e423ba5040a3ec6874020a733e1c5259a88923580e71ef73c16222aed28f482b8c270a544a85b745a7b327
f7696e6183 depends: qt: Don't hardcode pwd path (Carl Dong)
89bee1bdbf depends: tar: Always extract as yourself (Carl Dong)
340ef50772 depends: Defer to Python detected by autoconf (Carl Dong)
Pull request description:
Removes some implicit assumptions that the depends system has about its environment and, as a side-effect, makes it possible to build the depends tree under severely privilege-limited environments such as containers built by Guix.
Tree-SHA512: e8618f9310a0deae864b44f9b60baa29e6225ba16817973ff7830b55798ebd4343aa06da6c1f92682a7afb709d26f80d6ee794a139d4d44c27caf4f0c8fe95fc
