2376c61056
96cc6bb04f7e173e1f7637b780ac00fc75486671 guix/prelude: Override VERSION with FORCE_VERSION (Carl Dong)
Pull request description:
```
Previously, if the builder exported $VERSION in their environment (as
past Gitian-building docs told them to), but their HEAD does not
actually point to v$VERSION, their build outputs will differ from those
of other builders.
This is because the contrib/guix/guix-* scripts only ever act on the
current git worktree, and does not try to check out $VERSION if $VERSION
is set in the environment.
Setting $VERSION only makes the scripts pretend like the current
worktree is $VERSION.
This problem was seen in jonatack's attestation for all.SHA256SUMS,
where only his bitcoin-22.0rc3-osx-signed.dmg differed from everyone
else's.
Here is my deduced sequence of events:
1. Aug 27th: He guix-builds 22.0rc3 and uploads his attestations up to
guix.sigs
2. Aug 30th, sometime after POSIX time 1630310848: he pulls the latest
changes from master in the same worktree where he guix-built 22.0rc3
and ends up at 7be143a960e2
3. Aug 30th, sometime before POSIX time 1630315907: With his worktree
still on 7be143a960e2, he guix-codesigns. Normally, this would result
in outputs going in guix-build-7be143a960e2, but he had
VERSION=22.0rc3 in his environment, so the guix-* scripts pretended
like he was building 22.0rc3, and used 22.0rc3's guix-build directory
to locate un-codesigned outputs and dump codesigned ones.
However, our SOURCE_DATE_EPOCH defaults to the POSIX time of HEAD
(7be143a960e2), which made all timestamps in the resulting codesigned
DMG 1630310848, 7be143a960e2's POSIX timestamp. This differs from the
POSIX timestamp of 22.0rc3, which is 1630348517. Note that the
windows codesigning procedure does not consider SOURCE_DATE_EPOCH.
We resolve this by only allowing VERSION overrides via the FORCE_VERSION
environment variable.
```
Please ignore the branch name, it's not relevant to the change.
ACKs for top commit:
fanquake:
ACK 96cc6bb04f7e173e1f7637b780ac00fc75486671 - Also makes sense given there are Guix build guides recommending to set `VERSION` as part of the process. i.e https://gist.github.com/hebasto/7293726cbfcd0b58e1cfd5418316cee3.
Tree-SHA512: 9dca3fc637ce11049286a3ebee3cd61cce2125fc51d31cf472fbed7f659e1846fc44062753e0e71bfaec9e7fbab6f040bb88d9d4bc4f8acb28c6890563584acf
|
||
|---|---|---|
| .. | ||
| auto_gdb | ||
| containers | ||
| debian | ||
| devtools | ||
| gitian-descriptors | ||
| gitian-keys | ||
| guix | ||
| init | ||
| linearize | ||
| macdeploy | ||
| qos | ||
| seeds | ||
| shell | ||
| testgen | ||
| verify-commits | ||
| verifybinaries | ||
| windeploy | ||
| zmq | ||
| dash-cli.bash-completion | ||
| dash-qt.pro | ||
| dash-tx.bash-completion | ||
| dashd.bash-completion | ||
| filter-lcov.py | ||
| gitian-build.py | ||
| README.md | ||
| valgrind.supp | ||
Repository Tools
Developer tools
Specific tools for developers working on this repository.
Contains the script github-merge.py for merging GitHub pull requests securely and signing them using GPG.
Verify-Commits
Tool to verify that every merge commit was signed by a developer using the above github-merge.py script.
Linearize
Construct a linear, no-fork, best version of the blockchain.
Qos
A Linux bash script that will set up traffic control (tc) to limit the outgoing bandwidth for connections to the Dash network. This means one can have an always-on dashd instance running, and another local dashd/dash-qt instance which connects to this node and receives blocks from it.
Seeds
Utility to generate the pnSeed[] array that is compiled into the client.
Build Tools and Keys
Debian
Contains files used to package dashd/dash-qt for Debian-based Linux systems. If you compile dashd/dash-qt yourself, there are some useful files here.
Gitian-descriptors
Notes on getting Gitian builds up and running using KVM.
Gitian-keys
PGP keys used for signing Dash Core Gitian release results.
MacDeploy
Scripts and notes for Mac builds.
Gitian-build
Script for running full Gitian builds.
Test and Verify Tools
TestGen
Utilities to generate test vectors for the data-driven Dash tests.
Verify Binaries
This script attempts to download and verify the signature file SHA256SUMS.asc from bitcoin.org.