security-check: test for `_FORTIFY_SOURCE` usage in release binaries #27038

fanquake · 2023-02-03T17:05:08Z

Test for the existence of fortified functions in the ELF release binaries.
Currently skips bitcoin-util and checks for RISC-V.

DrahtBot · 2023-02-03T17:05:11Z

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage

For detailed information about the code coverage, see the test coverage report.

Reviews

See the guideline for information on the review process.

Type	Reviewers
ACK	TheCharlatan
Concept ACK	hebasto
Stale ACK	laanwj

If your review is incorrectly listed, please react with 👎 to this comment and the bot will ignore it on the next update.

Conflicts

No conflicts as of last run.

fanquake · 2023-02-13T15:46:44Z

we don't end up with any foritfied funcs in bitcoin-util or bitcoin-cli.

bitcoin-cli is fixed once we fortify libevent.

fanquake · 2023-02-17T14:36:29Z

bitcoin-cli is fixed once we fortify libevent.

Rebased on #27118

ff4a73a depends: use FORTIFY_SOURCE=3 with libevent (fanquake) Pull request description: Use `FORTIFY_SOURCE=3` when building libevent in depends. I've upstreamed a change to switch libevent from using =2 to =3 as well: libevent/libevent#1418. Solves half of #27038, by giving us some fortified funcs in `bitcoin-cli`. ACKs for top commit: TheCharlatan: ACK ff4a73a Tree-SHA512: eaf692ec92b288f0cb524c011fc81529f58efa4c43d418a7b3ae7108eba2bccba708a81a28ac6d063267be80ca615637c6e3fccc02497d7367af2eaae0e8d812

fanquake · 2023-02-28T10:30:52Z

Rebased post #27118.

ff4a73a depends: use FORTIFY_SOURCE=3 with libevent (fanquake) Pull request description: Use `FORTIFY_SOURCE=3` when building libevent in depends. I've upstreamed a change to switch libevent from using =2 to =3 as well: libevent/libevent#1418. Solves half of bitcoin#27038, by giving us some fortified funcs in `bitcoin-cli`. ACKs for top commit: TheCharlatan: ACK ff4a73a Tree-SHA512: eaf692ec92b288f0cb524c011fc81529f58efa4c43d418a7b3ae7108eba2bccba708a81a28ac6d063267be80ca615637c6e3fccc02497d7367af2eaae0e8d812

hebasto · 2023-10-25T12:27:54Z

Concept ACK.

hebasto · 2023-10-25T12:53:23Z

Can't be done yet because we don't end up with any fortified funcs in bitcoin-util.

Does it make sense to provide a list of expected symbols for every binary been tested? It would be an empty one for bitcoin-util.

fanquake · 2023-10-25T13:05:48Z

Does it make sense to provide a list of expected symbols for every binary been tested?

I don't think so, and that would likely require constant maintenance (plus guix builds to be run on every code change).

laanwj · 2024-04-24T07:13:52Z

Concept ACK

contrib/devtools/security-check.py

laanwj · 2024-04-24T07:20:04Z

i'd be okay with skipping the check for bitcoin-util: it's the least relevant binary for fortification (no network access, not even file format access). Could reconsider it later if it actually gains some useful functionality 😄

fanquake · 2024-09-06T10:12:04Z

Guix Build (aarch64):

f21ba8dde52ecf7fd1e76b5f6efe7d620a7a0baf8099eb6d25d09161a73f2030  guix-build-6c9000cfbfab/output/aarch64-linux-gnu/SHA256SUMS.part
5e89a83e025bfbc37118a1ca0d386b0ffbde22bd3357b06d7e4c3587e10b0ed6  guix-build-6c9000cfbfab/output/aarch64-linux-gnu/bitcoin-6c9000cfbfab-aarch64-linux-gnu-debug.tar.gz
d0b7acb03204f077bc88d0d9008041c1aa854a6e0fd244210099ae2f2b8b4ca3  guix-build-6c9000cfbfab/output/aarch64-linux-gnu/bitcoin-6c9000cfbfab-aarch64-linux-gnu.tar.gz
e4619881f66bbefd26cc4e28723c3ebb9b6720f4a3f83ee4733e41246a72eff6  guix-build-6c9000cfbfab/output/arm-linux-gnueabihf/SHA256SUMS.part
0d3fcb044b41e7b9146329f9a9a2113fd55acab2f2129d58c2b56fca2cf08b0d  guix-build-6c9000cfbfab/output/arm-linux-gnueabihf/bitcoin-6c9000cfbfab-arm-linux-gnueabihf-debug.tar.gz
0dde42354c7322480a43281655c6a337429522b6cf845f8dcf154eb87cb4077d  guix-build-6c9000cfbfab/output/arm-linux-gnueabihf/bitcoin-6c9000cfbfab-arm-linux-gnueabihf.tar.gz
42b54602d398545561dc2fdc9d8ba255333a24a1c3d61e7455e79c1ac89d0388  guix-build-6c9000cfbfab/output/arm64-apple-darwin/SHA256SUMS.part
862b895a04b29266e8677d12ec3ed86c90d697e565bfe09b60e7fd987579ddb0  guix-build-6c9000cfbfab/output/arm64-apple-darwin/bitcoin-6c9000cfbfab-arm64-apple-darwin-unsigned.tar.gz
f30b60f67b6415c6598a64aeb64f5653349e9dfdeacb901c4173a73fb725904f  guix-build-6c9000cfbfab/output/arm64-apple-darwin/bitcoin-6c9000cfbfab-arm64-apple-darwin-unsigned.zip
8024ed97ffb3d639882b399dca0c8e305627663d25bc7afc0a3b408a2054590f  guix-build-6c9000cfbfab/output/arm64-apple-darwin/bitcoin-6c9000cfbfab-arm64-apple-darwin.tar.gz
f69554b8a178d80980a0235bb1380dfc7bfff51bffc8d5861540623c26f2088d  guix-build-6c9000cfbfab/output/dist-archive/bitcoin-6c9000cfbfab.tar.gz
e3fe7b51ae096171b0c1f5cadc3f81809b704dc443f4cdcbfdf4da314b308367  guix-build-6c9000cfbfab/output/powerpc64-linux-gnu/SHA256SUMS.part
4ed6abfc07cee15820ef0b82cf627d743eda7c1bf949f91a7259adbfcc908972  guix-build-6c9000cfbfab/output/powerpc64-linux-gnu/bitcoin-6c9000cfbfab-powerpc64-linux-gnu-debug.tar.gz
72c28fe0d63ca94df4629b05530576f432fa170d5dff9117c7e1fe177df1e33e  guix-build-6c9000cfbfab/output/powerpc64-linux-gnu/bitcoin-6c9000cfbfab-powerpc64-linux-gnu.tar.gz
36efec196510892ae01bfbae75d6fd624be97fba9cdfe98a84f4b743c58e7914  guix-build-6c9000cfbfab/output/riscv64-linux-gnu/SHA256SUMS.part
713afe90c3fbb54d42d16636b4cc66f94956498e043580510cb0cbcbf1cb0b72  guix-build-6c9000cfbfab/output/riscv64-linux-gnu/bitcoin-6c9000cfbfab-riscv64-linux-gnu-debug.tar.gz
9dc73a4f7fabf55853cb55bcdb7dc64b4670345d2c00d40aea827c62e8dcb8f6  guix-build-6c9000cfbfab/output/riscv64-linux-gnu/bitcoin-6c9000cfbfab-riscv64-linux-gnu.tar.gz
5d059bb7188b104b530c6a21108f94942d6f7acaabf469f1205e3a815721449e  guix-build-6c9000cfbfab/output/x86_64-apple-darwin/SHA256SUMS.part
e7a2b21f3f0737cc5a04a0e4cb7b64afc254347758be97f6312700e85932de2a  guix-build-6c9000cfbfab/output/x86_64-apple-darwin/bitcoin-6c9000cfbfab-x86_64-apple-darwin-unsigned.tar.gz
a45a52a60dd218cae67faaca037d4004da8b1ba299b04e80780d5a416ed6596a  guix-build-6c9000cfbfab/output/x86_64-apple-darwin/bitcoin-6c9000cfbfab-x86_64-apple-darwin-unsigned.zip
460ea30d33f604ed044b9ee66dfbecbc0fb7049a18a899d365420d8c3bc31d35  guix-build-6c9000cfbfab/output/x86_64-apple-darwin/bitcoin-6c9000cfbfab-x86_64-apple-darwin.tar.gz
6dca6e13803d9ea07c20e9e865b48aae4e5e5e7ac0e0dd6f5699990769e165f3  guix-build-6c9000cfbfab/output/x86_64-linux-gnu/SHA256SUMS.part
e4be9ef51c5fecfbf6bdf31508dc8f6aaaf31d46d49101da2b3a2e86c30513d8  guix-build-6c9000cfbfab/output/x86_64-linux-gnu/bitcoin-6c9000cfbfab-x86_64-linux-gnu-debug.tar.gz
686499d3990e762945279536aa9c84e6c79fc8e85d1e4ecedbb0ce9c70c3154c  guix-build-6c9000cfbfab/output/x86_64-linux-gnu/bitcoin-6c9000cfbfab-x86_64-linux-gnu.tar.gz
efe2376411ac6979dfe6e542b4bd1d5e950f069ba057755cf3a1cfac9aa3b619  guix-build-6c9000cfbfab/output/x86_64-w64-mingw32/SHA256SUMS.part
b3fcd800835eea1430e19f7cab82006c96f15b86985d9582d81e62de3fe6c195  guix-build-6c9000cfbfab/output/x86_64-w64-mingw32/bitcoin-6c9000cfbfab-win64-debug.zip
2b8e9e6cc2a0f2215d21599db5b03d2c9f7a158f3182908682b23df4b643976f  guix-build-6c9000cfbfab/output/x86_64-w64-mingw32/bitcoin-6c9000cfbfab-win64-setup-unsigned.exe
3e476530d1321acb2561027ce8ea05fc9a98430c6afc6a50ccd60ace72445f5b  guix-build-6c9000cfbfab/output/x86_64-w64-mingw32/bitcoin-6c9000cfbfab-win64-unsigned.tar.gz
bb55ef5ebc3e768899c71033dae45fbb45e26c415209047f460d5d6f3e98529c  guix-build-6c9000cfbfab/output/x86_64-w64-mingw32/bitcoin-6c9000cfbfab-win64.zip

laanwj · 2024-09-08T09:34:16Z

ACK 6c9000c

Building on x86_64 gets different guix output for MacOS. But this is unrelated to this PR.

-129b365bba906f50926218d5b8bb76921f5f637549fe44941e01eb8ba5d5d5f0  guix-build-6c9000cfbfab/output/arm64-apple-darwin/bitcoin-6c9000cfbfab-arm64-apple-darwin-unsigned.zip
+f30b60f67b6415c6598a64aeb64f5653349e9dfdeacb901c4173a73fb725904f  guix-build-6c9000cfbfab/output/arm64-apple-darwin/bitcoin-6c9000cfbfab-arm64-apple-darwin-unsigned.zip
-f836231d54d171cd98589519166200ed6a65741ff249e6e2144e94cf0e964ce5  guix-build-6c9000cfbfab/output/x86_64-apple-darwin/bitcoin-6c9000cfbfab-x86_64-apple-darwin-unsigned.zip
+a45a52a60dd218cae67faaca037d4004da8b1ba299b04e80780d5a416ed6596a  guix-build-6c9000cfbfab/output/x86_64-apple-darwin/bitcoin-6c9000cfbfab-x86_64-apple-darwin-unsigned.zip

fanquake · 2024-09-09T14:01:39Z

Guix build (x86_64) note that macOS builds (probably) wont match:

b3bcd9f7508b35b3f4a187e9f1e4c87648bf3897575c0c4db8664f1fe08c2cf4  guix-build-be4f78275fa6/output/aarch64-linux-gnu/SHA256SUMS.part
356c7b9493887fc839e6b7951a3396085bfea33efce91070f972a69f60aac1f4  guix-build-be4f78275fa6/output/aarch64-linux-gnu/bitcoin-be4f78275fa6-aarch64-linux-gnu-debug.tar.gz
e2887613ca5d1f929294487f86bd36ab6af0739d12625c6c661a35781c4f1523  guix-build-be4f78275fa6/output/aarch64-linux-gnu/bitcoin-be4f78275fa6-aarch64-linux-gnu.tar.gz
92514b0968dbc869cc40fa618576d92aeedebcc7b93b08355ce7e0ced96e8992  guix-build-be4f78275fa6/output/arm-linux-gnueabihf/SHA256SUMS.part
1e692efe2151693cd353ad584678718431aed1f3b26550b7708774c32f8f11b8  guix-build-be4f78275fa6/output/arm-linux-gnueabihf/bitcoin-be4f78275fa6-arm-linux-gnueabihf-debug.tar.gz
3182761dacaac998d2f4bf3c40d8f459ab6c61ea3912895e4fb4f5ef78814b0c  guix-build-be4f78275fa6/output/arm-linux-gnueabihf/bitcoin-be4f78275fa6-arm-linux-gnueabihf.tar.gz
fb15e70c205133aaaf71211260a94914bb2721adc249a14cc39d2be211265dae  guix-build-be4f78275fa6/output/arm64-apple-darwin/SHA256SUMS.part
22999d45e4c5e22b1279a4362abda833d51bed2f5c1d478ad8f9f73b8878def5  guix-build-be4f78275fa6/output/arm64-apple-darwin/bitcoin-be4f78275fa6-arm64-apple-darwin-unsigned.tar.gz
8e295048be58a10b7a5c239baa84a7b04b84d523f5149884127b1a403636fba8  guix-build-be4f78275fa6/output/arm64-apple-darwin/bitcoin-be4f78275fa6-arm64-apple-darwin-unsigned.zip
1dd8fb0de68f9598f245d2565d634fbae232ce2507019de83724f72c3835f8b8  guix-build-be4f78275fa6/output/arm64-apple-darwin/bitcoin-be4f78275fa6-arm64-apple-darwin.tar.gz
7e48a49b04818bab314d872cffd11aa41650b01717bc01edc461e50d5afcb428  guix-build-be4f78275fa6/output/dist-archive/bitcoin-be4f78275fa6.tar.gz
65fae266d1a0bee5654bde79d02d9df9d0e0a35b517da1d8f227edb889171b8b  guix-build-be4f78275fa6/output/powerpc64-linux-gnu/SHA256SUMS.part
96ab98442b875cec7aa7ef927ae1ffb3ea047c1827f82e97ce3e2b5d942c8998  guix-build-be4f78275fa6/output/powerpc64-linux-gnu/bitcoin-be4f78275fa6-powerpc64-linux-gnu-debug.tar.gz
fdb0639b6efe2baee6266c516f482ed36ed71965ba21a3706d0a61444792a700  guix-build-be4f78275fa6/output/powerpc64-linux-gnu/bitcoin-be4f78275fa6-powerpc64-linux-gnu.tar.gz
2ea0fa8ee3e33350a43cb153223ab9d11cb6520f300c08010784df2cdfd9e9b2  guix-build-be4f78275fa6/output/riscv64-linux-gnu/SHA256SUMS.part
62c8961a668bee937eb9afa3ddf532a43f81402d55db4c9b16aeb3025e1f1a6a  guix-build-be4f78275fa6/output/riscv64-linux-gnu/bitcoin-be4f78275fa6-riscv64-linux-gnu-debug.tar.gz
0fa073206c1b5723242317ff4564d1c78e2f2184464552c896fcd90a6fcc98fa  guix-build-be4f78275fa6/output/riscv64-linux-gnu/bitcoin-be4f78275fa6-riscv64-linux-gnu.tar.gz
e9ed6817139513fae596446e003c5c6e1b96cb9497cb9b68e2423d62580b5137  guix-build-be4f78275fa6/output/x86_64-apple-darwin/SHA256SUMS.part
ae08548740f12a8c0053570aa9048c8de3db0c195f2360e39048556efe1f1027  guix-build-be4f78275fa6/output/x86_64-apple-darwin/bitcoin-be4f78275fa6-x86_64-apple-darwin-unsigned.tar.gz
96228a3d7ef976f8dccbe58c462065c260191ec093fa56919a8a96bae4631fdf  guix-build-be4f78275fa6/output/x86_64-apple-darwin/bitcoin-be4f78275fa6-x86_64-apple-darwin-unsigned.zip
3cd89ca037f9ffc8a42c9e83ddccc5fc49f7c365fcbed4c5ae50b6a243f8fffd  guix-build-be4f78275fa6/output/x86_64-apple-darwin/bitcoin-be4f78275fa6-x86_64-apple-darwin.tar.gz
3ddcd9d6d618b2a1769baccaf5a4d6f44cf7ac4f6554c27be2aaa50dfc5efeca  guix-build-be4f78275fa6/output/x86_64-linux-gnu/SHA256SUMS.part
49f09f86a8b485ce0b55bb56a7f214021ea56a23e942e98a4994a01559761615  guix-build-be4f78275fa6/output/x86_64-linux-gnu/bitcoin-be4f78275fa6-x86_64-linux-gnu-debug.tar.gz
fe0e969bdfeb3743074b51d2eee31da938110ec00f10b3e1d3fa8548d4400645  guix-build-be4f78275fa6/output/x86_64-linux-gnu/bitcoin-be4f78275fa6-x86_64-linux-gnu.tar.gz
b6e26a5527d84fc65077c34b61b3d813e5aa3b76383eb13aab84b2282b1b27dc  guix-build-be4f78275fa6/output/x86_64-w64-mingw32/SHA256SUMS.part
fd2352c71357a7e239da30154ca056df1f2d31594e353f44d74841d786879840  guix-build-be4f78275fa6/output/x86_64-w64-mingw32/bitcoin-be4f78275fa6-win64-debug.zip
521e156965a8bee4399ba861edf6aba75579d00b077d1b4db34b7c01d565b6d4  guix-build-be4f78275fa6/output/x86_64-w64-mingw32/bitcoin-be4f78275fa6-win64-setup-unsigned.exe
4b6ebd88fd17aac230099ceee6f40c49e5bf841e964a53f52024d04b6e447dfe  guix-build-be4f78275fa6/output/x86_64-w64-mingw32/bitcoin-be4f78275fa6-win64-unsigned.tar.gz
9830bcba326f52fb0cc529826243b2f878a975e9ae70db09bf2358c6602b39dc  guix-build-be4f78275fa6/output/x86_64-w64-mingw32/bitcoin-be4f78275fa6-win64.zip

TheCharlatan · 2024-09-09T14:07:42Z

Guix builds (aarch64):

b3bcd9f7508b35b3f4a187e9f1e4c87648bf3897575c0c4db8664f1fe08c2cf4  guix-build-be4f78275fa6/output/aarch64-linux-gnu/SHA256SUMS.part
356c7b9493887fc839e6b7951a3396085bfea33efce91070f972a69f60aac1f4  guix-build-be4f78275fa6/output/aarch64-linux-gnu/bitcoin-be4f78275fa6-aarch64-linux-gnu-debug.tar.gz
e2887613ca5d1f929294487f86bd36ab6af0739d12625c6c661a35781c4f1523  guix-build-be4f78275fa6/output/aarch64-linux-gnu/bitcoin-be4f78275fa6-aarch64-linux-gnu.tar.gz
92514b0968dbc869cc40fa618576d92aeedebcc7b93b08355ce7e0ced96e8992  guix-build-be4f78275fa6/output/arm-linux-gnueabihf/SHA256SUMS.part
1e692efe2151693cd353ad584678718431aed1f3b26550b7708774c32f8f11b8  guix-build-be4f78275fa6/output/arm-linux-gnueabihf/bitcoin-be4f78275fa6-arm-linux-gnueabihf-debug.tar.gz
3182761dacaac998d2f4bf3c40d8f459ab6c61ea3912895e4fb4f5ef78814b0c  guix-build-be4f78275fa6/output/arm-linux-gnueabihf/bitcoin-be4f78275fa6-arm-linux-gnueabihf.tar.gz
498954cd93a28fa8cf710f0aaa096d91b4e920612188b7f3b2e61af28a9d7d6e  guix-build-be4f78275fa6/output/arm64-apple-darwin/SHA256SUMS.part
22999d45e4c5e22b1279a4362abda833d51bed2f5c1d478ad8f9f73b8878def5  guix-build-be4f78275fa6/output/arm64-apple-darwin/bitcoin-be4f78275fa6-arm64-apple-darwin-unsigned.tar.gz
286febd16cd27c9f5f71ea9b8f0e7dd1ee2bfb2dfa6f59cb43a229d02a460e25  guix-build-be4f78275fa6/output/arm64-apple-darwin/bitcoin-be4f78275fa6-arm64-apple-darwin-unsigned.zip
1dd8fb0de68f9598f245d2565d634fbae232ce2507019de83724f72c3835f8b8  guix-build-be4f78275fa6/output/arm64-apple-darwin/bitcoin-be4f78275fa6-arm64-apple-darwin.tar.gz
7e48a49b04818bab314d872cffd11aa41650b01717bc01edc461e50d5afcb428  guix-build-be4f78275fa6/output/dist-archive/bitcoin-be4f78275fa6.tar.gz
65fae266d1a0bee5654bde79d02d9df9d0e0a35b517da1d8f227edb889171b8b  guix-build-be4f78275fa6/output/powerpc64-linux-gnu/SHA256SUMS.part
96ab98442b875cec7aa7ef927ae1ffb3ea047c1827f82e97ce3e2b5d942c8998  guix-build-be4f78275fa6/output/powerpc64-linux-gnu/bitcoin-be4f78275fa6-powerpc64-linux-gnu-debug.tar.gz
fdb0639b6efe2baee6266c516f482ed36ed71965ba21a3706d0a61444792a700  guix-build-be4f78275fa6/output/powerpc64-linux-gnu/bitcoin-be4f78275fa6-powerpc64-linux-gnu.tar.gz
2ea0fa8ee3e33350a43cb153223ab9d11cb6520f300c08010784df2cdfd9e9b2  guix-build-be4f78275fa6/output/riscv64-linux-gnu/SHA256SUMS.part
62c8961a668bee937eb9afa3ddf532a43f81402d55db4c9b16aeb3025e1f1a6a  guix-build-be4f78275fa6/output/riscv64-linux-gnu/bitcoin-be4f78275fa6-riscv64-linux-gnu-debug.tar.gz
0fa073206c1b5723242317ff4564d1c78e2f2184464552c896fcd90a6fcc98fa  guix-build-be4f78275fa6/output/riscv64-linux-gnu/bitcoin-be4f78275fa6-riscv64-linux-gnu.tar.gz
674b1df15a79d891c17936fd2de46209e25ab1cf70136416dfc0936b560012c5  guix-build-be4f78275fa6/output/x86_64-apple-darwin/SHA256SUMS.part
ae08548740f12a8c0053570aa9048c8de3db0c195f2360e39048556efe1f1027  guix-build-be4f78275fa6/output/x86_64-apple-darwin/bitcoin-be4f78275fa6-x86_64-apple-darwin-unsigned.tar.gz
24e42f85fae635448de1a538fb6be5cd7372260c049362d7b4f89e5876f94da3  guix-build-be4f78275fa6/output/x86_64-apple-darwin/bitcoin-be4f78275fa6-x86_64-apple-darwin-unsigned.zip
3cd89ca037f9ffc8a42c9e83ddccc5fc49f7c365fcbed4c5ae50b6a243f8fffd  guix-build-be4f78275fa6/output/x86_64-apple-darwin/bitcoin-be4f78275fa6-x86_64-apple-darwin.tar.gz
3ddcd9d6d618b2a1769baccaf5a4d6f44cf7ac4f6554c27be2aaa50dfc5efeca  guix-build-be4f78275fa6/output/x86_64-linux-gnu/SHA256SUMS.part
49f09f86a8b485ce0b55bb56a7f214021ea56a23e942e98a4994a01559761615  guix-build-be4f78275fa6/output/x86_64-linux-gnu/bitcoin-be4f78275fa6-x86_64-linux-gnu-debug.tar.gz
fe0e969bdfeb3743074b51d2eee31da938110ec00f10b3e1d3fa8548d4400645  guix-build-be4f78275fa6/output/x86_64-linux-gnu/bitcoin-be4f78275fa6-x86_64-linux-gnu.tar.gz
b6e26a5527d84fc65077c34b61b3d813e5aa3b76383eb13aab84b2282b1b27dc  guix-build-be4f78275fa6/output/x86_64-w64-mingw32/SHA256SUMS.part
fd2352c71357a7e239da30154ca056df1f2d31594e353f44d74841d786879840  guix-build-be4f78275fa6/output/x86_64-w64-mingw32/bitcoin-be4f78275fa6-win64-debug.zip
521e156965a8bee4399ba861edf6aba75579d00b077d1b4db34b7c01d565b6d4  guix-build-be4f78275fa6/output/x86_64-w64-mingw32/bitcoin-be4f78275fa6-win64-setup-unsigned.exe
4b6ebd88fd17aac230099ceee6f40c49e5bf841e964a53f52024d04b6e447dfe  guix-build-be4f78275fa6/output/x86_64-w64-mingw32/bitcoin-be4f78275fa6-win64-unsigned.tar.gz
9830bcba326f52fb0cc529826243b2f878a975e9ae70db09bf2358c6602b39dc  guix-build-be4f78275fa6/output/x86_64-w64-mingw32/bitcoin-be4f78275fa6-win64.zip

TheCharlatan

ACK be4f782

TheCharlatan · 2024-09-09T14:22:57Z

contrib/devtools/security-check.py

+
+    # ignore stack-protector and bdb
+    chk_funcs.discard('__stack_chk')
+    chk_funcs.discard('__db_chk')


Bit unfortunate that this list has to be maintained, but I can't think of a better way either.

Yea, it's a bit annoying. At least post-BDB, it'll just be "ignore the stack protector".

DrahtBot · 2024-09-09T23:32:10Z

Guix builds (on x86_64) [untrusted test-only build, possibly unsafe, not for production use]

File	commit `712a2b5` (master)	commit `8300a35` (master and this pull)
SHA256SUMS.part	`9ad30f314fadec5b...`	`1a335b762e041b11...`
*-aarch64-linux-gnu-debug.tar.gz	`823e68da6a312e26...`	`f90829104f3c3534...`
*-aarch64-linux-gnu.tar.gz	`0d35a4c03cc25bf4...`	`408bfb43c5e4dcc6...`
*-arm-linux-gnueabihf-debug.tar.gz	`4f47c5c051f82dde...`	`76203c885c2d581f...`
*-arm-linux-gnueabihf.tar.gz	`c9237ef8593d539e...`	`6b88beb0c434ab2a...`
*-arm64-apple-darwin-unsigned.tar.gz	`1d6e67f279353867...`	`c3cc72600f2d5aac...`
*-arm64-apple-darwin-unsigned.zip	`7d97c73dd52df78d...`	`601f08682e47dae7...`
*-arm64-apple-darwin.tar.gz	`f7b9f476f26b7cee...`	`ddb4a33188172f32...`
*-powerpc64-linux-gnu-debug.tar.gz	`c1731bd23e3872e0...`	`620abd9ff752789c...`
*-powerpc64-linux-gnu.tar.gz	`eab17c7cab25293a...`	`0c37ff38214f86b2...`
*-riscv64-linux-gnu-debug.tar.gz	`0d5d330ab4c19eb9...`	`64819b3d04c3c049...`
*-riscv64-linux-gnu.tar.gz	`8140418fddd4ffe0...`	`b20d689b5e1f9110...`
*-x86_64-apple-darwin-unsigned.tar.gz	`6e73d97ff6f35412...`	`7b4337926f67ce9b...`
*-x86_64-apple-darwin-unsigned.zip	`592d4715b1893cd8...`	`1a4eb81dff4c92f2...`
*-x86_64-apple-darwin.tar.gz	`af38614dd7d3378d...`	`da43346c39b1a97b...`
*-x86_64-linux-gnu-debug.tar.gz	`ac8477768621775e...`	`e43c2937656bae46...`
*-x86_64-linux-gnu.tar.gz	`25e7e1ef671cfd5d...`	`6e48fc8761934398...`
*.tar.gz	`5fe864ecd9fad95b...`	`bcd3cfbad388d76e...`
guix_build.log	`9439849b41f164ca...`	`b5b2f18b9376d806...`
guix_build.log.diff		`48716f7fd8852415...`

hebasto · 2024-09-10T08:50:16Z

Shouldn't we check for the absence of unfortified versions of functions, rather than checking for the presence of fortified ones?

fanquake · 2024-09-10T08:54:15Z

Shouldn't we check for the absence of unfortified versions of functions, rather than checking for the presence of fortified ones?

Can you explain how that test would work? Not all functions are guaranteed to be fortified.

hebasto · 2024-09-10T09:00:53Z

Shouldn't we check for the absence of unfortified versions of functions, rather than checking for the presence of fortified ones?

Can you explain how that test would work? Not all functions are guaranteed to be fortified.

Get the list of fortified functions from all binaries.
Create a list of the corresponding unfortified functions based on the list from step 1.
Check for the absence of symbols from the list in step 2.

fanquake · 2024-09-10T09:05:57Z

Get the list of fortified functions from all binaries.

This assumes that fortification is already working correctly, otherwise you'll miss any (relevant) function that hasn't been fortified at least one time.

Again, it's not a bug to have unfortified functions. So I'm not sure what you are trying to acheive by turning that into a check failure. Can you explain further.

hebasto · 2024-09-10T09:14:29Z

Again, it's not a bug to have unfortified functions.

Then how it can be classified?

So I'm not sure what you are trying to acheive by turning that into a check failure.

Fortified functions can be statically linked into executables from a toolchain that was built with fortification enabled, while the rest of the code remains unfortified. In that case, the current PR branch will report a false positive result, won't it?

fanquake · 2024-09-10T09:18:41Z

Then how it can be classified?

As expected behaviour, given that whether fortification occurs is dependant on various (compiler & libc) heuristics.

Fortified functions can be statically linked into executables from a toolchain that was built with fortification enabled, while the rest of the code remains unfortified. In that case, the current PR branch will report a false positive result, won't it?

I don't really understand what you mean. Can you give a specific example of a false positive/issue, in the context of our Guix environment/build.

hebasto · 2024-09-10T09:43:44Z

Can you give a specific example of a false positive/issue, in the context of our Guix environment/build.

Sure. This branch clearly demonstrates false positive results for bitcoind and bitcoin-qt:

b07d7f1b7e5f5eaf8649685e7f8e031e4ac078f87dbd27e0d732c2a578ef3c4c  guix-build-423fc912bca9/output/dist-archive/bitcoin-423fc912bca9.tar.gz
e7cce3c0bdf87e4583067fdf39aea50fb4c12fb0d52cbb78e3c7c0c967a9b215  guix-build-423fc912bca9/output/x86_64-linux-gnu/SHA256SUMS.part
b14a23e900a0ed33a4cc6ca274070e793bb0c649155f2ecac236f3c58438c06c  guix-build-423fc912bca9/output/x86_64-linux-gnu/bitcoin-423fc912bca9-x86_64-linux-gnu-debug.tar.gz
a4e71897a197c0c27fa303cd701278ae2c2354e13db78bb7f74fa9ee191ab01a  guix-build-423fc912bca9/output/x86_64-linux-gnu/bitcoin-423fc912bca9-x86_64-linux-gnu.tar.gz

fanquake · 2024-09-10T09:58:41Z

Sure. This branch clearly demonstrates false positive results for bitcoind and bitcoin-qt:

Thanks. I built this branch and inspected bitcoind, and it contains calls to fortified functions. i.e:

objdump -D /root/bitcoin/guix-build-423fc912bca9/output/x86_64-linux-gnu/bitcoin-423fc912bca9/bin/bitcoind
<snip>
  6f9afe:	e8 cd dd 95 ff       	call   578d0 <__vsnprintf_chk@plt>
  6fd0a1:	e8 ba b1 95 ff       	call   58260 <__fprintf_chk@plt>
  6fe135:	e8 66 a0 95 ff       	call   581a0 <__fdelt_chk@plt>
  6fe161:	e8 3a a0 95 ff       	call   581a0 <__fdelt_chk@plt>
  6fe1ec:	e8 af 9f 95 ff       	call   581a0 <__fdelt_chk@plt>
  6fe228:	e8 73 9f 95 ff       	call   581a0 <__fdelt_chk@plt>
  6fe410:	e8 8b 9d 95 ff       	call   581a0 <__fdelt_chk@plt>
  6fe461:	e8 3a 9d 95 ff       	call   581a0 <__fdelt_chk@plt>
  6fe47f:	e8 1c 9d 95 ff       	call   581a0 <__fdelt_chk@plt>
  6ff600:	e8 1b 86 95 ff       	call   57c20 <__stack_chk_fail@plt>
  6ff85c:	e8 6f 8a 95 ff       	call   582d0 <__memcpy_chk@plt>
  6ff951:	e8 ca 82 95 ff       	call   57c20 <__stack_chk_fail@plt>
<much more output>

So how is this a false positive?

hebasto · 2024-09-10T10:02:37Z

So how is this a false positive?

This commit deletes the source fortification logic from the build system altogether. Nevertheless, the check passes.

fanquake · 2024-09-10T10:04:03Z

This commit deletes the source fortification logic from the build system altogether. Nevertheless, the check passes.

Yes, the check as implemented, which checks for (any) usage of fortified function calls in the binary, passes, because the binary contains calls to fortified functions.

…6e67b2a d8b6e67b2a kernel: Add check if the chainstate maanger is busy loading blocks f12a131af8 kernel: Process transactions 75d48e6718 kernel: Add optional mempool 889632bb70 kernel: Add support for handling transactions 476c754f3b kernel: Add check for when a block has been mutated. ebef1b465b kernel: Add support for handling block headers a56c79a2b5 kernel: Add utxo set iteration and value retrieval 33c71843e3 kernel: Add pure kernel bitcoin-chainstate ccb2bb59f9 kernel: Add block index utility functions to C header c953e1f530 kernel: Add function to read block undo data from disk to C header 55673f7f70 kernel: Add functions to read block from disk to C header 348e1c0a22 kernel: Add function for copying block data to C header 4c71ffbef6 kernel: Add functions for the block validation state to C header 160343c9c2 kernel: Add validation interface and task runner to C header 55a60d8c3f kernel: Add interrupt function to C header 0d59e95b82 kernel: Add import blocks function to C header 804e064ff6 kernel: Add chainstate load options for in-memory dbs in C header 1c829ce9f4 kernel: Add options for reindexing in C header c8a2917004 kernel: Add block validation to C header 8015b8374c Kernel: Add chainstate loading to kernel C header b3c8467b62 kernel: Add chainstate manager object to C header 07c55185c2 kernel: Add notifications context option to C header 71c45c0680 kerenl: Add chain params context option to C header d2ad67bd5f kernel: Add kernel library context object 1c6716c609 kernel: Add logging to kernel library C header 63a83b8dad kernel: Introduce initial kernel C header API REVERT: 8777c555fc kernel: Add pure kernel bitcoin-chainstate REVERT: fcc69abdb9 kernel: Add block index utility functions to C header REVERT: 266d21c9c6 kernel: Add function to read block undo data from disk to C header REVERT: 62b2926c0a kernel: Add functions to read block from disk to C header REVERT: 440d7a7a86 kernel: Add function for copying block data to C header REVERT: 8827ebd5ea kernel: Add functions for the block validation state to C header REVERT: 1ad10251b4 kernel: Add validation interface and task runner to C header REVERT: b96eb0c49c kernel: Add interrupt function to C header REVERT: d96ffb9165 kernel: Add import blocks function to C header REVERT: 28dc294a13 kernel: Add chainstate load options for in-memory dbs in C header REVERT: 7de1202a01 kernel: Add options for reindexing in C header REVERT: 2e28c5516d kernel: Add block validation to C header REVERT: f511ce1489 Kernel: Add chainstate loading to kernel C header REVERT: 7ed0a89a3e kernel: Add chainstate manager object to C header REVERT: 3fb9cec5d4 kernel: Add notifications context option to C header REVERT: d71bbbab94 kerenl: Add chain params context option to C header REVERT: 7cfc892152 kernel: Add kernel library context object REVERT: ba01b6bd0e kernel: Add logging to kernel library C header REVERT: 17b98b95eb kernel: Introduce initial kernel C header API REVERT: 0c4ff18ee9 Merge bitcoin/bitcoin#30896: kernel: Move background load thread to node context REVERT: 87d54500bf Merge bitcoin/bitcoin#30892: test: Check already deactivated network stays suspended after dumptxoutset REVERT: 71af7435ef Merge bitcoin/bitcoin#30233: refactor: move m_is_inbound out of CNodeState REVERT: 1d5b2406bb Merge bitcoin/bitcoin#30877: code style: update .editorconfig file REVERT: fea550b480 Merge bitcoin/bitcoin#30890: doc: unit test runner help fixup and improvements REVERT: 95560616fb code style: update .editorconfig file REVERT: 282f0e9255 Unit test runner documentation fix and improvements REVERT: 06a9f7789e Merge bitcoin/bitcoin#30433: build: add `standard branch-protection` to hardening flags for aarch64-linux REVERT: bc7900f33d kernel: Move background load thread to node context REVERT: e43ce250c6 Merge bitcoin-core/gui#835: Fix crash when closing wallet REVERT: 001b1cf010 build: use standard branch-protection for aarch64-linux REVERT: a965f2bc07 gui: fix crash when closing wallet REVERT: 72c9a1fe94 test: Check that network stays suspended after dumptxoutset if it was off before REVERT: cf0120ff02 Merge bitcoin/bitcoin#30880: test: Wait for local services to update in feature_assumeutxo REVERT: e46bebb444 Merge bitcoin/bitcoin#30546: util: Use consteval checked format string in FatalErrorf, LogConnectFailure REVERT: be768dbd18 Merge bitcoin/bitcoin#30618: test: support std::optional in BOOST_CHECK_* and increase FromUserHex fuzz feature coverage REVERT: 07c7c96022 Merge bitcoin/bitcoin#30883: build: Revert "Minimize I/O operations in `GenerateHeaderFrom{Json,Raw}.cmake`" REVERT: 24817e8b15 Merge bitcoin/bitcoin#30814: kernel: Create usable static kernel library REVERT: fdeb717e78 Revert "build: Minimize I/O operations in `GenerateHeaderFrom{Json,Raw}.cmake`" REVERT: 07f4cebe57 refactor: move m_is_inbound out of CNodeState REVERT: 19f4a7c95a test: Wait for local services to update in feature_assumeutxo REVERT: 7d43bca052 Merge bitcoin/bitcoin#30872: test: fix exclude parsing for functional runner REVERT: cf786eccd7 Merge bitcoin/bitcoin#30865: build: Skip secp256k1 ctime tests when tests are not being built REVERT: 23eedc5d1e build: Skip secp256k1 ctime tests when tests are not being built REVERT: fa5bc450d5 util: Use compile-time check for LogConnectFailure REVERT: fa7087b896 util: Use compile-time check for FatalErrorf REVERT: faa62c0112 util: Add ConstevalFormatString REVERT: 72b46f28bf test: fix exclude parsing for functional runner REVERT: a5e99669cc Merge bitcoin/bitcoin#30733: test: remove unused src_dir param from run_tests after CMake migration REVERT: 0c1e507278 Merge bitcoin/bitcoin#30871: build: Add more cmake presets REVERT: fcb61bbc8d Merge bitcoin/bitcoin#27038: security-check: test for `_FORTIFY_SOURCE` usage in release binaries REVERT: 85833cf05f Merge bitcoin/bitcoin#30847: test: Drop no longer needed workarounds REVERT: 11e2f9fff4 Merge bitcoin/bitcoin#30835: build: Introduce "Kernel" installation component REVERT: db8350b0e3 Merge bitcoin/bitcoin#30803: build: Minor build system fixes and amendments REVERT: a86e7a476d Merge bitcoin/bitcoin#30838: build: Use CMake's default permissions in macOS `deploy` target REVERT: f0eb63399a Merge bitcoin/bitcoin#30841: ci: Post CMake-migration fixes and amendments REVERT: 155963768a Merge bitcoin/bitcoin#30842: build: Minimize I/O operations in `GenerateHeaderFrom{Json,Raw}.cmake` REVERT: c773618886 Merge bitcoin/bitcoin#30867: build: Fix `ENABLE_WALLET` option REVERT: 349632e022 Merge bitcoin/bitcoin#30807: Fix peers abruptly disconnecting from AssumeUTXO nodes during IBD REVERT: f6298a878f Merge bitcoin/bitcoin#30840: docs: Updated debug build instructions for cmake REVERT: a8809aeb6e Merge bitcoin/bitcoin#30870: docs: updated developer notes for --with-sanitizers to -DSANITIZERS REVERT: f15e817811 build: add more CMake presets (dev-mode, libfuzzer, libfuzzer-nosan) REVERT: fae7b83eb5 lint: Remove forbidden functions from lint-format-strings.py REVERT: 4b1ce3cac8 docs: updated developer notes for --with-sanitizers to -DSANITIZERS and removed resource for -fsanitze flags REVERT: 1eac96a503 Compare FromUserHex result against other hex validators and parsers REVERT: 19947863e1 Use BOOST_CHECK_EQUAL for optional, arith_uint256, uint256, uint160 REVERT: 0725a37494 Merge bitcoin/bitcoin#30805: test: Add explicit onion bind to p2p_permissions REVERT: 0037d53d1a build: Fix `ENABLE_WALLET` option REVERT: 992f83bb6f test: add coverage for assumeUTXO honest peers disconnection REVERT: 6d5812e5c8 assumeUTXO: fix peers disconnection during sync REVERT: 082779d606 test: Add explicit onion bind to p2p_permissions REVERT: c66c68345e Merge bitcoin/bitcoin#30773: Remove unsafe uint256S() and test-only uint160S() REVERT: 2756797eca Merge bitcoin/bitcoin#30065: init: fixes file descriptor accounting REVERT: 5ba03e7d35 build: Use CMake's default permissions in macOS `deploy` target REVERT: e4fb97a512 Merge bitcoin/bitcoin#30791: build: Use correct variable name REVERT: df3f63ccfa Merge bitcoin/bitcoin#30509: multiprocess: Add -ipcbind option to bitcoin-node REVERT: 743ac30e34 Add std::optional support to Boost's equality check REVERT: 712a2b5453 Merge bitcoin/bitcoin#30817: test: Add coverage for dumptxoutset failure robustness REVERT: fb52023ee6 Merge bitcoin/bitcoin#30684: init: fix init fatal error on invalid negated option value REVERT: 746f88000e Merge bitcoin/bitcoin#30401: fix: increase consistency of rpcauth parsing REVERT: 2d68c3b1c2 build: Use correct variables when passing `-fsanitize` to libsecp256k1 REVERT: df86a4f333 Merge bitcoin/bitcoin#30845: Update libsecp256k1 subtree to latest master REVERT: be4f78275f contrib: test for FORTIFY_SOURCE in security-check.py REVERT: 94bc3c4cc0 Merge bitcoin/bitcoin#30824: cmake: decouple `FORTIFY_SOURCE` check from `Debug` build type REVERT: ba84c2774d Merge bitcoin/bitcoin#30823: cmake: add `USE_SOURCE_PERMISSIONS` to all `configure_file()` usage REVERT: da3f4cb8ee Merge bitcoin/bitcoin#30850: doc: fix minor typo REVERT: 7a669fde18 docs: Fix minor typo REVERT: 1cc93fe7b4 build: Delete dead code that implements `IF_CHECK_FAILED` option REVERT: 0b003e1ff7 docs: Updated debug build instructions for cmake REVERT: 341ad23809 build: Delete MSVC special case for `BUILD_FOR_FUZZING` option REVERT: 5c80192ff6 test: Drop no longer needed workarounds REVERT: ff54395de4 Update secp256k1 subtree to latest master REVERT: 611562806c Squashed 'src/secp256k1/' changes from 642c885b61..2f2ccc4695 REVERT: b07fe666f2 build: Minimize I/O operations in `GenerateHeaderFrom{Json,Raw}.cmake` REVERT: c45186ca54 ci: Switch from `make` to `cmake --build` REVERT: 6e5f33af58 ci: Handle log files regardless of CMake's version REVERT: fdad128b52 build: Stop enabling CMake's CMP0141 policy REVERT: b2a6f545b4 doc: Drop `ctest` command from Windows cross-compiling instructions REVERT: 73b618582d build: Print `CMAKE_CXX_COMPILER_ARG1` in summary REVERT: f03c942095 build, test: Add missed log options REVERT: 6f2cb0eafd doc: Amend comment about ZeroMQ config files REVERT: 0dd16d7118 build: Add a pkg-config file for libbitcoinkernel REVERT: 45be32f838 build: Produce a usable static kernel library REVERT: 43cd83b0c7 test: move uint256_tests/operator_with_self to arith_uint256_tests REVERT: c6c994cb2b test: remove test-only uint160S REVERT: 62cc4656e2 test: remove test-only uint256S REVERT: adc00ad728 test: remove test-only arith_uint256S REVERT: a5fa90706a Merge bitcoin/bitcoin#30834: test: Work around boost compilation error REVERT: 7b04fabe2d build: Introduce "Kernel" installation component REVERT: fa9d7d5d20 test: Work around boost compilation error REVERT: fa3ecdf778 Revert "build: work around issue with Boost <= 1.80 and Clang >= 18" REVERT: 30073e6b3a multiprocess: Add -ipcbind option to bitcoin-node REVERT: bbf95c0cc5 Merge bitcoin/bitcoin#30755: ci: Add missed configuration options to "Win64 native" job REVERT: 73fe7d7230 multiprocess: Add unit tests for connect, serve, and listen functions REVERT: 955d4077aa multiprocess: Add IPC connectAddress and listenAddress methods REVERT: 4da20434d4 depends: Update libmultiprocess library for CustomMessage function and ThreadContext bugfix REVERT: ee22bf55e3 doc: Update and amend MSVC build guide REVERT: c07fdd6546 fuzz: Don't compile BDB-specific code on MSVC in `wallet_bdb_parser.cpp` REVERT: e07a3ede52 ci: Add missed configuration options to "Win64 native" job REVERT: 1f054eca4e cmake: add USE_SOURCE_PERMISSIONS to all configure_file usage REVERT: 0e5cd608da Merge bitcoin/bitcoin#30415: contrib: fix check-deps.sh to check for weak symbols REVERT: 118b55c462 Merge bitcoin/bitcoin#30790: bench: Remove redundant logging benchmarks REVERT: c0cbe26a86 Merge bitcoin/bitcoin#30748: test: Pin and document TEST_DIR_PATH_ELEMENT, SeedRand::FIXED_SEED REVERT: c3af4b1ec3 Merge bitcoin/bitcoin#30822: cmake: scope Boost Test check to `vcpkg` REVERT: 7f472e9bcd Merge bitcoin/bitcoin#30821: build: work around issue with Boost <= 1.80 and Clang >= 18 REVERT: d4c7c4009d init: error out if -maxconnections is negative REVERT: c773649481 init: improves file descriptors accounting and docs REVERT: 29008a7ff4 init: fixes fd accounting regarding poll/select REVERT: 30803a35d5 cmake: decouple FORTIFY_SOURCE check from Debug build type REVERT: a7a4e11db8 cmake: scope Boost Test check to vcpkg REVERT: d661e2b1b7 Merge bitcoin/bitcoin#30812: lint: Check for release note snippets in the wrong folder REVERT: cd062d6684 build: work around issue with Boost <= 1.80 and Clang >= 18 REVERT: d6a1b94ffd Merge bitcoin-core/gui#834: qt, build: remove unneeded `Q_IMPORT_PLUGIN` macro calls REVERT: 6852d1d487 Merge bitcoin/bitcoin#30796: test: Use std::span and std::string_view for raw data REVERT: fa3a7ebe5b lint: Check for release note snippets in the wrong folder REVERT: fa05ee0517 Merge bitcoin/bitcoin#30772: build: Fix / improve coverage scripts REVERT: 79772cd26e Merge bitcoin/bitcoin#30743: depends: build libevent with `-D_GNU_SOURCE` REVERT: faecca9a85 test: Use span for raw data REVERT: c2b779da4e refactor: Manage dumptxoutset RAII classes with std::optional REVERT: 4b5bf335ad test: Add coverage for failing dumptxoutset behavior REVERT: f794a0d5f4 Merge bitcoin/bitcoin#30819: doc: fix assumeutxo design doc link REVERT: fadbcd51fc bench: Remove redundant logging benchmarks REVERT: fa8dd952e2 bench: Use LogInfo instead of the deprecated alias LogPrintf REVERT: e5f7272ad3 doc: fix assumeutxo design doc link REVERT: 93e48240bf Merge bitcoin/bitcoin#30244: ci: parse TEST_RUNNER_EXTRA into an array REVERT: f640b323bd Merge bitcoin/bitcoin#30723: lint: Speed up and fix flake8 checks REVERT: 3ae35b427f ci: run check-deps.sh as part of clang-tidy job REVERT: 0aaa1298a0 contrib: fix check-deps.sh when libraries do not import symbols REVERT: 3c99f5a38a contrib: fix check-deps.sh to check for weak symbols REVERT: 86c80e9cf2 contrib: make check-deps.sh script work with cmake REVERT: 5373aa30e2 Merge bitcoin/bitcoin#30788: test: fixing failing system_tests/run_command under some Locales REVERT: 3210d87dfc Merge bitcoin/bitcoin#29043: fuzz: make FuzzedDataProvider usage deterministic REVERT: 81276540d3 Merge bitcoin/bitcoin#30148: cli: restrict multiple exclusive argument usage in bitcoin-cli REVERT: 210210c923 Merge bitcoin/bitcoin#29566: test: update satoshi_round function REVERT: b0c3de6847 Merge bitcoin/bitcoin#28417: contrib/signet/miner updates REVERT: cb65ac469a Merge bitcoin/bitcoin#29605: net: Favor peers from addrman over fetching seednodes REVERT: b8d2f58e06 Merge bitcoin/bitcoin#30808: rpc: dumptxoutset height parameter follow-ups (29553) REVERT: f51b237723 refactor: rpc: use uint256::FromHex for ParseHashV REVERT: d9fcbfc372 build: Add `JOBS` variable support to `CoverageFuzz.cmake` script REVERT: e7cf4a6f27 build: Add missed `-g` for "Coverage" build configuration REVERT: fe2003ab12 build: Add `COMMAND_ERROR_IS_FATAL` to every process in coverage scrips REVERT: a3108a7c56 rpc: Manage dumptxoutset rollback with RAII class REVERT: c5eaae3b89 doc: Add -rpcclienttimeout=0 to loadtxoutset examples REVERT: 598b9bba5a rpc: Don't re-enable previously disabled network after dumptxoutset REVERT: ae48a22a3d test: fixing failing system_tests/run_command under some Locales REVERT: fac973647d test: Use string_view for json_tests REVERT: 5567754087 depends: build libevent with -D_GNU_SOURCE REVERT: 7346b01092 qt, build: remove unneeded `Q_IMPORT_PLUGIN` macro calls REVERT: fa84f9decd test: Pin and document TEST_DIR_PATH_ELEMENT REVERT: 2ad560139b Remove unused src_dir param from run_tests REVERT: 2222f7a874 test: Rename SeedRand::SEED to FIXED_SEED for clarity REVERT: fafdb7df34 lint: Speed up flake8 checks REVERT: faf17df7fb lint: Document missing py_lint dependency REVERT: faebeb828f lint: Remove python whitespace and shadowing lint rules REVERT: 7777047835 lint: Remove python lint rules that are SyntaxError REVERT: faaf3e53f0 test: [refactor] Fix F841 flake8 REVERT: 444421db69 test: [refactor] Fix E714 pycodestyle REVERT: ee47ca29d6 init: fix fatal error on '-wallet' negated option value REVERT: 27c976d11a fix: increase consistency of rpcauth parsing REVERT: 2ad3689512 test: add norpcauth test REVERT: 67df0dec1a test: blank rpcauth CLI interaction REVERT: fb6d51eb25 signet/miner: Use argparse exclusive groups REVERT: ec317bc44b test: update satoshi_round function REVERT: ecc98ccff2 test: add cases for blank rpcauth REVERT: c8e6771af0 test: restrict multiple CLI arguments REVERT: 8838c4f171 common/args.h: automate check for multiple cli commands REVERT: 6eeb188d40 test: adds seednode functional tests REVERT: 3270f0adad net: Favor peers from addrman over fetching seednodes REVERT: 8131bf7483 ci: parse TEST_RUNNER_EXTRA into an array REVERT: c4762b0aa0 test: allow excluding func test by name and arg REVERT: 338a266a9a signet/miner: add support for a poolnum/poolid tag in mined blocks REVERT: 409ab7d35b signet/miner: add Generate.mine function REVERT: 7b31332370 signet/miner: add Generate.gbt function REVERT: 85c5c0bea9 signet/miner: add Generate.next_block_time function REVERT: 5540e6ca49 signet/miner: move next_block_* functions into new Generator class REVERT: 35f4631196 signet/miner: rename do_decode_psbt to decode_psbt REVERT: aac040b439 signet/miner: drop create_coinbase function REVERT: 16951f549e signet/miner: drop do_createpsbt function REVERT: 3aed0a4284 signet/miner: drop get_reward_address function REVERT: 01960c53c7 fuzz: make FuzzedDataProvider usage deterministic git-subtree-dir: libbitcoinkernel-sys/bitcoin git-subtree-split: d8b6e67b2a12332f188320e90262e2d741e27f7b

…e7b1f5e d5ee7b1f5e kernel: Add check if the chainstate maanger is busy loading blocks 604752a1da kernel: Process transactions 37d74344e8 kernel: Add optional mempool fdfb45e273 kernel: Add support for handling transactions 5ed4aa699c kernel: Add check for when a block has been mutated. b8f6a2740d kernel: Add support for handling block headers 1aad96a695 kernel: Add utxo set iteration and value retrieval 8777c555fc kernel: Add pure kernel bitcoin-chainstate fcc69abdb9 kernel: Add block index utility functions to C header 266d21c9c6 kernel: Add function to read block undo data from disk to C header 62b2926c0a kernel: Add functions to read block from disk to C header 440d7a7a86 kernel: Add function for copying block data to C header 8827ebd5ea kernel: Add functions for the block validation state to C header 1ad10251b4 kernel: Add validation interface and task runner to C header b96eb0c49c kernel: Add interrupt function to C header d96ffb9165 kernel: Add import blocks function to C header 28dc294a13 kernel: Add chainstate load options for in-memory dbs in C header 7de1202a01 kernel: Add options for reindexing in C header 2e28c5516d kernel: Add block validation to C header f511ce1489 Kernel: Add chainstate loading to kernel C header 7ed0a89a3e kernel: Add chainstate manager object to C header 3fb9cec5d4 kernel: Add notifications context option to C header d71bbbab94 kerenl: Add chain params context option to C header 7cfc892152 kernel: Add kernel library context object ba01b6bd0e kernel: Add logging to kernel library C header 17b98b95eb kernel: Introduce initial kernel C header API 0c4ff18ee9 Merge bitcoin/bitcoin#30896: kernel: Move background load thread to node context 87d54500bf Merge bitcoin/bitcoin#30892: test: Check already deactivated network stays suspended after dumptxoutset 71af7435ef Merge bitcoin/bitcoin#30233: refactor: move m_is_inbound out of CNodeState 1d5b2406bb Merge bitcoin/bitcoin#30877: code style: update .editorconfig file fea550b480 Merge bitcoin/bitcoin#30890: doc: unit test runner help fixup and improvements 95560616fb code style: update .editorconfig file 282f0e9255 Unit test runner documentation fix and improvements 06a9f7789e Merge bitcoin/bitcoin#30433: build: add `standard branch-protection` to hardening flags for aarch64-linux bc7900f33d kernel: Move background load thread to node context e43ce250c6 Merge bitcoin-core/gui#835: Fix crash when closing wallet 001b1cf010 build: use standard branch-protection for aarch64-linux a965f2bc07 gui: fix crash when closing wallet 72c9a1fe94 test: Check that network stays suspended after dumptxoutset if it was off before cf0120ff02 Merge bitcoin/bitcoin#30880: test: Wait for local services to update in feature_assumeutxo e46bebb444 Merge bitcoin/bitcoin#30546: util: Use consteval checked format string in FatalErrorf, LogConnectFailure be768dbd18 Merge bitcoin/bitcoin#30618: test: support std::optional in BOOST_CHECK_* and increase FromUserHex fuzz feature coverage 07c7c96022 Merge bitcoin/bitcoin#30883: build: Revert "Minimize I/O operations in `GenerateHeaderFrom{Json,Raw}.cmake`" 24817e8b15 Merge bitcoin/bitcoin#30814: kernel: Create usable static kernel library fdeb717e78 Revert "build: Minimize I/O operations in `GenerateHeaderFrom{Json,Raw}.cmake`" 07f4cebe57 refactor: move m_is_inbound out of CNodeState 19f4a7c95a test: Wait for local services to update in feature_assumeutxo 7d43bca052 Merge bitcoin/bitcoin#30872: test: fix exclude parsing for functional runner cf786eccd7 Merge bitcoin/bitcoin#30865: build: Skip secp256k1 ctime tests when tests are not being built 23eedc5d1e build: Skip secp256k1 ctime tests when tests are not being built fa5bc450d5 util: Use compile-time check for LogConnectFailure fa7087b896 util: Use compile-time check for FatalErrorf faa62c0112 util: Add ConstevalFormatString 72b46f28bf test: fix exclude parsing for functional runner a5e99669cc Merge bitcoin/bitcoin#30733: test: remove unused src_dir param from run_tests after CMake migration 0c1e507278 Merge bitcoin/bitcoin#30871: build: Add more cmake presets fcb61bbc8d Merge bitcoin/bitcoin#27038: security-check: test for `_FORTIFY_SOURCE` usage in release binaries 85833cf05f Merge bitcoin/bitcoin#30847: test: Drop no longer needed workarounds 11e2f9fff4 Merge bitcoin/bitcoin#30835: build: Introduce "Kernel" installation component db8350b0e3 Merge bitcoin/bitcoin#30803: build: Minor build system fixes and amendments a86e7a476d Merge bitcoin/bitcoin#30838: build: Use CMake's default permissions in macOS `deploy` target f0eb63399a Merge bitcoin/bitcoin#30841: ci: Post CMake-migration fixes and amendments 155963768a Merge bitcoin/bitcoin#30842: build: Minimize I/O operations in `GenerateHeaderFrom{Json,Raw}.cmake` c773618886 Merge bitcoin/bitcoin#30867: build: Fix `ENABLE_WALLET` option 349632e022 Merge bitcoin/bitcoin#30807: Fix peers abruptly disconnecting from AssumeUTXO nodes during IBD f6298a878f Merge bitcoin/bitcoin#30840: docs: Updated debug build instructions for cmake a8809aeb6e Merge bitcoin/bitcoin#30870: docs: updated developer notes for --with-sanitizers to -DSANITIZERS f15e817811 build: add more CMake presets (dev-mode, libfuzzer, libfuzzer-nosan) fae7b83eb5 lint: Remove forbidden functions from lint-format-strings.py 4b1ce3cac8 docs: updated developer notes for --with-sanitizers to -DSANITIZERS and removed resource for -fsanitze flags 1eac96a503 Compare FromUserHex result against other hex validators and parsers 19947863e1 Use BOOST_CHECK_EQUAL for optional, arith_uint256, uint256, uint160 0725a37494 Merge bitcoin/bitcoin#30805: test: Add explicit onion bind to p2p_permissions 0037d53d1a build: Fix `ENABLE_WALLET` option 992f83bb6f test: add coverage for assumeUTXO honest peers disconnection 6d5812e5c8 assumeUTXO: fix peers disconnection during sync 082779d606 test: Add explicit onion bind to p2p_permissions c66c68345e Merge bitcoin/bitcoin#30773: Remove unsafe uint256S() and test-only uint160S() 2756797eca Merge bitcoin/bitcoin#30065: init: fixes file descriptor accounting 5ba03e7d35 build: Use CMake's default permissions in macOS `deploy` target e4fb97a512 Merge bitcoin/bitcoin#30791: build: Use correct variable name df3f63ccfa Merge bitcoin/bitcoin#30509: multiprocess: Add -ipcbind option to bitcoin-node 743ac30e34 Add std::optional support to Boost's equality check 712a2b5453 Merge bitcoin/bitcoin#30817: test: Add coverage for dumptxoutset failure robustness fb52023ee6 Merge bitcoin/bitcoin#30684: init: fix init fatal error on invalid negated option value 746f88000e Merge bitcoin/bitcoin#30401: fix: increase consistency of rpcauth parsing 2d68c3b1c2 build: Use correct variables when passing `-fsanitize` to libsecp256k1 df86a4f333 Merge bitcoin/bitcoin#30845: Update libsecp256k1 subtree to latest master be4f78275f contrib: test for FORTIFY_SOURCE in security-check.py 94bc3c4cc0 Merge bitcoin/bitcoin#30824: cmake: decouple `FORTIFY_SOURCE` check from `Debug` build type ba84c2774d Merge bitcoin/bitcoin#30823: cmake: add `USE_SOURCE_PERMISSIONS` to all `configure_file()` usage da3f4cb8ee Merge bitcoin/bitcoin#30850: doc: fix minor typo 7a669fde18 docs: Fix minor typo 1cc93fe7b4 build: Delete dead code that implements `IF_CHECK_FAILED` option 0b003e1ff7 docs: Updated debug build instructions for cmake 341ad23809 build: Delete MSVC special case for `BUILD_FOR_FUZZING` option 5c80192ff6 test: Drop no longer needed workarounds ff54395de4 Update secp256k1 subtree to latest master 611562806c Squashed 'src/secp256k1/' changes from 642c885b61..2f2ccc4695 b07fe666f2 build: Minimize I/O operations in `GenerateHeaderFrom{Json,Raw}.cmake` c45186ca54 ci: Switch from `make` to `cmake --build` 6e5f33af58 ci: Handle log files regardless of CMake's version fdad128b52 build: Stop enabling CMake's CMP0141 policy b2a6f545b4 doc: Drop `ctest` command from Windows cross-compiling instructions 73b618582d build: Print `CMAKE_CXX_COMPILER_ARG1` in summary f03c942095 build, test: Add missed log options 6f2cb0eafd doc: Amend comment about ZeroMQ config files 0dd16d7118 build: Add a pkg-config file for libbitcoinkernel 45be32f838 build: Produce a usable static kernel library 43cd83b0c7 test: move uint256_tests/operator_with_self to arith_uint256_tests c6c994cb2b test: remove test-only uint160S 62cc4656e2 test: remove test-only uint256S adc00ad728 test: remove test-only arith_uint256S a5fa90706a Merge bitcoin/bitcoin#30834: test: Work around boost compilation error 7b04fabe2d build: Introduce "Kernel" installation component fa9d7d5d20 test: Work around boost compilation error fa3ecdf778 Revert "build: work around issue with Boost <= 1.80 and Clang >= 18" 30073e6b3a multiprocess: Add -ipcbind option to bitcoin-node bbf95c0cc5 Merge bitcoin/bitcoin#30755: ci: Add missed configuration options to "Win64 native" job 73fe7d7230 multiprocess: Add unit tests for connect, serve, and listen functions 955d4077aa multiprocess: Add IPC connectAddress and listenAddress methods 4da20434d4 depends: Update libmultiprocess library for CustomMessage function and ThreadContext bugfix ee22bf55e3 doc: Update and amend MSVC build guide c07fdd6546 fuzz: Don't compile BDB-specific code on MSVC in `wallet_bdb_parser.cpp` e07a3ede52 ci: Add missed configuration options to "Win64 native" job 1f054eca4e cmake: add USE_SOURCE_PERMISSIONS to all configure_file usage 0e5cd608da Merge bitcoin/bitcoin#30415: contrib: fix check-deps.sh to check for weak symbols 118b55c462 Merge bitcoin/bitcoin#30790: bench: Remove redundant logging benchmarks c0cbe26a86 Merge bitcoin/bitcoin#30748: test: Pin and document TEST_DIR_PATH_ELEMENT, SeedRand::FIXED_SEED c3af4b1ec3 Merge bitcoin/bitcoin#30822: cmake: scope Boost Test check to `vcpkg` 7f472e9bcd Merge bitcoin/bitcoin#30821: build: work around issue with Boost <= 1.80 and Clang >= 18 d4c7c4009d init: error out if -maxconnections is negative c773649481 init: improves file descriptors accounting and docs 29008a7ff4 init: fixes fd accounting regarding poll/select 30803a35d5 cmake: decouple FORTIFY_SOURCE check from Debug build type a7a4e11db8 cmake: scope Boost Test check to vcpkg d661e2b1b7 Merge bitcoin/bitcoin#30812: lint: Check for release note snippets in the wrong folder cd062d6684 build: work around issue with Boost <= 1.80 and Clang >= 18 d6a1b94ffd Merge bitcoin-core/gui#834: qt, build: remove unneeded `Q_IMPORT_PLUGIN` macro calls 6852d1d487 Merge bitcoin/bitcoin#30796: test: Use std::span and std::string_view for raw data fa3a7ebe5b lint: Check for release note snippets in the wrong folder fa05ee0517 Merge bitcoin/bitcoin#30772: build: Fix / improve coverage scripts 79772cd26e Merge bitcoin/bitcoin#30743: depends: build libevent with `-D_GNU_SOURCE` faecca9a85 test: Use span for raw data c2b779da4e refactor: Manage dumptxoutset RAII classes with std::optional 4b5bf335ad test: Add coverage for failing dumptxoutset behavior f794a0d5f4 Merge bitcoin/bitcoin#30819: doc: fix assumeutxo design doc link fadbcd51fc bench: Remove redundant logging benchmarks fa8dd952e2 bench: Use LogInfo instead of the deprecated alias LogPrintf e5f7272ad3 doc: fix assumeutxo design doc link 93e48240bf Merge bitcoin/bitcoin#30244: ci: parse TEST_RUNNER_EXTRA into an array f640b323bd Merge bitcoin/bitcoin#30723: lint: Speed up and fix flake8 checks 3ae35b427f ci: run check-deps.sh as part of clang-tidy job 0aaa1298a0 contrib: fix check-deps.sh when libraries do not import symbols 3c99f5a38a contrib: fix check-deps.sh to check for weak symbols 86c80e9cf2 contrib: make check-deps.sh script work with cmake 5373aa30e2 Merge bitcoin/bitcoin#30788: test: fixing failing system_tests/run_command under some Locales 3210d87dfc Merge bitcoin/bitcoin#29043: fuzz: make FuzzedDataProvider usage deterministic 81276540d3 Merge bitcoin/bitcoin#30148: cli: restrict multiple exclusive argument usage in bitcoin-cli 210210c923 Merge bitcoin/bitcoin#29566: test: update satoshi_round function b0c3de6847 Merge bitcoin/bitcoin#28417: contrib/signet/miner updates cb65ac469a Merge bitcoin/bitcoin#29605: net: Favor peers from addrman over fetching seednodes b8d2f58e06 Merge bitcoin/bitcoin#30808: rpc: dumptxoutset height parameter follow-ups (29553) f51b237723 refactor: rpc: use uint256::FromHex for ParseHashV d9fcbfc372 build: Add `JOBS` variable support to `CoverageFuzz.cmake` script e7cf4a6f27 build: Add missed `-g` for "Coverage" build configuration fe2003ab12 build: Add `COMMAND_ERROR_IS_FATAL` to every process in coverage scrips a3108a7c56 rpc: Manage dumptxoutset rollback with RAII class c5eaae3b89 doc: Add -rpcclienttimeout=0 to loadtxoutset examples 598b9bba5a rpc: Don't re-enable previously disabled network after dumptxoutset ae48a22a3d test: fixing failing system_tests/run_command under some Locales fac973647d test: Use string_view for json_tests 5567754087 depends: build libevent with -D_GNU_SOURCE 7346b01092 qt, build: remove unneeded `Q_IMPORT_PLUGIN` macro calls fa84f9decd test: Pin and document TEST_DIR_PATH_ELEMENT 2ad560139b Remove unused src_dir param from run_tests 2222f7a874 test: Rename SeedRand::SEED to FIXED_SEED for clarity fafdb7df34 lint: Speed up flake8 checks faf17df7fb lint: Document missing py_lint dependency faebeb828f lint: Remove python whitespace and shadowing lint rules 7777047835 lint: Remove python lint rules that are SyntaxError faaf3e53f0 test: [refactor] Fix F841 flake8 444421db69 test: [refactor] Fix E714 pycodestyle ee47ca29d6 init: fix fatal error on '-wallet' negated option value 27c976d11a fix: increase consistency of rpcauth parsing 2ad3689512 test: add norpcauth test 67df0dec1a test: blank rpcauth CLI interaction fb6d51eb25 signet/miner: Use argparse exclusive groups ec317bc44b test: update satoshi_round function ecc98ccff2 test: add cases for blank rpcauth c8e6771af0 test: restrict multiple CLI arguments 8838c4f171 common/args.h: automate check for multiple cli commands 6eeb188d40 test: adds seednode functional tests 3270f0adad net: Favor peers from addrman over fetching seednodes 8131bf7483 ci: parse TEST_RUNNER_EXTRA into an array c4762b0aa0 test: allow excluding func test by name and arg 338a266a9a signet/miner: add support for a poolnum/poolid tag in mined blocks 409ab7d35b signet/miner: add Generate.mine function 7b31332370 signet/miner: add Generate.gbt function 85c5c0bea9 signet/miner: add Generate.next_block_time function 5540e6ca49 signet/miner: move next_block_* functions into new Generator class 35f4631196 signet/miner: rename do_decode_psbt to decode_psbt aac040b439 signet/miner: drop create_coinbase function 16951f549e signet/miner: drop do_createpsbt function 3aed0a4284 signet/miner: drop get_reward_address function 01960c53c7 fuzz: make FuzzedDataProvider usage deterministic REVERT: d8b6e67b2a kernel: Add check if the chainstate maanger is busy loading blocks REVERT: f12a131af8 kernel: Process transactions REVERT: 75d48e6718 kernel: Add optional mempool REVERT: 889632bb70 kernel: Add support for handling transactions REVERT: 476c754f3b kernel: Add check for when a block has been mutated. REVERT: ebef1b465b kernel: Add support for handling block headers REVERT: a56c79a2b5 kernel: Add utxo set iteration and value retrieval REVERT: 33c71843e3 kernel: Add pure kernel bitcoin-chainstate REVERT: ccb2bb59f9 kernel: Add block index utility functions to C header REVERT: c953e1f530 kernel: Add function to read block undo data from disk to C header REVERT: 55673f7f70 kernel: Add functions to read block from disk to C header REVERT: 348e1c0a22 kernel: Add function for copying block data to C header REVERT: 4c71ffbef6 kernel: Add functions for the block validation state to C header REVERT: 160343c9c2 kernel: Add validation interface and task runner to C header REVERT: 55a60d8c3f kernel: Add interrupt function to C header REVERT: 0d59e95b82 kernel: Add import blocks function to C header REVERT: 804e064ff6 kernel: Add chainstate load options for in-memory dbs in C header REVERT: 1c829ce9f4 kernel: Add options for reindexing in C header REVERT: c8a2917004 kernel: Add block validation to C header REVERT: 8015b8374c Kernel: Add chainstate loading to kernel C header REVERT: b3c8467b62 kernel: Add chainstate manager object to C header REVERT: 07c55185c2 kernel: Add notifications context option to C header REVERT: 71c45c0680 kerenl: Add chain params context option to C header REVERT: d2ad67bd5f kernel: Add kernel library context object REVERT: 1c6716c609 kernel: Add logging to kernel library C header REVERT: 63a83b8dad kernel: Introduce initial kernel C header API git-subtree-dir: libbitcoinkernel-sys/bitcoin git-subtree-split: d5ee7b1f5ee19e454a74d00502a0bf7be849c260

fanquake mentioned this pull request Feb 5, 2023

build: use _FORTIFY_SOURCE=3 #27027

Merged

fanquake mentioned this pull request Feb 17, 2023

depends: harden libevent #27118

Merged

fanquake force-pushed the sec_check_fortify_source branch from f4de92e to 0ed3654 Compare February 17, 2023 14:36

DrahtBot mentioned this pull request Feb 17, 2023

guix: Pointer Authentication and Branch Target Identification for aarch64 Linux #24123

Draft

fanquake force-pushed the sec_check_fortify_source branch from 0ed3654 to 4fea80e Compare February 28, 2023 10:30

fanquake force-pushed the sec_check_fortify_source branch from 4fea80e to 0ff65e0 Compare March 31, 2023 16:10

fanquake force-pushed the sec_check_fortify_source branch from 0ff65e0 to 4f4ba44 Compare July 27, 2023 09:37

fanquake force-pushed the sec_check_fortify_source branch from 4f4ba44 to 2d0324f Compare September 6, 2023 09:25

fanquake force-pushed the sec_check_fortify_source branch from 2d0324f to 80e1df5 Compare October 2, 2023 13:46

DrahtBot added CI failed and removed CI failed labels Oct 29, 2023

fanquake force-pushed the sec_check_fortify_source branch from 80e1df5 to 829f19e Compare December 8, 2023 11:56

DrahtBot added the CI failed label Jan 13, 2024

fanquake force-pushed the sec_check_fortify_source branch from 829f19e to 0295a78 Compare March 19, 2024 10:40

DrahtBot removed the CI failed label Mar 19, 2024

laanwj reviewed Apr 24, 2024

View reviewed changes

contrib/devtools/security-check.py Show resolved Hide resolved

DrahtBot mentioned this pull request Apr 29, 2024

guix: build with glibc 2.31 #29987

Merged

fanquake force-pushed the sec_check_fortify_source branch from 0295a78 to ae6ccb4 Compare June 26, 2024 14:34

DrahtBot mentioned this pull request Jul 4, 2024

contrib: use c++ compiler rather than c compiler for binary checks #30387

Merged

fanquake force-pushed the sec_check_fortify_source branch from ea79e13 to bfd70dc Compare August 30, 2024 16:46

ryanofsky mentioned this pull request Sep 5, 2024

cmake: decouple FORTIFY_SOURCE check from Debug build type #30824

Merged

fanquake force-pushed the sec_check_fortify_source branch from bfd70dc to 6c9000c Compare September 6, 2024 09:02

DrahtBot requested a review from hebasto September 8, 2024 09:34

contrib: test for FORTIFY_SOURCE in security-check.py

be4f782

fanquake force-pushed the sec_check_fortify_source branch from 6c9000c to be4f782 Compare September 9, 2024 11:35

fanquake added the DrahtBot Guix build requested label Sep 9, 2024

TheCharlatan approved these changes Sep 9, 2024

View reviewed changes

DrahtBot requested a review from laanwj September 9, 2024 14:23

DrahtBot added the CI failed label Sep 9, 2024

DrahtBot removed the DrahtBot Guix build requested label Sep 9, 2024

fanquake merged commit fcb61bb into bitcoin:master Sep 12, 2024
14 of 16 checks passed

fanquake deleted the sec_check_fortify_source branch September 12, 2024 10:32

security-check: test for _FORTIFY_SOURCE usage in release binaries #27038

security-check: test for _FORTIFY_SOURCE usage in release binaries #27038

Uh oh!

Conversation

fanquake commented Feb 3, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DrahtBot commented Feb 3, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage

Reviews

Conflicts

Uh oh!

fanquake commented Feb 13, 2023

Uh oh!

fanquake commented Feb 17, 2023

Uh oh!

fanquake commented Feb 28, 2023

Uh oh!

hebasto commented Oct 25, 2023

Uh oh!

hebasto commented Oct 25, 2023

Uh oh!

fanquake commented Oct 25, 2023

Uh oh!

laanwj commented Apr 24, 2024

Uh oh!

Uh oh!

laanwj commented Apr 24, 2024

Uh oh!

fanquake commented Sep 6, 2024

Uh oh!

laanwj commented Sep 8, 2024

Uh oh!

fanquake commented Sep 9, 2024

Uh oh!

TheCharlatan commented Sep 9, 2024

Uh oh!

TheCharlatan left a comment

Choose a reason for hiding this comment

Uh oh!

TheCharlatan Sep 9, 2024

Choose a reason for hiding this comment

Uh oh!

fanquake Sep 10, 2024

Choose a reason for hiding this comment

Uh oh!

DrahtBot commented Sep 9, 2024

Guix builds (on x86_64) [untrusted test-only build, possibly unsafe, not for production use]

Uh oh!

hebasto commented Sep 10, 2024

Uh oh!

fanquake commented Sep 10, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hebasto commented Sep 10, 2024

Uh oh!

fanquake commented Sep 10, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hebasto commented Sep 10, 2024

Uh oh!

fanquake commented Sep 10, 2024

Uh oh!

hebasto commented Sep 10, 2024

Uh oh!

fanquake commented Sep 10, 2024

Uh oh!

hebasto commented Sep 10, 2024

Uh oh!

fanquake commented Sep 10, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

security-check: test for `_FORTIFY_SOURCE` usage in release binaries #27038

security-check: test for `_FORTIFY_SOURCE` usage in release binaries #27038

fanquake commented Feb 3, 2023 •

edited

Loading

DrahtBot commented Feb 3, 2023 •

edited

Loading

fanquake commented Sep 10, 2024 •

edited

Loading

fanquake commented Sep 10, 2024 •

edited

Loading

fanquake commented Sep 10, 2024 •

edited

Loading