scripts: make security checks architecture independent #23838
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers. ConflictsReviewers, this pull request conflicts with the following ones:
If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first. |
|
@fanquake seeing significant differences between our hashes, will perform another build just in case: |
Given that there aren't any changes to code / dependencies here, that should be impossible. It'd the same as if we Guix built a PR which only modified a doc.md, and then got a mismatch. There must be some caching / local issue introducing non-determinism in either environment. The main point of the Guix build in this PR is to show that the (test-)security checks are still passing. |
|
Concept ACK. |
Guix builds:They match @jarolrod's ones except for |
laanwj
reviewed
Jan 3, 2022
This paves the way for using and checking for architecture dependent flags like -fcf-protection on x86_64 Linux and -mbranch-protection on 64 bit ARM.
99f79d4 to
b9898ae
Compare
Guix builds: |
hebasto
approved these changes
Jan 3, 2022
sidhujag
pushed a commit
to syscoin/syscoin
that referenced
this pull request
Jan 4, 2022
…endent b9898ae scripts: make security checks architecture independent (fanquake) Pull request description: This paves the way for using and checking for architecture dependent flags like `-fcf-protection` on x86_64 Linux and `-mbranch-protection` on 64 bit ARM. While we need a workaround for RISCV arch detection, I sent a change upstream (lief-project/LIEF#640), which has been merged. So we can drop this workaround along with our other RISCV workarounds (i.e lief-project/LIEF#562) with the next LIEF release. Required for bitcoin#19075, bitcoin#21851, bitcoin#21888 etc. Guix build: ```bash bash-5.1# find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum c57bcad9d763aae223a256283fef6243d79e0df46c5b5706dc9034a87df56694 guix-build-b9898aeeaa6a/output/aarch64-linux-gnu/SHA256SUMS.part f16fb8f0a2d4dfd576fea440c487722d076f3db9d10ec0480b2f94df0c92a6a3 guix-build-b9898aeeaa6a/output/aarch64-linux-gnu/bitcoin-b9898aeeaa6a-aarch64-linux-gnu-debug.tar.gz 0e6e660eca7484ddb160b3d62d8867cf171044e81e719de899cd9b8b898cc614 guix-build-b9898aeeaa6a/output/aarch64-linux-gnu/bitcoin-b9898aeeaa6a-aarch64-linux-gnu.tar.gz 29f14e305a280dc1d33a1f2d660db952caf6f3a9aeff9ab9560f122821269ab2 guix-build-b9898aeeaa6a/output/arm-linux-gnueabihf/SHA256SUMS.part 26477f58601363dfe8eb2639472f71943bc341d415b6190316af232f363f5485 guix-build-b9898aeeaa6a/output/arm-linux-gnueabihf/bitcoin-b9898aeeaa6a-arm-linux-gnueabihf-debug.tar.gz 372be53fd6d7fedad1bddc45cd9d1ce34cff376eaae4f613e2aa2465728fba82 guix-build-b9898aeeaa6a/output/arm-linux-gnueabihf/bitcoin-b9898aeeaa6a-arm-linux-gnueabihf.tar.gz 39778c9d2949deaba404c90b930e5a0b72663bb05e9d82e93439be131fd622e3 guix-build-b9898aeeaa6a/output/dist-archive/bitcoin-b9898aeeaa6a.tar.gz 599eee817b364b0348034a3e8c97b4bb1a35a78e3ba3472f7589f7a241947b51 guix-build-b9898aeeaa6a/output/powerpc64-linux-gnu/SHA256SUMS.part ade0c5ac07d467aa73f85d2a08c3fc3b311816869a2b6903bba4b4e6c88ad9d2 guix-build-b9898aeeaa6a/output/powerpc64-linux-gnu/bitcoin-b9898aeeaa6a-powerpc64-linux-gnu-debug.tar.gz c63db0e2570756df0b459e6114f01f0b47972ba8d81fcd9568edee95dfade23b guix-build-b9898aeeaa6a/output/powerpc64-linux-gnu/bitcoin-b9898aeeaa6a-powerpc64-linux-gnu.tar.gz dc4e6ba6958e534161a54669ff5d75bc312cfeb92567cc2092235eed0e2f6aa7 guix-build-b9898aeeaa6a/output/powerpc64le-linux-gnu/SHA256SUMS.part 3ce4c7e50915f72f24fcd24e1e1bc8460cdf2c065e390cf5f626c4cffd50961c guix-build-b9898aeeaa6a/output/powerpc64le-linux-gnu/bitcoin-b9898aeeaa6a-powerpc64le-linux-gnu-debug.tar.gz c8f4a8f10f16fab07547553f1f2580c4aa98ac63246fb30da0560a6367990dd1 guix-build-b9898aeeaa6a/output/powerpc64le-linux-gnu/bitcoin-b9898aeeaa6a-powerpc64le-linux-gnu.tar.gz 8206937fefc76cc277cc7aa8762d7554575942a9e1704106d5ab9b6fe01d5408 guix-build-b9898aeeaa6a/output/riscv64-linux-gnu/SHA256SUMS.part 9530ee044927df02d96c3a9e5974d68b70a7105cb943b94e846c496c2d0579b9 guix-build-b9898aeeaa6a/output/riscv64-linux-gnu/bitcoin-b9898aeeaa6a-riscv64-linux-gnu-debug.tar.gz fc4885db902c3205d3c1bc45c7e03375e621633efb419df37f145d11329bd6ed guix-build-b9898aeeaa6a/output/riscv64-linux-gnu/bitcoin-b9898aeeaa6a-riscv64-linux-gnu.tar.gz caedbc37d5aa5fbb0e370019ce5f1d5f6745b32153f562b0aee80aceec57deab guix-build-b9898aeeaa6a/output/x86_64-apple-darwin/SHA256SUMS.part 1b363dfde1d83530ec4deb0f24547c07446f5db99f327fe382a6e91b4b6cc454 guix-build-b9898aeeaa6a/output/x86_64-apple-darwin/bitcoin-b9898aeeaa6a-osx-unsigned.dmg bee82fe6e50a249eab21b6c97ad7436447489d0eabe3e5f7c992ba3b22dfc5ea guix-build-b9898aeeaa6a/output/x86_64-apple-darwin/bitcoin-b9898aeeaa6a-osx-unsigned.tar.gz a935280e1229c69bdd29f32d4c894f1384e765872c68ea0dcdacdf897d4bc013 guix-build-b9898aeeaa6a/output/x86_64-apple-darwin/bitcoin-b9898aeeaa6a-osx64.tar.gz 370a87e34e694fe44ba0cd809a1ba044bcc0e7e100b01d74a883069b3d754d1c guix-build-b9898aeeaa6a/output/x86_64-linux-gnu/SHA256SUMS.part 46f8c3aa2c3a65f3fc73ddda344724e800bb463d80b062dc749ab76f4c21bc8c guix-build-b9898aeeaa6a/output/x86_64-linux-gnu/bitcoin-b9898aeeaa6a-x86_64-linux-gnu-debug.tar.gz 9704b95152ebe582f8aa70bbab8f34ea5e32d80dfda948c019cb9f7d0982f36c guix-build-b9898aeeaa6a/output/x86_64-linux-gnu/bitcoin-b9898aeeaa6a-x86_64-linux-gnu.tar.gz 8385a966601ab4b9dc11d4467435c26af93dce97b66f3d33d7a8f7a885ac326d guix-build-b9898aeeaa6a/output/x86_64-w64-mingw32/SHA256SUMS.part f46812804e79166e5440b678166ce2cc38b5628d1a9e312b3af138720cacc478 guix-build-b9898aeeaa6a/output/x86_64-w64-mingw32/bitcoin-b9898aeeaa6a-win-unsigned.tar.gz 1d7077fdc59ce6af2ea5bffaa5a2ab579f8e8382467a7140623a6a2c4a588a0c guix-build-b9898aeeaa6a/output/x86_64-w64-mingw32/bitcoin-b9898aeeaa6a-win64-debug.zip 033fa4263ec91ca1e53ff652f12104c3c2aa7da9240a9b48bfa8f2341c79a225 guix-build-b9898aeeaa6a/output/x86_64-w64-mingw32/bitcoin-b9898aeeaa6a-win64-setup-unsigned.exe b7fdc84dee75951c131747c00e1e3c2da87e6f98e9435ffe7fa350ecda6771e8 guix-build-b9898aeeaa6a/output/x86_64-w64-mingw32/bitcoin-b9898aeeaa6a-win64.zip ``` ACKs for top commit: laanwj: Code review ACK b9898ae hebasto: ACK b9898ae Tree-SHA512: d7e7c3eb33f54d44a2252f36871fdb77c182da18ee02078e8b5b4f91d02ec91f9e5c829160839b010b40670202ff05d2c702b7a3873b450878f21ade4dc0ab58
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This paves the way for using and checking for architecture dependent flags like
-fcf-protectionon x86_64 Linux and-mbranch-protectionon 64 bit ARM.While we need a workaround for RISCV arch detection, I sent a change upstream (lief-project/LIEF#640), which has been merged. So we can drop this workaround along with our other RISCV workarounds (i.e lief-project/LIEF#562) with the next LIEF release.
Required for #19075, #21851, #21888 etc.
Guix build: