93439a71ed
Most of the mingw-w64 toolchain changes have now been upstreamed, we can point to a commit that exists upstream. NOTE: I'm not changing the URL yet until we see that Guix upstream will accept all my patches for macOS. ----- The Guix tree that's referred to by this commit contains the following changes relevant to our mingw-w64 build: b066c25026 Adds a PACKAGES-WITH-*PATCHES procedure which we can use in the future to apply patches to packages if those patches are not considered appropriate to upstream Guix 4719b71572 Adds mingw-w64 (the libc itself) reproducibility patches, taken from debian. 79825bee07 + 401d28e433 + c1c50cb5b0 Add mingw-w64 specific binutils patches, taken from debian. Specifically, the "Make DLL import libraries reproducible" patch made libbitcoinconsensus.dll.a build reproducibly. The followup commits were hotfixes for my mistakes. 0f864175dc Bumps mingw-w64 to v7.0.0. This is the first release that enables secure APIs by default (which we need), and gains _FORTIFY_SOURCE support. This will also be what Ubuntu Focal 20.04 LTS releases with. cdf00cf75d Bumps NSIS to v3.05. This is the first release that includes a fix for a reproducibility bug found by some of the electrum developers. See details here: https://sourceforge.net/p/nsis/bugs/1230/
118 lines
5.1 KiB
Bash
Executable file
118 lines
5.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
export LC_ALL=C
|
|
set -e -o pipefail
|
|
|
|
# Determine the maximum number of jobs to run simultaneously (overridable by
|
|
# environment)
|
|
MAX_JOBS="${MAX_JOBS:-$(nproc)}"
|
|
|
|
# Download the depends sources now as we won't have internet access in the build
|
|
# container
|
|
make -C "${PWD}/depends" -j"$MAX_JOBS" download ${V:+V=1} ${SOURCES_PATH:+SOURCES_PATH="$SOURCES_PATH"}
|
|
|
|
# Determine the reference time used for determinism (overridable by environment)
|
|
SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(git log --format=%at -1)}"
|
|
|
|
# Execute "$@" in a pinned, possibly older version of Guix, for reproducibility
|
|
# across time.
|
|
time-machine() {
|
|
guix time-machine --url=https://github.com/dongcarl/guix.git \
|
|
--commit=b066c25026f21fb57677aa34692a5034338e7ee3 \
|
|
-- "$@"
|
|
}
|
|
|
|
# Function to be called when building for host ${1} and the user interrupts the
|
|
# build
|
|
int_trap() {
|
|
cat << EOF
|
|
** INT received while building ${1}, you may want to clean up the relevant
|
|
output, deploy, and distsrc-* directories before rebuilding
|
|
|
|
Hint: To blow everything away, you may want to use:
|
|
|
|
$ git clean -xdff --exclude='/depends/SDKs/*'
|
|
|
|
Specifically, this will remove all files without an entry in the index,
|
|
excluding the SDK directory. Practically speaking, this means that all ignored
|
|
and untracked files and directories will be wiped, allowing you to start anew.
|
|
EOF
|
|
}
|
|
|
|
# Deterministically build Bitcoin Core for HOSTs (overridable by environment)
|
|
# shellcheck disable=SC2153
|
|
for host in ${HOSTS=x86_64-linux-gnu arm-linux-gnueabihf aarch64-linux-gnu riscv64-linux-gnu x86_64-w64-mingw32}; do
|
|
|
|
# Display proper warning when the user interrupts the build
|
|
trap 'int_trap ${host}' INT
|
|
|
|
(
|
|
# Required for 'contrib/guix/manifest.scm' to output the right manifest
|
|
# for the particular $HOST we're building for
|
|
export HOST="$host"
|
|
|
|
# Run the build script 'contrib/guix/libexec/build.sh' in the build
|
|
# container specified by 'contrib/guix/manifest.scm'.
|
|
#
|
|
# Explanation of `guix environment` flags:
|
|
#
|
|
# --container run command within an isolated container
|
|
#
|
|
# Running in an isolated container minimizes build-time differences
|
|
# between machines and improves reproducibility
|
|
#
|
|
# --pure unset existing environment variables
|
|
#
|
|
# Same rationale as --container
|
|
#
|
|
# --no-cwd do not share current working directory with an
|
|
# isolated container
|
|
#
|
|
# When --container is specified, the default behavior is to share
|
|
# the current working directory with the isolated container at the
|
|
# same exact path (e.g. mapping '/home/satoshi/bitcoin/' to
|
|
# '/home/satoshi/bitcoin/'). This means that the $PWD inside the
|
|
# container becomes a source of irreproducibility. --no-cwd disables
|
|
# this behaviour.
|
|
#
|
|
# --share=SPEC for containers, share writable host file system
|
|
# according to SPEC
|
|
#
|
|
# --share="$PWD"=/bitcoin
|
|
#
|
|
# maps our current working directory to /bitcoin
|
|
# inside the isolated container, which we later cd
|
|
# into.
|
|
#
|
|
# While we don't want to map our current working directory to the
|
|
# same exact path (as this introduces irreproducibility), we do want
|
|
# it to be at a _fixed_ path _somewhere_ inside the isolated
|
|
# container so that we have something to build. '/bitcoin' was
|
|
# chosen arbitrarily.
|
|
#
|
|
# ${SOURCES_PATH:+--share="$SOURCES_PATH"}
|
|
#
|
|
# make the downloaded depends sources path available
|
|
# inside the isolated container
|
|
#
|
|
# The isolated container has no network access as it's in a
|
|
# different network namespace from the main machine, so we have to
|
|
# make the downloaded depends sources available to it. The sources
|
|
# should have been downloaded prior to this invocation.
|
|
#
|
|
# shellcheck disable=SC2086
|
|
time-machine environment --manifest="${PWD}/contrib/guix/manifest.scm" \
|
|
--container \
|
|
--pure \
|
|
--no-cwd \
|
|
--share="$PWD"=/bitcoin \
|
|
${SOURCES_PATH:+--share="$SOURCES_PATH"} \
|
|
${ADDITIONAL_GUIX_ENVIRONMENT_FLAGS} \
|
|
-- env HOST="$host" \
|
|
MAX_JOBS="$MAX_JOBS" \
|
|
SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:?unable to determine value}" \
|
|
${V:+V=1} \
|
|
${SOURCES_PATH:+SOURCES_PATH="$SOURCES_PATH"} \
|
|
bash -c "cd /bitcoin && bash contrib/guix/libexec/build.sh"
|
|
)
|
|
|
|
done
|