guix: codesign script

Author: tobtoht

contrib/guix/guix-codesign

@@ -91,7 +91,7 @@ fi
 ################
 
 # Default to building for all supported HOSTs (overridable by environment)
-export HOSTS="${HOSTS:-x86_64-w64-mingw32 x86_64-apple-darwin arm64-apple-darwin}"
+export HOSTS="${HOSTS:-x86_64-w64-mingw32 x86_64-w64-mingw32.installer}"
 
 # Usage: distsrc_for_host HOST
 #
@@ -149,13 +149,13 @@ outdir_for_host() {
 }
 
 
-unsigned_tarball_for_host() {
+unsigned_file_for_host() {
     case "$1" in
-        *mingw*)
-            echo "$(outdir_for_host "$1")/${DISTNAME}-win64-unsigned.tar.gz"
+        *mingw.installer)
+            echo "$(outdir_for_host "$1")/FeatherWalletSetup-${DISTNAME}-unsigned.exe"
             ;;
-        *darwin*)
-            echo "$(outdir_for_host "$1")/${DISTNAME}-${1}-unsigned.tar.gz"
+        *mingw*)
+            echo "$(outdir_for_host "$1")/${DISTNAME}-unsigned.exe"
             ;;
         *)
             exit 1
@@ -164,22 +164,22 @@ unsigned_tarball_for_host() {
 }
 
 # Accumulate a list of build directories that already exist...
-hosts_unsigned_tarball_missing=""
+hosts_file_tarball_missing=""
 for host in $HOSTS; do
-    if [ ! -e "$(unsigned_tarball_for_host "$host")" ]; then
-        hosts_unsigned_tarball_missing+=" ${host}"
+    if [ ! -e "$(unsigned_file_for_host "$host")" ]; then
+        hosts_file_tarball_missing+=" ${host}"
     fi
 done
 
-if [ -n "$hosts_unsigned_tarball_missing" ]; then
+if [ -n "$hosts_file_tarball_missing" ]; then
     # ...so that we can print them out nicely in an error message
     cat << EOF
-ERR: Unsigned tarballs do not exist
+ERR: Unsigned files do not exist
 ...
 
 EOF
-for host in $hosts_unsigned_tarball_missing; do
-    echo "     ${host} '$(unsigned_tarball_for_host "$host")'"
+for host in $hosts_file_tarball_missing; do
+    echo "     ${host} '$(unsigned_file_for_host "$host")'"
 done
 exit 1
 fi
@@ -256,7 +256,6 @@ output directory.
 EOF
 }
 
-# Deterministically build Bitcoin Core
 # shellcheck disable=SC2153
 for host in $HOSTS; do
 
@@ -282,66 +281,6 @@ INFO: Codesigning ${VERSION:?not set} for platform triple ${HOST:?not set}:
           ...bind-mounted in container to: '/detached-sigs'
 EOF
 
-
-        # Run the build script 'contrib/guix/libexec/build.sh' in the build
-        # container specified by 'contrib/guix/manifest.scm'.
-        #
-        # Explanation of `guix shell` flags:
-        #
-        #   --container        run command within an isolated container
-        #
-        #     Running in an isolated container minimizes build-time differences
-        #     between machines and improves reproducibility
-        #
-        #   --pure             unset existing environment variables
-        #
-        #     Same rationale as --container
-        #
-        #   --no-cwd           do not share current working directory with an
-        #                      isolated container
-        #
-        #     When --container is specified, the default behavior is to share
-        #     the current working directory with the isolated container at the
-        #     same exact path (e.g. mapping '/home/satoshi/bitcoin/' to
-        #     '/home/satoshi/bitcoin/'). This means that the $PWD inside the
-        #     container becomes a source of irreproducibility. --no-cwd disables
-        #     this behaviour.
-        #
-        #   --share=SPEC       for containers, share writable host file system
-        #                      according to SPEC
-        #
-        #   --share="$PWD"=/bitcoin
-        #
-        #                     maps our current working directory to /bitcoin
-        #                     inside the isolated container, which we later cd
-        #                     into.
-        #
-        #     While we don't want to map our current working directory to the
-        #     same exact path (as this introduces irreproducibility), we do want
-        #     it to be at a _fixed_ path _somewhere_ inside the isolated
-        #     container so that we have something to build. '/bitcoin' was
-        #     chosen arbitrarily.
-        #
-        #   ${SOURCES_PATH:+--share="$SOURCES_PATH"}
-        #
-        #                     make the downloaded depends sources path available
-        #                     inside the isolated container
-        #
-        #     The isolated container has no network access as it's in a
-        #     different network namespace from the main machine, so we have to
-        #     make the downloaded depends sources available to it. The sources
-        #     should have been downloaded prior to this invocation.
-        #
-        #  ${SUBSTITUTE_URLS:+--substitute-urls="$SUBSTITUTE_URLS"}
-        #
-        #                     fetch substitute from SUBSTITUTE_URLS if they are
-        #                     authorized
-        #
-        #    Depending on the user's security model, it may be desirable to use
-        #    substitutes (pre-built packages) from servers that the user trusts.
-        #    Please read the README.md in the same directory as this file for
-        #    more information.
-        #
         # shellcheck disable=SC2086,SC2031
         time-machine shell --manifest="${PWD}/contrib/guix/manifest.scm" \
                                  --container \
@@ -358,11 +297,13 @@ EOF
                                  --keep-failed \
                                  --fallback \
                                  --link-profile \
+                                 --user="user" \
                                  --root="$(profiledir_for_host "${HOST}" codesigned)" \
                                  ${SUBSTITUTE_URLS:+--substitute-urls="$SUBSTITUTE_URLS"} \
                                  ${ADDITIONAL_GUIX_COMMON_FLAGS} ${ADDITIONAL_GUIX_ENVIRONMENT_FLAGS} \
                                  -- env HOST="$host" \
                                         DISTNAME="$DISTNAME" \
+                                        VERSION="$VERSION" \
                                         JOBS="$JOBS" \
                                         SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:?unable to determine value}" \
                                         ${V:+V=1} \
@@ -371,7 +312,7 @@ EOF
                                         OUTDIR="$(OUTDIR_BASE=/outdir-base && outdir_for_host "$HOST" codesigned)" \
                                         DIST_ARCHIVE_BASE=/outdir-base/dist-archive \
                                         GUIX_SIGS_REPO=/detached-sigs \
-                                        UNSIGNED_TARBALL="$(OUTDIR_BASE=/outdir-base && unsigned_tarball_for_host "$HOST")" \
+                                        UNSIGNED_TARBALL="$(OUTDIR_BASE=/outdir-base && unsigned_file_for_host "$HOST")" \
                                       bash -c "cd /bitcoin && bash contrib/guix/libexec/codesign.sh"
     )
 

contrib/guix/libexec/codesign.sh

@@ -31,6 +31,7 @@ Required environment variables as seen inside the container:
     DETACHED_SIGS_REPO: ${DETACHED_SIGS_REPO:?not set}
     DIST_ARCHIVE_BASE: ${DIST_ARCHIVE_BASE:?not set}
     DISTNAME: ${DISTNAME:?not set}
+    VERSION: ${VERSION:?not set}
     HOST: ${HOST:?not set}
     SOURCE_DATE_EPOCH: ${SOURCE_DATE_EPOCH:?not set}
     DISTSRC: ${DISTSRC:?not set}
@@ -55,11 +56,6 @@ mkdir -p "$DISTSRC"
 (
     cd "$DISTSRC"
 
-    tar -xf "$UNSIGNED_TARBALL"
-
-    mkdir -p codesignatures
-    tar -C codesignatures -xf "$CODESIGNATURE_GIT_ARCHIVE"
-
     case "$HOST" in
         *mingw*)
             find "$PWD" -name "*-unsigned.exe" | while read -r infile; do
@@ -70,7 +66,7 @@ mkdir -p "$DISTSRC"
                                  -in "$infile" \
                                  -out "${OUTDIR}/${infile_base/-unsigned}" \
                                  -CAfile "$GUIX_ENVIRONMENT/etc/ssl/certs/ca-certificates.crt" \
-                                 -sigin codesignatures/win/"$infile_base".pem
+                                 -sigin /detached-sigs/codesignatures/"${VERSION}"/"$infile_base".pem
             done
             ;;
         *)