bitcoin-core / guix.sigs

Bitcoin Core release attestations (Guix)

This repository contains Guix attestations for releases of Bitcoin Core.

Overall process

The Guix build consists of two stages:

• In the first stage (noncodesigned), people compile the binaries from source.
• Then, code signatures for Windows and MacOS are generated from the binaries that were produced in the first stage, and distributed to the builders.
• In the second stage (all), the builders attach these code signatures.

See https://github.com/bitcoin/bitcoin/blob/master/doc/release-process.md#building on how to build the release with Guix and create an attestation.

Directory structure

• /<version>/<signer>/: Build attestations for repository tag v<version> for <signer>.
  • noncodesigned.SHA256SUMS: Hashes of binaries produced by the first stage build for this version.
  • noncodesigned.SHA256SUMS.asc: Detached PGP signature for noncodesigned.SHA256SUMS.
  • all.SHA256SUMS: Hashes of binaries produced by the second stage build. This covers all the binaries uploaded to the website, and is what to check release binaries against.
  • all.SHA256SUMS.asc: Detached PGP signature for all.SHA256SUMS.
• /builder-keys/<signer>.gpg: PGP keys of the signers. If you're going to do builds and contribute attestations, file a PR to add your key here.
• /contrib: Scripts used in the CI tests.

guix.sigs's Issues

Fix CI sanity script

See #27 (comment)

ci: Rework CI log output (\n)

Looks like the \n remains escaped in the CI log. Maybe a good first issue if someone wants to fix this in a follow-up?

Originally posted by @MarcoFalke in #544 (comment)

Directory for people's public keys

We should have a directory where it's just people's public keys to avoid over-reliance on keyservers and this situation: bitcoin-core/bitcoincore.org#793 (comment)

We can check via CI that everyone who uploads has a key and that signatures are valid.

.

.

.

Notification for mismatching builds

In #1201 it turns out that @0xB10C had been building mismatching builds for a while, without it being noticed before.

It would be useful to have some kind of notification when this happens. A mismatching build always points to a problem, either (in the good case) a local configuration issue, but it can also be a bug in the build system or worst-case even a backdoor attempt. So it needs to be investigated.

See discussion here: #1201 (comment)

Sanity check ci task?

Should there be a sanity check similar to https://github.com/bitcoin-core/gitian.sigs/blob/dfaecb5fa5062a3b2443e1f93933139b864745d8/.travis.yml ?

Combined keys

Currently I import the keys by running:

 KEY_URL=https://raw.githubusercontent.com/bitcoin-core/guix.sigs/main/builder-keys

 curl -sSL ${KEY_URL}/CoinForensics.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/Emzy.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/Sjors.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/TheCharlatan.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/achow101.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/benthecarman.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/cfields.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/darosior.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/dunxen.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/fanquake.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/glozow.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/guggero.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/hebasto.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/jackielove4u.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/josibake.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/laanwj.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/satsie.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/sipa.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/svanstaa.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/theStack.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/vertiond.gpg | gpg --import - \
 && curl -sSL ${KEY_URL}/willyko.gpg | gpg --import -

But as soon as new signers will be added or removed in the future, the script will break.

So why is there not a single file that bundles all the current keys so that I dont have to download them all individually?

Or otherwise at least a file that contains all the names of the signers, so that I can parse that instead of hardcoding the names in my code?