guix: stop passing depends sources to codesigning
What the developer wrote
Authored by fanquake
guix: stop passing depends sources to codesigning
I think this is just a copy-pasta from the build container. I don't see
why we'd need the depends sources available when performing codesigning.
What changed, and why it matters
This commit removes leftover code that unnecessarily shared Bitcoin's dependency source files into the isolated Guix container used for codesigning release binaries. The change is described by the author as a cleanup of copy-pasted build-container options, not a security fix. It slightly reduces the attack surface of the codesigning environment by exposing fewer files, but there is no direct evidence of an exploitable vulnerability.
No urgent action required. Treat as a routine hardening/cleanup change. Reviewers may verify that codesigning still succeeds without SOURCES_PATH and that no other unnecessary mounts remain in the codesigning container.
Security signals we found
Reduction of filesystem exposure in an isolated release-codesigning container
Author-characterized cleanup of copy-pasted build-container configuration
No evidence of vulnerability, exploit, or security incident in the diff or commit message
Evidence from the diff
The patch deletes the ${SOURCES_PATH:+–share=”$SOURCES_PATH”} mount and the corresponding SOURCES_PATH environment variable from contrib/guix/guix-codesign. The author states this was copied from the build container script and is unnecessary for codesigning, which only needs the detached signatures repository, git metadata, and the already-built dist/archive inputs. Removing the mount marginally hardens the isolated codesigning container by reducing filesystem exposure, but the diff itself does not demonstrate a security bug, bypass, or incident.
Changed components
contrib/guix/guix-codesignGuix codesigning container invocationInspect captured patch +0 / −12
diff --git a/contrib/guix/guix-codesign b/contrib/guix/guix-codesign
index ac7aae3a..ec8fbc0c 100755
--- a/contrib/guix/guix-codesign
+++ b/contrib/guix/guix-codesign
@@ -328,16 +328,6 @@ EOF
# container so that we have something to build. '/bitcoin' was
# chosen arbitrarily.
#
- # ${SOURCES_PATH:+--share="$SOURCES_PATH"}
- #
- # make the downloaded depends sources path available
- # inside the isolated container
- #
- # The isolated container has no network access as it's in a
- # different network namespace from the main machine, so we have to
- # make the downloaded depends sources available to it. The sources
- # should have been downloaded prior to this invocation.
- #
# ${SUBSTITUTE_URLS:+--substitute-urls="$SUBSTITUTE_URLS"}
#
# fetch substitute from SUBSTITUTE_URLS if they are
@@ -359,7 +349,6 @@ EOF
--share="$DETACHED_SIGS_REPO"=/detached-sigs \
--expose="$(git rev-parse --git-common-dir)" \
--expose="$(git -C "$DETACHED_SIGS_REPO" rev-parse --git-common-dir)" \
- ${SOURCES_PATH:+--share="$SOURCES_PATH"} \
--cores="$JOBS" \
--keep-failed \
--fallback \
@@ -372,7 +361,6 @@ EOF
JOBS="$JOBS" \
SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:?unable to determine value}" \
${V:+V=1} \
- ${SOURCES_PATH:+SOURCES_PATH="$SOURCES_PATH"} \
DISTSRC="$(DISTSRC_BASE=/distsrc-base && distsrc_for_host "$HOST")" \
OUTDIR="$(OUTDIR_BASE=/outdir-base && outdir_for_host "$HOST" codesigned)" \
DIST_ARCHIVE_BASE=/outdir-base/dist-archive \
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.