#25573 guix: produce a `-static-pie` bitcoind

• Make Linux release binaries run on any distribution without host glibc version dependencies
• Enable bitcoind to run directly on Alpine Linux, NixOS, and minimal container environments

Updates the Guix build configuration to build Linux release binaries for x86_64 and aarch64 (excluding bitcoin-qt) as static position-independent executables (-static-pie) using GCC 14 and glibc 2.44. It adapts symbol-check and security-check scripts for static ELF binaries, patches glibc to avoid dynamic NSS module loading and store path leakage, and adds release notes documenting the change and its name resolution behavior.

Problem: Currently, Bitcoin Core release binaries dynamically link against glibc, requiring an older glibc baseline in Guix and causing friction or failure on non-glibc distributions (like Alpine/musl), NixOS, scratch containers, and very old systems.

P2 · new feature

• P2 because it removes runtime glibc version constraints for official Linux releases
• Directly benefits node operators on non-glibc distributions and minimal container hosts
• Unblocks long-sought static release packaging for Linux

Produces fully portable static position-independent binaries for Linux release artifacts, eliminating runtime glibc version mismatches and enabling execution on Alpine, NixOS, scratch containers, and older enterprise systems while preserving ASLR. It also resolves a long-standing issue (#19075).

Membership: Modifies Guix build manifests, scripts, toolchain definitions, and symbol/security check linters.

Factors: security/stability 1, bug 0, performance 0, user value 2, leverage 2

• Review #36272 first

The code and Guix builds are fully functional and reproducible, but the PR is based on prerequisite toolchain PRs #36272 and #36193.

Author status: active, frequently rebasing and coordinating prerequisite build refactors

Resolved concerns:

• Dynamic NSS name resolution failure (e.g. mDNS/LDAP): verified to fail closed gracefully to DNS/fixed seeds and documented in release notes.
• Symbol and security checks: adapted to handle static ELF binaries where fortify checks and dynamic library dependencies differ.
• Glibc store path leaks causing nondeterminism: eliminated with custom glibc patches.

• Broad support for static PIE binaries as preferable to alternative libc approaches (theuni)
• Approach approved and verified across multiple Linux distributions (willcl-ark, hebasto, jsarenik)
• Verified reproducible Guix build hashes match (sedited, xrviv, willcl-ark)
• Concept approval without reservation (dergoegge, w0xlt)

Broad support across maintainers and contributors with extensive cross-distribution and Guix reproducibility testing.

Multiple maintainers and regular contributors gave Concept and Approach ACKs. Concerns regarding external NSS resolution behavior were investigated, tested across multiple distros, and documented in release notes.

• theuni: 'This is amazing! ... This is a MUCH more palatable change.'
• willcl-ark: 'Approach ACK ... I think this is a worthwhile goal for a number of reasons.'
• hebasto: 'Approach ACK 06b842f50872e38a6ac4956c9305edf543bca695.'

Objections: none enumerated.

Support:

• theuni: Much more palatable and auditable than switching to musl libc
• willcl-ark: Significantly improves portability across scratch containers, NixOS, and diverse Linux distributions without host glibc coupling
• hebasto: Tested binary execution and verified Guix toolchain construction
• jsarenik: Enables clean deployment on Alpine without glibc compatibility shims

Participants: theuni (support), luke-jr (question), Frank-GER (neutral), dergoegge (support), m3dwards (support), willcl-ark (support), sipa (support), w0xlt (support), nkatha23 (support), hebasto (support), tobtoht (neutral), 151henry151 (support), sedited (support), jsarenik (support), xrviv (support), 0xB10C (support), ottosch (support), theStack (support), janb84 (support), ketominer (support)

State derived from the lists: substantive support, no open objection (theuni, willcl-ark, hebasto, jsarenik)

Review verdicts (DrahtBot): 0

• Approach ACK: willcl-ark, hebasto, jsarenik
• Concept ACK: dergoegge, w0xlt

Depends on: #36272, #36193

Enables:

• #19075 Investigate aarch64 pointer authentication

836 lines under test/bench/ci.

• contrib/guix/toolchains.scm +357/-0
• contrib/guix/manifest_build.scm +2/-273
• contrib/guix/patches/glibc-guix-store-paths.patch +94/-0
• contrib/guix/symbol-check.py +32/-5
• contrib/guix/patches/glibc-nss-nodlopen.patch +32/-0
• depends/patches/boost/drop_wcrtomb_wchar_t.patch +17/-0
• doc/release-notes-25573.md +13/-0
• contrib/guix/linux_static.scm +12/-0
• contrib/guix/guix-build +9/-1
• contrib/guix/libexec/build_linux.sh +8/-1
• contrib/guix/manifest_gui.scm +5/-1
• depends/packages/boost.mk +5/-0
• contrib/guix/security-check.py +4/-0

This PR configures Guix to build Linux bitcoind and CLI executables as -static-pie binaries using GCC 14 and glibc 2.44, while leaving the GUI dynamic. This eliminates host glibc version dependencies, allowing release binaries to run out of the box on musl/Alpine, NixOS, scratch containers, and older distributions while maintaining ASLR security. The PR has strong support and has been thoroughly tested for reproducibility and cross-platform compatibility across many distributions. It depends on base PRs #36272 and #36193.