#25573 guix: produce a `-static-pie` bitcoind

ReviewabilityReviewsAgreementSize
#25573 fanquake guix: produce a `-static-pie` bitcoindReady0Mild13 + 243 tests
  • Make Linux release binaries portable across non-glibc distributions and systems with older glibcs
  • Allow bitcoind and CLI tools to run on platforms like Alpine and NixOS without compatibility shims
  • Review is worthwhile now with no known blockers or invalidating changes
  • Broad testing confirmation across Alpine, NixOS, and older Linux distributions (0xB10C, dergoegge, jsarenik)
  • Support because static glibc is more palatable and auditable than switching to musl (theuni)
  • Unaddressed objection: dynamic NSS resolvers break when loading host libraries, no author reply (luke-jr)
  • Open question on whether static binaries should drop fortify checks (willcl-ark)
  • 13 lines added or modified outside tests
  • 243 lines added or modified in tests
  • 7 lines removed in total
  • 8 files, 6 commits
Build and CI#3 of 56
P2 · platform fix
  • P2 because it enables release binaries to run natively on distributions like Alpine and NixOS
  • Older Linux installations and container environments no longer require glibc workarounds
Ranking notes
Reviewability: ReadyStalePaused
Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets
Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs.
Size: lines added or modified outside tests, then in tests; greener = smaller.

Goal

Configure Guix release builds for Linux x86_64 and aarch64 to produce non-GUI binaries (bitcoind and CLI tools) as static position-independent executables (-static-pie) using glibc 2.44. Apply patches to glibc to eliminate non-deterministic store paths and avoid dlopen in NSS modules, while mapping store paths with compiler prefix flags. Update symbol and security checks to validate static ELFs without dynamic interpreters.

Problem: Linux release binaries dynamically link against glibc, preventing them from running on non-glibc distributions such as Alpine or on systems with glibc versions older than the build toolchain's. Dynamic linking also complicates security hardening features such as pointer authentication on aarch64 (#19075).

Evidence of importance:

  • PR description: 'Using glibc for static builds, would be less of a leap compared to switching to musl libc (POC in #23203).'
  • Release notes: 'Release binaries for x86_64 and aarch64 Linux (except for bitcoin-qt) are now compiled with -static-pie, making them more portable. They can now be run on non-glibc based systems, as well as on systems than ship with older glibcs, than were previously supported.'

Scope: Modifies Guix package definitions for glibc, adds glibc patches for deterministic store paths and NSS static linking, and modifies post-build ELF validation scripts.

Risk of a mistake: medium (build). Alters the toolchain and binary linkage of Linux release executables, which could cause subtle runtime breakage or regressions in host name resolution.

Changed since the previous assessment: Added a Guix helper generating `-ffile-prefix-map` flags to remap `/gnu/store` directories to `/usr` in CFLAGS and CPPFLAGS when compiling glibc.

Reviewability

Ready

Nothing known that would invalidate a review now.

Waiting on (from the thread read):

  • author: address willcl-ark's review questions and suggestions regarding fortify checks and build flags 2026-10-01

Agreement

Mild

objection that needs an answer has none yet (luke-jr)

Thread notes: Added Concept ACK from l0rinc.

Objections, suggestions, and questions:

ReviewerTypeHarm, request, or questionStatusMust beAuthor repliedQuote
luke-jr (contributor)objection, correctnessStatically linked glibc binaries break when dynamic NSS resolvers attempt to load mismatched host glibc shared libraries.open · willcl-ark explained static glibc bakes in files and dns backends, preventing resolver breakage; no author replyansweredno2022-07-16: 'How does this handle resolvers? eg, static glibc 2.33 applications break on systems with glibc 2.34...'
Frank-GER (none)objection, correctnessEarly static binary builds crash on startup on older host systems like Ubuntu 20.04 due to glibc early init assertion failures.fixed · fix pushed · glibc 2.36 update resolved the startup assertion crashchangedyes2022-08-04: 'bitcoind: dl-call-libc-early-init.c:37: _dl_call_libc_early_init: Assertion `sym != NULL' failed. Aborted (core dumped)'
Status from: 2022-08-24: fanquake: 'Pushed a number of changes, and rebased on master. Switched from glibc 2.35 to 2.36.'
m3dwards (member)question, approachWhether the trade-offs of static glibc regarding resolvers and binary size increase are correctly understood.answered · author confirmed binary size increase and willcl-ark addressed resolversansweredyes2025-11-07: 'Have I got the potential trade-offs correct here?'
Status from: 2025-11-11: fanquake: 'Yes ~2mb. I've added a comparison of bitcoind size for master vs this change, to the PR description.'
hebasto (member)question, maintenanceWhat should be done regarding linker warnings about getaddrinfo, getgrgid, and getpwuid requiring runtime shared libraries.answered · author investigated glibc code and began upstreaming changesansweredyes2026-05-22: 'What should we do about the following warnings:'
Status from: 2026-06-11: fanquake: 'I've been looking at the related code in glibc, and I think these warnings might actually no-longer be correct. Will try'
hebasto (member)suggestion, approachSet CMAKE_CXX_LINK_OPTIONS_PIE instead of dropping -Werror=dev.answered · author declined hardcoding -static-pie or patching cmake tarballansweredyes2026-05-24: 'Instead of dropping `-Werror=dev`, we can use the approach suggested here:'
Status from: 2026-05-26: fanquake: 'I'm not sure; we don't want to hardcode `-static-pie` anywhere, nor do we want to extract, and then patch the tarball.'
willcl-ark (member)suggestion, scopeAdd a release note explaining the removal of dynamic NSS modules on Linux static binaries.fixed · fix pushed · release note updated with NSS explanationchangedyes2026-07-22: 'I think the removal of external NSS modules on the x64 linux binary might warrant a release note'
Status from: 2026-08-12: fanquake: 'Thanks, taken your release note additions in the next push.'
willcl-ark (member)objection, correctnessELF FORTIFY security check returns True even when fortification is disabled because static binaries pull in libc.a symbol definitions.fixed · fix pushed · author updated check to return True for static binarieschangedyes2026-07-22: 'I don't think switching from `binary.imported_symbols` to `binary.symbols` provides a valid FORTIFY check for static binaries any more.'
Status from: 2026-07-29: fanquake: 'For now I've opted to just return True for any static bin'
hebasto (member)question, scopeWhat is the minimum supported Linux kernel version for the resulting fully-static bitcoind.answered · author confirmed kernel floors remain 3.2.0 and 3.7.0, and opened #35993answeredyes2026-08-07: 'What's the minimum supported Linux kernel version for the resulting fully-static bitcoind?'
Status from: 2026-08-10: fanquake: 'This shouldn't be changed here, and remain as `3.2.0` for x86_64 and `3.7.0` for aarc64.'
sedited (member)objection, correctnessStatic binary attempts to open Guix store locale paths inherited from the build environment, leaking store paths and risking nondeterminism.fixed · fix pushed · glibc configure flag filtered out in commit updatechangedyes2026-08-11: 'trying to open some locales from the guix build environment and apparently so from the inherited glibc version'
Status from: 2026-08-12: fanquake: 'This is due to Guix appending `(string-append "libc_cv_complocaledir=/run/current-system/locale/",(version-major+minor v'
xrviv (none)suggestion, interfaceAdd a log message when Lookup() returns empty for a manual target so NSS resolution failures are visible.openansweredno2026-08-17: 'The part I think is worth acting on: the failure has no diagnostic.'
hebasto (member)question, maintenanceWhether four unused modules in linux_static.scm are really needed.fixed · fix pushed · unneeded modules dropped from linux_static.scmansweredyes2026-08-18: 'Are these four modules really needed? Build succeeds without them for me.'
Status from: 2026-09-08: fanquake: 'Dropped.'
willcl-ark (member)question, safetyWhether fortify checks must be dropped for static binaries given it leaves Bitcoin Core translation units unchecked.openansweredno2026-10-01: 'Do we have to drop the fortify checks here? Just because we have fortified glibc, this doesn't enforce fortified bitcoin core translation units.'
willcl-ark (member)suggestion, maintenanceCompute a single CMAKE_EXE_LINKER_FLAGS variable before cmake -S rather than passing a second flag.answered · author confirmed the duplicate flag was a rebasing error that will be fixedansweredyes2026-10-01: 'Might it be cleaner to always compute a single variable before `cmake -S` and just pass it in once?'
Status from: 2026-10-01: fanquake: 'I think this might have been a rebasing error. We will only have one `CMAKE_EXE_LINKER_FLAGS`.'
willcl-ark (member)suggestion, approachHardcode the list of expected static binaries instead of dynamically detecting static binaries and skipping checks.openansweredno2026-10-01: 'instead of "seeing which binaires appear to be static and skipping checks", we might as well hard-code the list of those we expect to be static...'

Support:

  • theuni (member) (2022-07-13) [read]: Static musl builds would be very cool but tricky to audit for parity and thus pretty unlikely to ever become official/supported imo. This is a MUCH more palatable change.
  • dergoegge (member) (Concept ACK, 2025-10-22): (no reason given) [not substantive]
  • w0xlt (contributor) (Concept ACK, 2026-04-08): (no reason given) [not substantive]
  • nkatha23 (none) (2026-04-17) [tested]: Tested the x86_64 binary on Fedora 43, verifying outbound peer connections and DNS seeding
  • willcl-ark (member) (Approach ACK, 2026-05-22) [read]: I think this is a worthwhile goal for a number of reasons. Splitting manifests and build scripts seems vastly preferable and aligns with project direction.
  • hebasto (member) (Concept ACK, 2026-05-22): (no reason given) [not substantive]
  • 151henry151 (contributor) (2026-08-02) [both]: Guix-built tip to check reproducibility, static-pie shape, and NSS fail-closed behavior under nodlopen patch
  • dergoegge (member) (2026-08-11) [tested]: synced signet and ran test_bitcoin on NixOS 26.05 x86 machine without problem
  • jsarenik (none) (Approach ACK, 2026-08-14) [tested]: Successfully running signet faucet on Alpine without needing custom LD_PRELOAD glibc shims
  • hebasto (member) (Approach ACK, 2026-08-17) [tested]: Tested binary execution on Fedora 21 with Linux kernel 3.17.4
  • 0xB10C (member) (2026-08-18) [tested]: Allows binaries to run on NixOS without compatibility loaders like nix-ld
  • ottosch (none) (2026-08-18) [tested]: Ran test_bitcoin test suite successfully on Arch Linux
  • theStack (member) (2026-08-18) [tested]: Tested aarch64 bitcoind binary on Ubuntu 25.04 notebook, passing unit tests and signet sync
  • janb84 (member) (2026-08-18) [tested]: Tested static binary on Apple container machines running Alpine
  • ketominer (none) (2026-08-27) [tested]: Needed for nodl as older devices are based on Ubuntu 18 and won't be upgraded; stable on Ubuntu 18.04 aarch64
  • l0rinc (member) (Concept ACK, 2026-10-16): we should do this in the next release - will review and try it out later [not substantive]

Participants:

  • theuni (member, support, 1 statements 2022-07-13 to 2022-07-13): supported glibc static-pie approach over musl as more auditable and palatable
  • luke-jr (contributor, objection, 1 statements 2022-07-16 to 2022-07-16): raised concern about static glibc resolver compatibility across glibc versions
  • Frank-GER (none, objection, 4 statements 2022-08-04 to 2022-08-08): reported startup assertion crash on early static binary builds under Ubuntu 20.04
  • dergoegge (member, support, 2 statements 2025-10-22 to 2026-08-11): Concept ACK and tested on NixOS
  • m3dwards (member, question, 1 statements 2025-11-07 to 2025-11-07): asked about trade-offs regarding resolvers and binary size
  • willcl-ark (member, support, 16 statements 2025-11-17 to 2026-10-01): Approach ACK, tested across platforms, reviewed security-check.py and build scripts
  • sipa (member, support, 1 statements 2026-04-08 to 2026-04-08): expressed support for static-pie
  • w0xlt (contributor, support, 1 statements 2026-04-08 to 2026-04-08): Concept ACK
  • nkatha23 (none, support, 1 statements 2026-04-17 to 2026-04-17): tested binary on Fedora 43, verifying outbound peer connections and DNS seeding
  • hebasto (member, support, 12 statements 2026-05-22 to 2026-08-18): Concept ACK and Approach ACK, tested binaries in scratch container and Fedora 21
  • tobtoht (contributor, neutral, 1 statements 2026-06-16 to 2026-06-16): clarified that non-glibc dependencies were already statically linked
  • 151henry151 (contributor, support, 1 statements 2026-08-02 to 2026-08-02): verified Guix build reproducibility, static-pie properties, and NSS fail-closed behavior
  • sedited (member, objection, 4 statements 2026-08-08 to 2026-08-11): identified locale build path leaks from Guix environment into binary; tested on arm
  • jsarenik (none, support, 1 statements 2026-08-14 to 2026-08-14): Approach ACK, runs static binary on Alpine without glibc compatibility shims
  • xrviv (none, neutral, 2 statements 2026-08-17 to 2026-08-18): reproduced external NSS resolution behavior and corroborated Guix build hashes
  • 0xB10C (member, support, 1 statements 2026-08-18 to 2026-08-18): tested x86 and aarch64 binaries on NixOS without nix-ld compatibility wrapper
  • janb84 (member, support, 1 statements 2026-08-18 to 2026-08-18): tested static binary on Apple container machines using Alpine
  • ottosch (none, support, 1 statements 2026-08-18 to 2026-08-18): tested on Arch Linux, successfully running bitcoind and test suite
  • theStack (member, support, 1 statements 2026-08-18 to 2026-08-18): tested aarch64 binary on Ubuntu 25.04 notebook, passing unit tests and signet sync
  • ketominer (none, support, 2 statements 2026-08-27 to 2026-08-30): tested static binary on Ubuntu 18.04 aarch64 for nodl devices
  • l0rinc (member, support, 1 statements 2026-10-16 to 2026-10-16): Concept ACK for next release

Files

250 lines under test/bench/ci.

  • contrib/guix/patches/glibc-guix-store-paths.patch +94/-0
  • contrib/guix/toolchains.scm +68/-0
  • contrib/guix/symbol-check.py +32/-5
  • contrib/guix/patches/glibc-nss-nodlopen.patch +32/-0
  • doc/release-notes-25573.md +13/-0
  • contrib/guix/libexec/build_linux.sh +8/-1
  • contrib/guix/linux_static.scm +5/-1
  • contrib/guix/security-check.py +4/-0

Card

The short text the ranking pass compares across PRs.

Configures Guix to build official Linux x86_64 and aarch64 release binaries (excluding bitcoin-qt) as static position-independent executables (-static-pie) using glibc 2.44. This allows bitcoind and command-line utilities to run on musl-based distributions like Alpine Linux and on older Linux installations without dynamic linker dependencies, and enables aarch64 pointer authentication (#19075). A known trade-off is that dynamic NSS modules (such as mDNS, LDAP, or SSSD) will no longer function for name resolution in bitcoind. Post-build symbol and security checks are adjusted to inspect static ELF executables.

Data

dossier JSON · extract JSON · model ledger, generated 2026-10-23T01:15, confidence high, input hash fd2e9330891b5ecb
thread read through 2026-10-16 (96 statements), head 3dd28a74fa
labels: Build system

Categories

Build and CI

P2 · platform fix

Produces static-pie binaries that expand release portability to non-glibc distributions like Alpine, NixOS, and systems with older glibcs. Release notes and feedback confirm this solves real execution blockers on musl, older distros, and containers, while preserving release reproducibility and security checks.

Membership: Changes Guix release build scripts, toolchain definitions, and ELF checks under contrib/guix/ to produce -static-pie Linux binaries, carrying the Build system label.

Factors: security/stability 1, bug 0, performance 0, user value 2, leverage 1