From fbc2a50388d9076d9311da16e07cbbc31ff585d1 Mon Sep 17 00:00:00 2001
From: fanquake <fanquake@gmail.com>
Date: Thu, 29 Jul 2021 11:11:55 +0800
Subject: [PATCH 1/9] Merge bitcoin/bitcoin#22531: guix: Fixes to
 guix-{attest,verify}

9b313dfef18792fcc36e78ef3caa693fafcce04e guix: Ensure EPOCH_SOURCE_DATE does not include GPG information (Andrew Chow)
43225f0a2a517ccd79dc49279b979ffd2eca6b85 guix: Remove extra \r from all.SHA256SUMS line ending (Andrew Chow)
d080c27066449f76bc8709fc50e422757971d2cf guix, doc: Add a note that codesigners need to rebuild after tagging (Andrew Chow)
4a466388a0092fbdf5f8969c6bfb65bf8cc962e1 guix: Allow changing the base manifest in guix-verify (Andrew Chow)
33455c76964b9e27b33e970d9722cc47657b291b guix: Make all.SHA256SUMS rather than codesigned.SHA256SUMS (Andrew Chow)

Pull request description:

  `guix-verify` expects `all.SHA256SUMS` but `guix-attest` produces `codesigned.SHA256SUMS`. Since `all.SHA256SUMS` makes more sense (as the file contains all the sha256sums, not just the codesigned ones), `guix-attest` has been changed to output a file of that name.

  As a quality of life improvement, `guix-verify` can take `SIGNER` and use the signer's manifest as the base to compare against. This makes it easier to compare a single person's attestations with everyone else's and can make it more obvious when one builder is clearly mismatching with everyone else.

  Lastly `release-process.md` is updated with a note about a gotcha that can cause a mismatch in the codesigned attestation.

ACKs for top commit:
  fanquake:
    ACK 9b313dfef18792fcc36e78ef3caa693fafcce04e

Tree-SHA512: 0d60627def38288dbd3059ad1e72cad224f9205da11b1a561c082ef28250a074df5cc5f2797c91a7be027bc486a3fda3319c2e496a8724e5b539337236c6f990
---
 contrib/guix/guix-attest   | 13 ++++++-------
 contrib/guix/guix-build    |  2 +-
 contrib/guix/guix-codesign |  2 +-
 contrib/guix/guix-verify   | 28 +++++++++++++++++++++++++++-
 doc/release-process.md     |  3 +++
 5 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/contrib/guix/guix-attest b/contrib/guix/guix-attest
index 84fb2840eaf9c..7c71ff3508260 100755
--- a/contrib/guix/guix-attest
+++ b/contrib/guix/guix-attest
@@ -213,8 +213,8 @@ mkdir -p "$outsigdir"
         exit 1
     fi
 
-    temp_codesigned="$(mktemp)"
-    trap 'rm -rf -- "$temp_codesigned"' EXIT
+    temp_all="$(mktemp)"
+    trap 'rm -rf -- "$temp_all"' EXIT
 
     if (( ${#codesigned_fragments[@]} )); then
         # Note: all.SHA256SUMS attests to all of $sha256sum_fragments, but is
@@ -222,20 +222,19 @@ mkdir -p "$outsigdir"
         cat "${sha256sum_fragments[@]}" \
             | sort -u \
             | sort -k2 \
-            | sed 's/$/\r/' \
             | basenameify_SHA256SUMS \
-                > "$temp_codesigned"
-        if [ -e codesigned.SHA256SUMS ]; then
+                > "$temp_all"
+        if [ -e all.SHA256SUMS ]; then
             # The SHA256SUMS already exists, make sure it's exactly what we
             # expect, error out if not
-            if diff -u all.SHA256SUMS "$temp_codesigned"; then
+            if diff -u all.SHA256SUMS "$temp_all"; then
                 echo "An all.SHA256SUMS file already exists for '${VERSION}' and is up-to-date."
             else
                 shasum_already_exists all.SHA256SUMS
                 exit 1
             fi
         else
-            mv "$temp_codesigned" codesigned.SHA256SUMS
+            mv "$temp_all" all.SHA256SUMS
         fi
     else
         # It is fine to have the codesigned outputs be missing (perhaps the
diff --git a/contrib/guix/guix-build b/contrib/guix/guix-build
index 176eab32f93df..0d7ecfa271c56 100755
--- a/contrib/guix/guix-build
+++ b/contrib/guix/guix-build
@@ -233,7 +233,7 @@ host_to_commonname() {
 }
 
 # Determine the reference time used for determinism (overridable by environment)
-SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(git log --format=%at -1)}"
+SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(git -c log.showSignature=false log --format=%at -1)}"
 
 # Precious directories are those which should not be cleaned between successive
 # guix builds
diff --git a/contrib/guix/guix-codesign b/contrib/guix/guix-codesign
index 45da43abf1c12..445ee91172d94 100755
--- a/contrib/guix/guix-codesign
+++ b/contrib/guix/guix-codesign
@@ -220,7 +220,7 @@ fi
 JOBS="${JOBS:-$(nproc)}"
 
 # Determine the reference time used for determinism (overridable by environment)
-SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(git log --format=%at -1)}"
+SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(git -c log.showSignature=false log --format=%at -1)}"
 
 # Make sure an output directory exists for our builds
 OUTDIR_BASE="${OUTDIR_BASE:-${VERSION_BASE}/output}"
diff --git a/contrib/guix/guix-verify b/contrib/guix/guix-verify
index ffcfba736092c..feb0e55ea04b6 100755
--- a/contrib/guix/guix-verify
+++ b/contrib/guix/guix-verify
@@ -28,7 +28,11 @@ cmd_usage() {
 cat <<EOF
 Synopsis:
 
-    env GUIX_SIGS_REPO=<path/to/guix.sigs> ./contrib/guix/guix-verify
+    env GUIX_SIGS_REPO=<path/to/guix.sigs> [ SIGNER=<signer> ] ./contrib/guix/guix-verify
+
+Example overriding signer's manifest to use as base
+
+    env GUIX_SIGS_REPO=/home/dongcarl/guix.sigs SIGNER=achow101 ./contrib/guix/guix-verify
 
 EOF
 }
@@ -94,6 +98,17 @@ echo "--------------------"
 echo ""
 if (( ${#all_noncodesigned[@]} )); then
     compare_noncodesigned="${all_noncodesigned[0]}"
+    if [[ -n "$SIGNER" ]]; then
+        signer_noncodesigned="$OUTSIGDIR_BASE/$SIGNER/noncodesigned.SHA256SUMS"
+        if [[ -f "$signer_noncodesigned" ]]; then
+            echo "Using $SIGNER's manifest as the base to compare against"
+            compare_noncodesigned="$signer_noncodesigned"
+        else
+            echo "Unable to find $SIGNER's manifest, using the first one found"
+        fi
+    else
+        echo "No SIGNER provided, using the first manifest found"
+    fi
 
     for current_manifest in "${all_noncodesigned[@]}"; do
         verify "$compare_noncodesigned" "$current_manifest"
@@ -114,6 +129,17 @@ echo "--------------------"
 echo ""
 if (( ${#all_all[@]} )); then
     compare_all="${all_all[0]}"
+    if [[ -n "$SIGNER" ]]; then
+        signer_all="$OUTSIGDIR_BASE/$SIGNER/all.SHA256SUMS"
+        if [[ -f "$signer_all" ]]; then
+            echo "Using $SIGNER's manifest as the base to compare against"
+            compare_all="$signer_all"
+        else
+            echo "Unable to find $SIGNER's manifest, using the first one found"
+        fi
+    else
+        echo "No SIGNER provided, using the first manifest found"
+    fi
 
     for current_manifest in "${all_all[@]}"; do
         verify "$compare_all" "$current_manifest"
diff --git a/doc/release-process.md b/doc/release-process.md
index c7a804e6793d8..eaec5c59409bd 100644
--- a/doc/release-process.md
+++ b/doc/release-process.md
@@ -145,6 +145,9 @@ Codesigner only: Sign the windows binaries:
 * Enter the passphrase for the key when prompted
 * `signature-win.tar.gz` will be created
 
+Code-signer only: It is advised to test that the code signature attaches properly prior to tagging by performing the `guix-codesign` step.
+However if this is done, once the release has been tagged in the bitcoin-detached-sigs repo, the `guix-codesign` step must be performed again in order for the guix attestation to be valid when compared against the attestations of non-codesigner builds.
+
 Codesigner only: Commit the detached codesign payloads:
 
 ```sh

From 5c0283b0208e1d448d087e85bcb6f553053e994b Mon Sep 17 00:00:00 2001
From: fanquake <fanquake@gmail.com>
Date: Fri, 11 Mar 2022 10:26:20 +0000
Subject: [PATCH 2/9] Merge bitcoin/bitcoin#24509: doc: Add `guix` prefix for
 changes to reproducible builds

f1f994a122b135160216b6fc56c095b83eeaf812 doc: Add `guix` prefix for changes to reproducible builds (Hennadii Stepanov)

Pull request description:

  Most of contributors already use the `guix:` prefix for changes to `contrib/guix`. Also `guix` is shorter than `build`, and it is more focused/specific.

ACKs for top commit:
  fanquake:
    ACK f1f994a122b135160216b6fc56c095b83eeaf812

Tree-SHA512: 3f754e80802ec4e871b099ce1f0877e34ecc4816fbe9c49bfd2a7368ef79fed9edf6c65f38eedef2a87367fdc911dc548e0def422d80b66a91ce2e5f35826032
---
 .github/workflows/semantic-pull-request.yml | 1 +
 CONTRIBUTING.md                             | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/semantic-pull-request.yml b/.github/workflows/semantic-pull-request.yml
index cb351ee2f9172..2ec7381172f6d 100644
--- a/.github/workflows/semantic-pull-request.yml
+++ b/.github/workflows/semantic-pull-request.yml
@@ -28,6 +28,7 @@ jobs:
             perf
             test
             build
+            guix
             ci
             chore
             revert
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 95e34313e6d8a..381dbb91a88d4 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -131,6 +131,7 @@ include:
   - *utils* for changes to the utils and libraries
   - *wallet* for changes to the wallet code
   - *zmq* for changes to the ZMQ APIs
+  - *guix* for changes to the GUIX reproducible builds
 
 Examples:
 

From 22e7845cf253c9096cd7f5be780d5f4cf4d50bf2 Mon Sep 17 00:00:00 2001
From: fanquake <fanquake@gmail.com>
Date: Fri, 1 Jul 2022 10:40:57 +0100
Subject: [PATCH 3/9] Merge bitcoin/bitcoin#25508: guix: use elfesteem
 2eb1e5384ff7a220fd1afacd4a0170acff54fe56

103c0d9f7e084c94ba7d83a44e784ab0b4a6d8e4 guix: use elfesteem 2eb1e5384ff7a220fd1afacd4a0170acff54fe56 (fanquake)

Pull request description:

  Our patch has been merged upstream, see https://github.com/LRGH/elfesteem/pull/3.

  Guix Build (x86_64):
  ```bash
  3deb66d386587e7ce29b92528170081d9e74443ddf50d07b72aacaee31c11641  guix-build-103c0d9f7e08/output/aarch64-linux-gnu/SHA256SUMS.part
  5f53a059ccf07181fa1154dc6ab741a9beda663a48d123d2aa4256ca7d38497a  guix-build-103c0d9f7e08/output/aarch64-linux-gnu/bitcoin-103c0d9f7e08-aarch64-linux-gnu-debug.tar.gz
  20cdb705439ff54822f7c3cad12254b46f8ff93aae58f1716253f39bd734eaf1  guix-build-103c0d9f7e08/output/aarch64-linux-gnu/bitcoin-103c0d9f7e08-aarch64-linux-gnu.tar.gz
  ae51fb2ef8e76326bde4693f778444a5c21df1feba42b161e667c5f069aae967  guix-build-103c0d9f7e08/output/arm-linux-gnueabihf/SHA256SUMS.part
  0ffeaa089582871a578069c0251bf51823624274c23c2fd65f04d2a3e50f3296  guix-build-103c0d9f7e08/output/arm-linux-gnueabihf/bitcoin-103c0d9f7e08-arm-linux-gnueabihf-debug.tar.gz
  71f3da47678d8169414ef0072271604fa550e84ce86979706b3b289a1521a119  guix-build-103c0d9f7e08/output/arm-linux-gnueabihf/bitcoin-103c0d9f7e08-arm-linux-gnueabihf.tar.gz
  f5d13de726f7705e946a2b3a63d182d8c7e70e3adc9a92552676898e9819db27  guix-build-103c0d9f7e08/output/arm64-apple-darwin/SHA256SUMS.part
  e411e8f0cc3ab18981ccb65768a6af1622748c14b6e0513401179bcd0df519a7  guix-build-103c0d9f7e08/output/arm64-apple-darwin/bitcoin-103c0d9f7e08-arm64-apple-darwin-unsigned.dmg
  d7e9aa52f9b0a0249445e926753978d6845bab0c02639d162879b921f237b8ce  guix-build-103c0d9f7e08/output/arm64-apple-darwin/bitcoin-103c0d9f7e08-arm64-apple-darwin-unsigned.tar.gz
  cefde91f0b75a27e945f190194dbe0dab5653a6bcc91b18bec34d952aebd72d7  guix-build-103c0d9f7e08/output/arm64-apple-darwin/bitcoin-103c0d9f7e08-arm64-apple-darwin.tar.gz
  0b399fd5f7a85974ab25933575a0173c814d4ab578d16ab13896bb51e408b92f  guix-build-103c0d9f7e08/output/dist-archive/bitcoin-103c0d9f7e08.tar.gz
  22d6a771d2eab73ab328c8b472160333dd52c6f734761f466c79251a37bd1895  guix-build-103c0d9f7e08/output/powerpc64-linux-gnu/SHA256SUMS.part
  a6e598b022683e0858be8bd4a6d75bc15f2fbc7632c45f8b03c7a8dff367343a  guix-build-103c0d9f7e08/output/powerpc64-linux-gnu/bitcoin-103c0d9f7e08-powerpc64-linux-gnu-debug.tar.gz
  04ea54706ac47f8880ae0fcddabb0f4fe899a0bacf52d0d936dbbc1149e14e10  guix-build-103c0d9f7e08/output/powerpc64-linux-gnu/bitcoin-103c0d9f7e08-powerpc64-linux-gnu.tar.gz
  059a7018ce96e141c258d516b85c3ee95f02b61dc2db4931fa14993b2bd945e3  guix-build-103c0d9f7e08/output/powerpc64le-linux-gnu/SHA256SUMS.part
  aacaa0e4827808ed189152c6f1a4e0d9300b89136a7dc064fd045f700ee06084  guix-build-103c0d9f7e08/output/powerpc64le-linux-gnu/bitcoin-103c0d9f7e08-powerpc64le-linux-gnu-debug.tar.gz
  4041f8de495b4633df0e28d75ab6cfd0bfe7ec9292384ce4d3331383d06da310  guix-build-103c0d9f7e08/output/powerpc64le-linux-gnu/bitcoin-103c0d9f7e08-powerpc64le-linux-gnu.tar.gz
  1586a47797a803cab03a9ebcd207eb395e1651c443e9192ac2b144b85e014762  guix-build-103c0d9f7e08/output/riscv64-linux-gnu/SHA256SUMS.part
  74f088bca4e7c0d44e6b7161ee4c835b38bc9291c78f37e53d3ede2da98d52c0  guix-build-103c0d9f7e08/output/riscv64-linux-gnu/bitcoin-103c0d9f7e08-riscv64-linux-gnu-debug.tar.gz
  12cfe35b28de03f2355d6fb5ed9393001d3b5a06b12a2792cb863ca4ae61db17  guix-build-103c0d9f7e08/output/riscv64-linux-gnu/bitcoin-103c0d9f7e08-riscv64-linux-gnu.tar.gz
  b021e117d1e92ad105234661468efeab98246db79d51267a766399776999bafe  guix-build-103c0d9f7e08/output/x86_64-apple-darwin/SHA256SUMS.part
  0a6c9d00f9ea2d67ca58c867258bb1b595a3141d5f199ffb047f7235bb2863a6  guix-build-103c0d9f7e08/output/x86_64-apple-darwin/bitcoin-103c0d9f7e08-x86_64-apple-darwin-unsigned.dmg
  a7df5f759e792e4fae46ab7ddca5db8cff8973aa33d7d99c4bfbf7c04c2d3013  guix-build-103c0d9f7e08/output/x86_64-apple-darwin/bitcoin-103c0d9f7e08-x86_64-apple-darwin-unsigned.tar.gz
  801ec4f81af5f184cc0e0fcf650f4e5822d895a4202c35575f46e1c63498b1aa  guix-build-103c0d9f7e08/output/x86_64-apple-darwin/bitcoin-103c0d9f7e08-x86_64-apple-darwin.tar.gz
  813e9c9c6e0ce430d2096963dbffeb141f239d67b334e44b3fd1f1bc9246758d  guix-build-103c0d9f7e08/output/x86_64-linux-gnu/SHA256SUMS.part
  43e7afc360267fea8e1620e0c2ea40c45af07debbd646abf9fe631465c2e2c47  guix-build-103c0d9f7e08/output/x86_64-linux-gnu/bitcoin-103c0d9f7e08-x86_64-linux-gnu-debug.tar.gz
  0c5fc4b3c5bf4a53f1f9710cd738d5c0bbe6a2f0dc45e91f92065ae766b63635  guix-build-103c0d9f7e08/output/x86_64-linux-gnu/bitcoin-103c0d9f7e08-x86_64-linux-gnu.tar.gz
  08c031137c2c472a944f3220cf3812a8ec1dd70da9b0f264361ba16badb65b9f  guix-build-103c0d9f7e08/output/x86_64-w64-mingw32/SHA256SUMS.part
  4bbdc405075001b61e7cc48974e4b987c887a861add6db419fb51eccd914fbb0  guix-build-103c0d9f7e08/output/x86_64-w64-mingw32/bitcoin-103c0d9f7e08-win64-debug.zip
  8de95b683500300a787dd1d0d74580e9d6ab448f00f4c32e58ad830b763f2755  guix-build-103c0d9f7e08/output/x86_64-w64-mingw32/bitcoin-103c0d9f7e08-win64-setup-unsigned.exe
  36202c352d1f3b238daa00126f7ad369e53a510a32bb2585d69f967ef02aff48  guix-build-103c0d9f7e08/output/x86_64-w64-mingw32/bitcoin-103c0d9f7e08-win64-unsigned.tar.gz
  6255922a31502a23ea323095dec2d176bca22977222936fc7857a55ac001f6e9  guix-build-103c0d9f7e08/output/x86_64-w64-mingw32/bitcoin-103c0d9f7e08-win64.zip
  ```

ACKs for top commit:
  hebasto:
    ACK 103c0d9f7e084c94ba7d83a44e784ab0b4a6d8e4, I have reviewed the code and it looks OK.

Tree-SHA512: 421956999d2daedbce2e94a13dffa20b2dafb36ca5ffa094d8dca79eb5e60ec91bfade59cd24da548b45aec00f688d570e61a3567ea8075c25d198ac7fc4efff
---
 contrib/guix/manifest.scm                           |  5 ++---
 .../patches/elfsteem-value-error-python-39.patch    | 13 -------------
 2 files changed, 2 insertions(+), 16 deletions(-)
 delete mode 100644 contrib/guix/patches/elfsteem-value-error-python-39.patch

diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index 648420f023f78..f728f6cb54e6e 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -233,7 +233,7 @@ thus should be able to compile on most platforms where these exist.")
     (license license:gpl3+))) ; license is with openssl exception
 
 (define-public python-elfesteem
-  (let ((commit "87bbd79ab7e361004c98cc8601d4e5f029fd8bd5"))
+  (let ((commit "2eb1e5384ff7a220fd1afacd4a0170acff54fe56"))
     (package
       (name "python-elfesteem")
       (version (git-version "0.1" "1" commit))
@@ -246,8 +246,7 @@ thus should be able to compile on most platforms where these exist.")
          (file-name (git-file-name name commit))
          (sha256
           (base32
-           "1nyvjisvyxyxnd0023xjf5846xd03lwawp5pfzr8vrky7wwm5maz"))
-      (patches (search-our-patches "elfsteem-value-error-python-39.patch"))))
+           "07x6p8clh11z8s1n2kdxrqwqm2almgc5qpkcr9ckb6y5ivjdr5r6"))))
       (build-system python-build-system)
       ;; There are no tests, but attempting to run python setup.py test leads to
       ;; PYTHONPATH problems, just disable the test
diff --git a/contrib/guix/patches/elfsteem-value-error-python-39.patch b/contrib/guix/patches/elfsteem-value-error-python-39.patch
deleted file mode 100644
index 21e1228afd83c..0000000000000
--- a/contrib/guix/patches/elfsteem-value-error-python-39.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/examples/otool.py b/examples/otool.py
-index 2b8efc0..d797b2e 100755
---- a/examples/otool.py
-+++ b/examples/otool.py
-@@ -342,7 +342,7 @@ if __name__ == '__main__':
-         try:
-             e = macho_init.MACHO(raw,
-                 parseSymbols = False)
--        except ValueError, err:
-+        except ValueError as err:
-             print("%s:" %file)
-             print("    %s" % err)
-             continue

From 2b7022106938e19f5cda3eefe9f623909cc920d9 Mon Sep 17 00:00:00 2001
From: MacroFake <falke.marco@gmail.com>
Date: Tue, 16 Aug 2022 08:37:50 +0200
Subject: [PATCH 4/9] Merge bitcoin/bitcoin#25833: doc: minor updates to guix
 README

98383d6d0dade5c2af2adcf10e274141fc7981aa doc: minor updates to guix README (Stacie)

Pull request description:

  Two minor updates to the guix docs:

  - `contrib/guix/README.md`: fix broken link
  - `contrib/guix/INSTALL.md`: Change Ubuntu version in the section on distribution maintained packages from 21.04 (Hirsute Hippo) to 22.04 (Jammy Jellyfish). The previous link to the Ubuntu Guix package (https://packages.ubuntu.com/hirsute/guix) was for Hirsute. That link is now broken, likely because Hirsute reached EOL in January. I was unable to locate a general page for Ubuntu Guix packages so I replaced the broken link with the search results for all Ubuntu Guix packages. That page currently displays Guix packages for three different versions of Ubuntu. Happy to replace this link if there is a better option.

ACKs for top commit:
  jarolrod:
    ACK 98383d6d0dade5c2af2adcf10e274141fc7981aa

Tree-SHA512: 6980f5952862773e79ca317edb4aadf6ff7c71726a0e4cb873c08bf51360c64e0498aabf4f53780f13cb06838eda93c89ba10fe35c4c8ae2b23191ab961b98f8
---
 contrib/guix/INSTALL.md | 4 ++--
 contrib/guix/README.md  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/contrib/guix/INSTALL.md b/contrib/guix/INSTALL.md
index a50b80f35719b..ce4b28b718a35 100644
--- a/contrib/guix/INSTALL.md
+++ b/contrib/guix/INSTALL.md
@@ -72,11 +72,11 @@ writing (July 2021). Guix is expected to be more widely packaged over time. For
 an up-to-date view on Guix's package status/version across distros, please see:
 https://repology.org/project/guix/versions
 
-### Debian 11 (Bullseye)/Ubuntu 21.04 (Hirsute Hippo)
+### Debian / Ubuntu
 
 Guix v1.2.0 is available as a distribution package starting in [Debian
 11](https://packages.debian.org/bullseye/guix) and [Ubuntu
-21.04](https://packages.ubuntu.com/hirsute/guix).
+21.04](https://packages.ubuntu.com/search?keywords=guix).
 
 Note that if you intend on using Guix without using any substitutes (more
 details [here][security-model]), v1.2.0 has a known problem when building GnuTLS
diff --git a/contrib/guix/README.md b/contrib/guix/README.md
index 28d570ffa2c23..66feb4d2d7aab 100644
--- a/contrib/guix/README.md
+++ b/contrib/guix/README.md
@@ -382,7 +382,7 @@ https://ci.guix.gnu.org is automatically used unless the `--no-substitutes` flag
 is supplied. This default list of substitute servers is overridable both on a
 `guix-daemon` level and when you invoke `guix` commands. See examples below for
 the various ways of adding dongcarl's substitute server after having [authorized
-his signing key](#authorize-the-signing-keys).
+his signing key](#step-1-authorize-the-signing-keys).
 
 Change the **default list** of substitute servers by starting `guix-daemon` with
 the `--substitute-urls` option (you will likely need to edit your init script):

From 7fdc7fb9d693de03c425db297a1a3c58ced8058e Mon Sep 17 00:00:00 2001
From: fanquake <fanquake@gmail.com>
Date: Tue, 13 Sep 2022 10:17:56 +0100
Subject: [PATCH 5/9] Merge bitcoin/bitcoin#26047: guix: use git-minimal over
 git

0cd7928133eb8a605979c6338bbcbcb116cfa669 guix: use git-minimal over git (fanquake)

Pull request description:

  From the [git-minimal package definition](https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/packages/version-control.scm?id=998eda3067c7d21e0d9bb3310d2f5a14b8f1c681#n597):
  > The size of the closure of 'git-minimal' is two thirds that of 'git'.
  > Its test suite runs slightly faster and most importantly it doesn't
  > depend on packages that are expensive to build such as Subversion.

  We don't need any git functionality above the basics, so switch to `git-minimal` and save CPU when building the package, while also pruning the greater dependency graph (see `dependencies:` below). Note that git-minimal also lists `riscv64-linux` as a supported system, where `git` does not.

  ```diff
  -name: git
  +name: git-minimal
   version: 2.37.3
   outputs:
  -+ send-email: see Appendix H
  -+ svn: see Appendix H
  -+ credential-netrc: see Appendix H
  -+ credential-libsecret: see Appendix H
  -+ subtree: see Appendix H
  -+ gui: see Appendix H
   + out: everything else
  -systems: x86_64-linux mips64el-linux aarch64-linux powerpc64le-linux i686-linux armhf-linux powerpc-linux
  -dependencies: asciidoc@9.1.0 bash-minimal@5.1.8 bash@5.1.8 curl@7.79.1 docbook-xsl@1.79.2 expat@2.4.1 gettext-minimal@0.21 glib@2.70.2 libsecret@0.20.4 openssl@1.1.1l pcre2@10.37 perl-authen-sasl@2.16 perl-cgi@4.52
  -+ perl-io-socket-ssl@2.068 perl-net-smtp-ssl@1.04 perl-term-readkey@2.38 perl@5.34.0 pkg-config@0.29.2 python@3.9.9 subversion@1.14.1 tcl@8.6.11 tk@8.6.11.1 xmlto@0.0.28 zlib@1.2.11
  -location: gnu/packages/version-control.scm:222:2
  +systems: x86_64-linux mips64el-linux aarch64-linux powerpc64le-linux riscv64-linux i686-linux armhf-linux powerpc-linux
  +dependencies: bash-minimal@5.1.8 bash@5.1.8 curl@7.79.1 expat@2.4.1 gettext-minimal@0.21 openssl@1.1.1l perl@5.34.0 zlib@1.2.11
  +location: gnu/packages/version-control.scm:608:2
   homepage: https://git-scm.com/
   license: GPL 2
   synopsis: Distributed version control system
  ```

  Guix Build (x86_64):
  ```bash
  da4adca0304f19833893867418c8827e0213c58a1b605753355340a5f270754a  guix-build-0cd7928133eb/output/aarch64-linux-gnu/SHA256SUMS.part
  38c2b5f8e560018911ed776660fcd2aa8b6061a59af26118f06e23c9a335e80c  guix-build-0cd7928133eb/output/aarch64-linux-gnu/bitcoin-0cd7928133eb-aarch64-linux-gnu-debug.tar.gz
  de117782318d6e0ed55efaae7b2f11d033fe05e7a72fbda3ef7bbcbc758add69  guix-build-0cd7928133eb/output/aarch64-linux-gnu/bitcoin-0cd7928133eb-aarch64-linux-gnu.tar.gz
  6ae8ebfac28c43488b9aa386b9a87937789a57e54dc1d77a9c7b95323a417abc  guix-build-0cd7928133eb/output/arm-linux-gnueabihf/SHA256SUMS.part
  97f5d9d14eeb4b2926304c142fa6c46b7126524b8f836655704f5643b58b9436  guix-build-0cd7928133eb/output/arm-linux-gnueabihf/bitcoin-0cd7928133eb-arm-linux-gnueabihf-debug.tar.gz
  37815ea73941cf0a870e5ac4aafe9249a63ed1eeaa37440de23c2d9bf2b77be8  guix-build-0cd7928133eb/output/arm-linux-gnueabihf/bitcoin-0cd7928133eb-arm-linux-gnueabihf.tar.gz
  64cd484fa48968dc7063c4f501e1ff62d1ba46ae9975bfa060a3c88e2a98d232  guix-build-0cd7928133eb/output/arm64-apple-darwin/SHA256SUMS.part
  4e7e0daaf0ac1b5ed5a7e5ee8085e5e6446c48e70161f78938acd0e916c55729  guix-build-0cd7928133eb/output/arm64-apple-darwin/bitcoin-0cd7928133eb-arm64-apple-darwin-unsigned.dmg
  0f2b534d16482e536552c7b3de605bd71997b898755fe5a9ac39b36aea2698b6  guix-build-0cd7928133eb/output/arm64-apple-darwin/bitcoin-0cd7928133eb-arm64-apple-darwin-unsigned.tar.gz
  03cd1f509c60919c2ad1503d2f98be444c9770b62c4d303cb4cbdc1100ce131d  guix-build-0cd7928133eb/output/arm64-apple-darwin/bitcoin-0cd7928133eb-arm64-apple-darwin.tar.gz
  1e28183c1c314921a8404b72283bb861dff28061310c18535618683b097e7e61  guix-build-0cd7928133eb/output/dist-archive/bitcoin-0cd7928133eb.tar.gz
  0f6459568d0369528ad35622d5378feccdac319eed618418841c22cc137cbd05  guix-build-0cd7928133eb/output/powerpc64-linux-gnu/SHA256SUMS.part
  1cf0c8a48add60082c381935630b59a0bd483a7eda97f04b72dcb05143135109  guix-build-0cd7928133eb/output/powerpc64-linux-gnu/bitcoin-0cd7928133eb-powerpc64-linux-gnu-debug.tar.gz
  5332f148efa1579b077747c8c7d6c763d31804d4ac454abaf34a3e2374c9b6b2  guix-build-0cd7928133eb/output/powerpc64-linux-gnu/bitcoin-0cd7928133eb-powerpc64-linux-gnu.tar.gz
  5fc03945c2ab86ba43395ccf32cf4b338dcceb446e106c0f6e660dac47224183  guix-build-0cd7928133eb/output/powerpc64le-linux-gnu/SHA256SUMS.part
  5cfabdb27dc8fb7de402c558e5f962ac4fdaf2c344d201f27f7ed1370a550407  guix-build-0cd7928133eb/output/powerpc64le-linux-gnu/bitcoin-0cd7928133eb-powerpc64le-linux-gnu-debug.tar.gz
  ba265df6803d472434ecb3ad44983965a5eca1ccd42fea64760309ff70d17ee5  guix-build-0cd7928133eb/output/powerpc64le-linux-gnu/bitcoin-0cd7928133eb-powerpc64le-linux-gnu.tar.gz
  ff40a374f215eb3010291569b8ed1958054e408469fc8b2fe97a30cca0ad5451  guix-build-0cd7928133eb/output/riscv64-linux-gnu/SHA256SUMS.part
  7b7b89ac1905d58f1e96a7840c018a556c472015a44442d0742bf758cb5f67ca  guix-build-0cd7928133eb/output/riscv64-linux-gnu/bitcoin-0cd7928133eb-riscv64-linux-gnu-debug.tar.gz
  10431bd8ffca82dd9c59f568272a1e7473cf474996f750d9bed4b576591fcff1  guix-build-0cd7928133eb/output/riscv64-linux-gnu/bitcoin-0cd7928133eb-riscv64-linux-gnu.tar.gz
  4ef532d8dbe42900146a5b3e02de2a6a59d66b3c66a4b9d919d3aeb0e9637ab1  guix-build-0cd7928133eb/output/x86_64-apple-darwin/SHA256SUMS.part
  77a1abe4139c19d227309216e29cf55dae06c4469412b457c9f0e8cf1eccc25c  guix-build-0cd7928133eb/output/x86_64-apple-darwin/bitcoin-0cd7928133eb-x86_64-apple-darwin-unsigned.dmg
  33028b640efab25648d0ec1abe9e91abc983706623ca9e2e7ac5fbfca0970909  guix-build-0cd7928133eb/output/x86_64-apple-darwin/bitcoin-0cd7928133eb-x86_64-apple-darwin-unsigned.tar.gz
  e10d2d5617b8b1a33a622d5904d2bd8eaf57a5b3605e22ef916a57105db2311e  guix-build-0cd7928133eb/output/x86_64-apple-darwin/bitcoin-0cd7928133eb-x86_64-apple-darwin.tar.gz
  bf65d3574afed2e017c9625d38cc31e0f2cbb7f1e8a9ce346644ea3dbb938d13  guix-build-0cd7928133eb/output/x86_64-linux-gnu/SHA256SUMS.part
  ce3810e70c97b2698822e4f46fa64dfa12353f7b54400e671b64868e3e4d3472  guix-build-0cd7928133eb/output/x86_64-linux-gnu/bitcoin-0cd7928133eb-x86_64-linux-gnu-debug.tar.gz
  4055370c15b199d1efef47cc262d9c43a3652dcd237a9434197ca3be4931b1d2  guix-build-0cd7928133eb/output/x86_64-linux-gnu/bitcoin-0cd7928133eb-x86_64-linux-gnu.tar.gz
  e59ed970d1db5d4839fa67957945628f6919ef5491f4a595f89ed3d8c81f1a76  guix-build-0cd7928133eb/output/x86_64-w64-mingw32/SHA256SUMS.part
  19c443fab5cb2fe75c9a5ad51fc022c97e31d7d69e049a889bd06f740f8daf78  guix-build-0cd7928133eb/output/x86_64-w64-mingw32/bitcoin-0cd7928133eb-win64-debug.zip
  88f6ca5d299080114532ec550c59eca4a3cdb759d9ea35cb14eba0b135e72436  guix-build-0cd7928133eb/output/x86_64-w64-mingw32/bitcoin-0cd7928133eb-win64-setup-unsigned.exe
  bcdb0b7467d3e47a694e51e9bfbaab9d5dc7162efe6c6bf4c303d368272c0cc6  guix-build-0cd7928133eb/output/x86_64-w64-mingw32/bitcoin-0cd7928133eb-win64-unsigned.tar.gz
  db1d4bbfab53405080d3abd09d1f05b2642ed513f6d8fcb5d92b9d0b32745293  guix-build-0cd7928133eb/output/x86_64-w64-mingw32/bitcoin-0cd7928133eb-win64.zip
  ```

  Guix Build (arm64):
  ```bash
  da4adca0304f19833893867418c8827e0213c58a1b605753355340a5f270754a  guix-build-0cd7928133eb/output/aarch64-linux-gnu/SHA256SUMS.part
  38c2b5f8e560018911ed776660fcd2aa8b6061a59af26118f06e23c9a335e80c  guix-build-0cd7928133eb/output/aarch64-linux-gnu/bitcoin-0cd7928133eb-aarch64-linux-gnu-debug.tar.gz
  de117782318d6e0ed55efaae7b2f11d033fe05e7a72fbda3ef7bbcbc758add69  guix-build-0cd7928133eb/output/aarch64-linux-gnu/bitcoin-0cd7928133eb-aarch64-linux-gnu.tar.gz
  6ae8ebfac28c43488b9aa386b9a87937789a57e54dc1d77a9c7b95323a417abc  guix-build-0cd7928133eb/output/arm-linux-gnueabihf/SHA256SUMS.part
  97f5d9d14eeb4b2926304c142fa6c46b7126524b8f836655704f5643b58b9436  guix-build-0cd7928133eb/output/arm-linux-gnueabihf/bitcoin-0cd7928133eb-arm-linux-gnueabihf-debug.tar.gz
  37815ea73941cf0a870e5ac4aafe9249a63ed1eeaa37440de23c2d9bf2b77be8  guix-build-0cd7928133eb/output/arm-linux-gnueabihf/bitcoin-0cd7928133eb-arm-linux-gnueabihf.tar.gz
  64cd484fa48968dc7063c4f501e1ff62d1ba46ae9975bfa060a3c88e2a98d232  guix-build-0cd7928133eb/output/arm64-apple-darwin/SHA256SUMS.part
  4e7e0daaf0ac1b5ed5a7e5ee8085e5e6446c48e70161f78938acd0e916c55729  guix-build-0cd7928133eb/output/arm64-apple-darwin/bitcoin-0cd7928133eb-arm64-apple-darwin-unsigned.dmg
  0f2b534d16482e536552c7b3de605bd71997b898755fe5a9ac39b36aea2698b6  guix-build-0cd7928133eb/output/arm64-apple-darwin/bitcoin-0cd7928133eb-arm64-apple-darwin-unsigned.tar.gz
  03cd1f509c60919c2ad1503d2f98be444c9770b62c4d303cb4cbdc1100ce131d  guix-build-0cd7928133eb/output/arm64-apple-darwin/bitcoin-0cd7928133eb-arm64-apple-darwin.tar.gz
  1e28183c1c314921a8404b72283bb861dff28061310c18535618683b097e7e61  guix-build-0cd7928133eb/output/dist-archive/bitcoin-0cd7928133eb.tar.gz
  0f6459568d0369528ad35622d5378feccdac319eed618418841c22cc137cbd05  guix-build-0cd7928133eb/output/powerpc64-linux-gnu/SHA256SUMS.part
  1cf0c8a48add60082c381935630b59a0bd483a7eda97f04b72dcb05143135109  guix-build-0cd7928133eb/output/powerpc64-linux-gnu/bitcoin-0cd7928133eb-powerpc64-linux-gnu-debug.tar.gz
  5332f148efa1579b077747c8c7d6c763d31804d4ac454abaf34a3e2374c9b6b2  guix-build-0cd7928133eb/output/powerpc64-linux-gnu/bitcoin-0cd7928133eb-powerpc64-linux-gnu.tar.gz
  5fc03945c2ab86ba43395ccf32cf4b338dcceb446e106c0f6e660dac47224183  guix-build-0cd7928133eb/output/powerpc64le-linux-gnu/SHA256SUMS.part
  5cfabdb27dc8fb7de402c558e5f962ac4fdaf2c344d201f27f7ed1370a550407  guix-build-0cd7928133eb/output/powerpc64le-linux-gnu/bitcoin-0cd7928133eb-powerpc64le-linux-gnu-debug.tar.gz
  ba265df6803d472434ecb3ad44983965a5eca1ccd42fea64760309ff70d17ee5  guix-build-0cd7928133eb/output/powerpc64le-linux-gnu/bitcoin-0cd7928133eb-powerpc64le-linux-gnu.tar.gz
  ff40a374f215eb3010291569b8ed1958054e408469fc8b2fe97a30cca0ad5451  guix-build-0cd7928133eb/output/riscv64-linux-gnu/SHA256SUMS.part
  7b7b89ac1905d58f1e96a7840c018a556c472015a44442d0742bf758cb5f67ca  guix-build-0cd7928133eb/output/riscv64-linux-gnu/bitcoin-0cd7928133eb-riscv64-linux-gnu-debug.tar.gz
  10431bd8ffca82dd9c59f568272a1e7473cf474996f750d9bed4b576591fcff1  guix-build-0cd7928133eb/output/riscv64-linux-gnu/bitcoin-0cd7928133eb-riscv64-linux-gnu.tar.gz
  4ef532d8dbe42900146a5b3e02de2a6a59d66b3c66a4b9d919d3aeb0e9637ab1  guix-build-0cd7928133eb/output/x86_64-apple-darwin/SHA256SUMS.part
  77a1abe4139c19d227309216e29cf55dae06c4469412b457c9f0e8cf1eccc25c  guix-build-0cd7928133eb/output/x86_64-apple-darwin/bitcoin-0cd7928133eb-x86_64-apple-darwin-unsigned.dmg
  33028b640efab25648d0ec1abe9e91abc983706623ca9e2e7ac5fbfca0970909  guix-build-0cd7928133eb/output/x86_64-apple-darwin/bitcoin-0cd7928133eb-x86_64-apple-darwin-unsigned.tar.gz
  e10d2d5617b8b1a33a622d5904d2bd8eaf57a5b3605e22ef916a57105db2311e  guix-build-0cd7928133eb/output/x86_64-apple-darwin/bitcoin-0cd7928133eb-x86_64-apple-darwin.tar.gz
  bf65d3574afed2e017c9625d38cc31e0f2cbb7f1e8a9ce346644ea3dbb938d13  guix-build-0cd7928133eb/output/x86_64-linux-gnu/SHA256SUMS.part
  ce3810e70c97b2698822e4f46fa64dfa12353f7b54400e671b64868e3e4d3472  guix-build-0cd7928133eb/output/x86_64-linux-gnu/bitcoin-0cd7928133eb-x86_64-linux-gnu-debug.tar.gz
  4055370c15b199d1efef47cc262d9c43a3652dcd237a9434197ca3be4931b1d2  guix-build-0cd7928133eb/output/x86_64-linux-gnu/bitcoin-0cd7928133eb-x86_64-linux-gnu.tar.gz
  e59ed970d1db5d4839fa67957945628f6919ef5491f4a595f89ed3d8c81f1a76  guix-build-0cd7928133eb/output/x86_64-w64-mingw32/SHA256SUMS.part
  19c443fab5cb2fe75c9a5ad51fc022c97e31d7d69e049a889bd06f740f8daf78  guix-build-0cd7928133eb/output/x86_64-w64-mingw32/bitcoin-0cd7928133eb-win64-debug.zip
  88f6ca5d299080114532ec550c59eca4a3cdb759d9ea35cb14eba0b135e72436  guix-build-0cd7928133eb/output/x86_64-w64-mingw32/bitcoin-0cd7928133eb-win64-setup-unsigned.exe
  bcdb0b7467d3e47a694e51e9bfbaab9d5dc7162efe6c6bf4c303d368272c0cc6  guix-build-0cd7928133eb/output/x86_64-w64-mingw32/bitcoin-0cd7928133eb-win64-unsigned.tar.gz
  db1d4bbfab53405080d3abd09d1f05b2642ed513f6d8fcb5d92b9d0b32745293  guix-build-0cd7928133eb/output/x86_64-w64-mingw32/bitcoin-0cd7928133eb-win64.zip
  ```

ACKs for top commit:
  hebasto:
    ACK 0cd7928133eb8a605979c6338bbcbcb116cfa669, I have reviewed the code and it looks OK. I have also checked out the usage of the `git-minimal` in the `git-download` Guix module which is being used. Did not compare actual build dependences while building from scratch.
  jarolrod:
    ACK 0cd7928133eb8a605979c6338bbcbcb116cfa669

Tree-SHA512: f949c4d2f9560f98b8a418a981da38bbb9cfee5d0814bea6bb676b7193f3cbddafd23a92f852ee59c6a68c9c282095e6368cb65c5f2352b2ab54f9692575349c
---
 contrib/guix/manifest.scm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index f728f6cb54e6e..0f7e0bb214c9b 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -598,7 +598,7 @@ parse, modify and abstract ELF, PE and MachO formats.")
         ;; Scripting
         python-minimal ;; (3.9)
         ;; Git
-        git
+        git-minimal
         ;; Tests
         (fix-ppc64-nx-default lief))
   (let ((target (getenv "HOST")))

From a0f5596cf18596fb054d9540268958ee31552334 Mon Sep 17 00:00:00 2001
From: fanquake <fanquake@gmail.com>
Date: Fri, 25 Nov 2022 16:47:48 +0000
Subject: [PATCH 6/9] Merge bitcoin/bitcoin#26335: Guix documentation
 improvements

10660c0c60f651a52ba9c86c7dba4fa232ed6583 doc: move Guix uninstall instructions to INSTALL.md (Sjors Provoost)
68fab72a8ca7cb8fb26a154a43efd998b7f78738 guix: OpenSSL test failure workaround (Sjors Provoost)
d612dca852db493531f4c3f51e6ea9987cd5db37 guix: reminder to migrate guix-daemon-original customization (Sjors Provoost)
8aa460cd02a6ab1229463c59e965203e52b34748 guix: add guile-gnutls and guile-json to install list (Sjors Provoost)
9b9991e02693c68061ccd4d6040641e20f934e6c guix: recommend mounting a tmpfs on /tmp (Sjors Provoost)
682283445e2cc815cf2786da83314fa8b8350511 guix: bump recommended hash for manual installation (Sjors Provoost)

Pull request description:

  I'm manually installing Guix on a fresh Ubuntu machine. Will be pushing more documentation fixes to this PR as I run into things.

  1. Bump minimum hash to match time-machine bump in #25099. It's not necessary for the root Guix version to match the time-machine version in our build, because `guix build` will automatically perform an upgrade for the user, but imo it's better to get any build issues (in Guix itself) over with while the user is going though `INSTALL.md`, rather than during their first Guix build (of Bitcoin Core).
  2. Recommend mapping a tmpfs to /tmp upfront, rather than in the troubleshooting section
  3. Add `guile-gnutls` and `guile-json` to the table of stuff to install (avoids having to find out in the `./configure` phase)
  4. Improve systemd doc
  5. Workaround OpenSSL v1.1.1l and v1.1.1n test failure (change machine time)
  6. Move uninstallation instructions to INSTALL.md, drop unused footnote / links

ACKs for top commit:
  jamesob:
    ACK https://github.com/bitcoin/bitcoin/pull/26335/commits/10660c0c60f651a52ba9c86c7dba4fa232ed6583

Tree-SHA512: ff1278b16f03ea9c63e23e97a852340ab824d5f6c64645cb70237dd828b9a439b4133b60cd2b89672573f6546e99419021d092e236f731908158a7aa6473b0ef
---
 contrib/guix/INSTALL.md | 66 ++++++++++++++++++++++++++++++++++++++---
 contrib/guix/README.md  | 49 ------------------------------
 2 files changed, 62 insertions(+), 53 deletions(-)

diff --git a/contrib/guix/INSTALL.md b/contrib/guix/INSTALL.md
index ce4b28b718a35..c7050b2ae3703 100644
--- a/contrib/guix/INSTALL.md
+++ b/contrib/guix/INSTALL.md
@@ -167,6 +167,10 @@ For reference, the graphic below outlines Guix v1.3.0's dependency graph:
 
 ![bootstrap map](https://user-images.githubusercontent.com/6399679/125064185-a9a59880-e0b0-11eb-82c1-9b8e5dc9950d.png)
 
+#### Consider /tmp on tmpfs
+
+If you use an NVME (SSD) drive, you may encounter [cryptic build errors](#coreutils-fail-teststail-2inotify-dir-recreate). Mounting a [tmpfs at /tmp](https://ubuntu.com/blog/data-driven-analysis-tmp-on-tmpfs) should prevent this and may improve performance as a bonus.
+
 #### Guile
 
 ##### Choosing a Guile version and sticking to it
@@ -334,6 +338,8 @@ packages in Debian at the time of writing.
 |-----------------------|---------------------|
 | guile-gcrypt          | libgcrypt-dev       |
 | guile-git             | libgit2-dev         |
+| guile-gnutls          | (none)              |
+| guile-json            | (none)              |
 | guile-lzlib           | liblz-dev           |
 | guile-ssh             | libssh-dev          |
 | guile-sqlite3         | libsqlite3-dev      |
@@ -384,8 +390,9 @@ cd guix
 ```
 
 You will likely want to build the latest release, however, if the latest release
-when you're reading this is still 1.2.0 then you may want to use 95aca29 instead
-to avoid a problem in the GnuTLS test suite.
+when you're reading this is still 1.3.0 then you may want to use 998eda30 instead
+to avoid the issues described in [#25099](
+https://github.com/bitcoin/bitcoin/pull/25099).
 
 ```
 git branch -a -l 'origin/version-*'  # check for the latest release
@@ -609,6 +616,8 @@ systemctl enable guix-daemon
 systemctl start guix-daemon
 ```
 
+Remember to set `--no-substitute` in `$libdir/systemd/system/guix-daemon.service` and other customizations if you used them for `guix-daemon-original.service`.
+
 ##### If you installed Guix via the Debian/Ubuntu distribution packages
 
 You will need to create a `guix-daemon-latest` service which points to the new
@@ -717,6 +726,19 @@ $ bzcat /var/log/guix/drvs/../...-foo-3.6.12.drv.bz2 | less
 times, it may be `/tmp/...drv-1` or `/tmp/...drv-2`. Always consult the build
 failure output for the most accurate, up-to-date information.
 
+### openssl-1.1.1l and openssl-1.1.1n
+
+OpenSSL includes tests that will fail once some certificate has expired. A workaround
+is to change your system clock:
+
+```sh
+sudo timedatectl set-ntp no
+sudo date --set "28 may 2022 15:00:00"
+sudo --login guix build --cores=1 /gnu/store/g9alz81w4q03ncm542487xd001s6akd4-openssl-1.1.1l.drv
+sudo --login guix build --cores=1 /gnu/store/mw6ax0gk33gh082anrdrxp2flrbskxv6-openssl-1.1.1n.drv
+sudo timedatectl set-ntp yes
+```
+
 ### python(-minimal): [Errno 84] Invalid or incomplete multibyte or wide character
 
 This error occurs when your `$TMPDIR` (default: /tmp) exists on a filesystem
@@ -774,7 +796,7 @@ The inotify-dir-create test fails on "remote" filesystems such as overlayfs
 as non-remote.
 
 A relatively easy workaround to this is to make sure that a somewhat traditional
-filesystem is mounted at `/tmp` (where `guix-daemon` performs its builds). For
+filesystem is mounted at `/tmp` (where `guix-daemon` performs its builds), see [/tmp on tmpfs](#consider-tmp-on-tmpfs). For
 Docker users, this might mean [using a volume][docker/volumes], [binding
 mounting][docker/bind-mnt] from host, or (for those with enough RAM and swap)
 [mounting a tmpfs][docker/tmpfs] using the `--tmpfs` flag.
@@ -782,7 +804,7 @@ mounting][docker/bind-mnt] from host, or (for those with enough RAM and swap)
 Please see the following links for more details:
 
 - An upstream coreutils bug has been filed: [debbugs#47940](https://debbugs.gnu.org/cgi/bugreport.cgi?bug=47940)
-- A Guix bug detailing the underlying problem has been filed: [guix-issues#47935](https://issues.guix.gnu.org/47935)
+- A Guix bug detailing the underlying problem has been filed: [guix-issues#47935](https://issues.guix.gnu.org/47935), [guix-issues#49985](https://issues.guix.gnu.org/49985#5)
 - A commit to skip this test in Guix has been merged into the core-updates branch:
 [savannah/guix@6ba1058](https://git.savannah.gnu.org/cgit/guix.git/commit/?id=6ba1058df0c4ce5611c2367531ae5c3cdc729ab4)
 
@@ -799,3 +821,39 @@ Please see the following links for more details:
 [docker/volumes]: https://docs.docker.com/storage/volumes/
 [docker/bind-mnt]: https://docs.docker.com/storage/bind-mounts/
 [docker/tmpfs]: https://docs.docker.com/storage/tmpfs/
+
+# Purging/Uninstalling Guix
+
+In the extraordinarily rare case where you messed up your Guix installation in
+an irreversible way, you may want to completely purge Guix from your system and
+start over.
+
+1. Uninstall Guix itself according to the way you installed it (e.g. `sudo apt
+   purge guix` for Ubuntu packaging, `sudo make uninstall` for a build from source).
+2. Remove all build users and groups
+
+   You may check for relevant users and groups using:
+
+   ```
+   getent passwd | grep guix
+   getent group | grep guix
+   ```
+
+   Then, you may remove users and groups using:
+
+   ```
+   sudo userdel <user>
+   sudo groupdel <group>
+   ```
+
+3. Remove all possible Guix-related directories
+    - `/var/guix/`
+    - `/var/log/guix/`
+    - `/gnu/`
+    - `/etc/guix/`
+    - `/home/*/.config/guix/`
+    - `/home/*/.cache/guix/`
+    - `/home/*/.guix-profile/`
+    - `/root/.config/guix/`
+    - `/root/.cache/guix/`
+    - `/root/.guix-profile/`
diff --git a/contrib/guix/README.md b/contrib/guix/README.md
index 66feb4d2d7aab..698deb47acfca 100644
--- a/contrib/guix/README.md
+++ b/contrib/guix/README.md
@@ -430,55 +430,6 @@ used.
 If you start `guix-daemon` using an init script, you can edit said script to
 supply this flag.
 
-
-# Purging/Uninstalling Guix
-
-In the extraordinarily rare case where you messed up your Guix installation in
-an irreversible way, you may want to completely purge Guix from your system and
-start over.
-
-1. Uninstall Guix itself according to the way you installed it (e.g. `sudo apt
-   purge guix` for Ubuntu packaging, `sudo make uninstall` for a build from source).
-2. Remove all build users and groups
-
-   You may check for relevant users and groups using:
-
-   ```
-   getent passwd | grep guix
-   getent group | grep guix
-   ```
-
-   Then, you may remove users and groups using:
-
-   ```
-   sudo userdel <user>
-   sudo groupdel <group>
-   ```
-
-3. Remove all possible Guix-related directories
-    - `/var/guix/`
-    - `/var/log/guix/`
-    - `/gnu/`
-    - `/etc/guix/`
-    - `/home/*/.config/guix/`
-    - `/home/*/.cache/guix/`
-    - `/home/*/.guix-profile/`
-    - `/root/.config/guix/`
-    - `/root/.cache/guix/`
-    - `/root/.guix-profile/`
-
 [b17e]: http://bootstrappable.org/
 [r12e/source-date-epoch]: https://reproducible-builds.org/docs/source-date-epoch/
-
-[guix/install.sh]: https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
-[guix/bin-install]: https://www.gnu.org/software/guix/manual/en/html_node/Binary-Installation.html
-[guix/env-setup]: https://www.gnu.org/software/guix/manual/en/html_node/Build-Environment-Setup.html
-[guix/substitutes]: https://www.gnu.org/software/guix/manual/en/html_node/Substitutes.html
-[guix/substitute-server-auth]: https://www.gnu.org/software/guix/manual/en/html_node/Substitute-Server-Authorization.html
-[guix/time-machine]: https://guix.gnu.org/manual/en/html_node/Invoking-guix-time_002dmachine.html
-
-[debian/guix-bullseye]: https://packages.debian.org/bullseye/guix
-[ubuntu/guix-hirsute]: https://packages.ubuntu.com/hirsute/guix
-[guix-docker]: https://github.com/dashpay/dash/tree/master/contrib/guix/Dockerfile
-
 [env-vars-list]: #recognized-environment-variables

From 12afe0c9950da5a9647ee43daa548b68710ce76c Mon Sep 17 00:00:00 2001
From: fanquake <fanquake@gmail.com>
Date: Wed, 15 Mar 2023 08:36:44 +0100
Subject: [PATCH 7/9] Merge bitcoin/bitcoin#27153: guix: pass
 `--enable-initfini-array` to release GCC

127c637cf0a80e0ea68a7c5aaa088e5ccc9d3d13 guix: pass --enable-initfini-array to release GCC (fanquake)

Pull request description:

  This returns us to pre-Guix behaviour, where the compilers we were using to build releases, were configured with this option.

  > [--enable-initfini-array](https://gcc.gnu.org/install/configure.html)
  > Force the use of sections .init_array and .fini_array (instead of .init and .fini) for constructors and destructors. Option --disable-initfini-array has the opposite effect. If neither option is specified, the configure script will try to guess whether the .init_array and .fini_array sections are supported and, if they are, use them.

ACKs for top commit:
  TheCharlatan:
    ACK 127c637cf0a80e0ea68a7c5aaa088e5ccc9d3d13
  vincenzopalazzo:
    utACK https://github.com/bitcoin/bitcoin/pull/27153/commits/127c637cf0a80e0ea68a7c5aaa088e5ccc9d3d13

Tree-SHA512: fa61227054d52d4dfb4524af3888203a501f680661bdef00bb0970d4e8f7c96cf7f592686c4795be5a0debca267b8e564a4960859297c31f6b261c0729238382
---
 contrib/guix/manifest.scm | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index 0f7e0bb214c9b..ebf8d02129c49 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -139,9 +139,11 @@ chain for " target " development."))
 ;; https://gcc.gnu.org/install/configure.html
 (define (hardened-gcc gcc)
   (package-with-extra-configure-variable (
-    package-with-extra-configure-variable gcc
-    "--enable-default-ssp" "yes")
-    "--enable-default-pie" "yes"))
+    package-with-extra-configure-variable (
+      package-with-extra-configure-variable gcc
+      "--enable-initfini-array" "yes")
+      "--enable-default-ssp" "yes")
+      "--enable-default-pie" "yes"))
 
 (define* (make-bitcoin-cross-toolchain target
                                        #:key

From 30f6c4985b60d746b058b3d143bf67419a9571ed Mon Sep 17 00:00:00 2001
From: fanquake <fanquake@gmail.com>
Date: Mon, 27 Mar 2023 14:55:11 +0100
Subject: [PATCH 8/9] Merge bitcoin/bitcoin#27326: guix: combine and document
 `enable_werror`

4becee396f3bda40832138dd1aaa90368ed31857 guix: combine and document enable_werror (fanquake)

Pull request description:

  Combine into `hardened-glibc`.
  Document why we don't use `--disable-werror` directly.

  https://www.gnu.org/software/libc/manual/html_node/Configuring-and-compiling.html
  > By default, the GNU C Library is built with -Werror. If you wish
  > to build without this option (for example, if building with a
  > newer version of GCC than this version of the GNU C Library was
  > tested with, so new warnings cause the build with -Werror to fail),
  > you can configure with --disable-werror.

ACKs for top commit:
  hebasto:
    ACK 4becee396f3bda40832138dd1aaa90368ed31857, the diff is correct.
  TheCharlatan:
    ACK 4becee396f3bda40832138dd1aaa90368ed31857

Tree-SHA512: 8724415f51b4d72d40c4e797faf52c93a81147fb629332b9388ffd7f113f2b16db3b7496bf3063dd978ac629fd5bde3ec7df4f1ff1ed714cb56f316a9334d119
---
 contrib/guix/manifest.scm | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index ebf8d02129c49..560b112f29fab 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -149,7 +149,7 @@ chain for " target " development."))
                                        #:key
                                        (base-gcc-for-libc base-gcc)
                                        (base-kernel-headers base-linux-kernel-headers)
-                                       (base-libc (hardened-glibc (make-glibc-without-werror glibc-2.28)))
+                                       (base-libc (hardened-glibc glibc-2.28))
                                        (base-gcc (make-gcc-rpath-link (hardened-gcc base-gcc))))
   "Convenience wrapper around MAKE-CROSS-TOOLCHAIN with default values
 desirable for building Dash Core release binaries."
@@ -501,15 +501,16 @@ and endian independent.")
 inspecting signatures in Mach-O binaries.")
       (license license:expat))))
 
-(define (make-glibc-without-werror glibc)
-  (package-with-extra-configure-variable glibc "enable_werror" "no"))
-
 ;; https://www.gnu.org/software/libc/manual/html_node/Configuring-and-compiling.html
+;; We don't use --disable-werror directly, as that would be passed through to bash,
+;; and cause it's build to fail.
 (define (hardened-glibc glibc)
   (package-with-extra-configure-variable (
-    package-with-extra-configure-variable glibc
-    "--enable-stack-protector" "strong")
-    "--enable-bind-now" "yes"))
+    package-with-extra-configure-variable (
+      package-with-extra-configure-variable glibc
+      "enable_werror" "no")
+      "--enable-stack-protector" "strong")
+      "--enable-bind-now" "yes"))
 
 (define-public glibc-2.28
   (package

From 69737c0073659f920e060928fc4445621de37e73 Mon Sep 17 00:00:00 2001
From: fanquake <fanquake@gmail.com>
Date: Wed, 29 Mar 2023 12:06:09 +0100
Subject: [PATCH 9/9] Merge bitcoin/bitcoin#27345: guix: use GCC tool wrappers

4133c8104f522c403c55d26bd03436a8149ff106 guix: use gcc tool wrappers (fanquake)

Pull request description:

  This way, correct `--plugin` arguments are passed through.

  This is a prerequisite for LTO (see #25391). Split out, to try move things along, as this change is isolated, and should be straight-forward.

ACKs for top commit:
  TheCharlatan:
    ACK [4133c81](https://github.com/bitcoin/bitcoin/pull/27345/commits/4133c8104f522c403c55d26bd03436a8149ff106)
  hebasto:
    ACK 4133c8104f522c403c55d26bd03436a8149ff106

Tree-SHA512: 4311a72a613cf027bd4490caa29604c985ed455589acd972285f13cbdf4806d2184a4dc6f20cb6f47c3fa751d58bfd0bacc257b87d4a804bf5ecf5b240e4a757
---
 contrib/guix/libexec/build.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/contrib/guix/libexec/build.sh b/contrib/guix/libexec/build.sh
index 0755764869b88..e5fc7cb2752da 100644
--- a/contrib/guix/libexec/build.sh
+++ b/contrib/guix/libexec/build.sh
@@ -207,9 +207,9 @@ make -C depends --jobs="$JOBS" HOST="$HOST" \
                                    ${SDK_PATH+SDK_PATH="$SDK_PATH"} \
                                    x86_64_linux_CC=x86_64-linux-gnu-gcc \
                                    x86_64_linux_CXX=x86_64-linux-gnu-g++ \
-                                   x86_64_linux_AR=x86_64-linux-gnu-ar \
-                                   x86_64_linux_RANLIB=x86_64-linux-gnu-ranlib \
-                                   x86_64_linux_NM=x86_64-linux-gnu-nm \
+                                   x86_64_linux_AR=x86_64-linux-gnu-gcc-ar \
+                                   x86_64_linux_RANLIB=x86_64-linux-gnu-gcc-ranlib \
+                                   x86_64_linux_NM=x86_64-linux-gnu-gcc-nm \
                                    x86_64_linux_STRIP=x86_64-linux-gnu-strip \
                                    qt_config_opts_x86_64_linux='-platform linux-g++ -xplatform bitcoin-linux-g++' \
                                    FORCE_USE_SYSTEM_CLANG=1