hebasto/guix-sigs.md

## guix-sigs.md

      
    Raw
  

              guix-sigs.md
            
          
    The bitcoin-core/guix.sigs Repository Workflow

Common environment variables

export SIGNER="hebasto"
export GUIX_SIGS_REPO="/home/hebasto/guix.sigs"
export DETACHED_SIGS_REPO="/home/hebasto/bitcoin-detached-sigs"

Prerequisites


Make sure your public key is available on https://keys.openpgp.org/.


Fork the bitcoin-core/guix.sigs repository on GitHub (if not forked yet):


pushd $GUIX_SIGS_REPO
git remote add hebasto git@github.com:hebasto/guix.sigs.git
git config remote.pushDefault hebasto
popd


The Xcode-15.0-15A240d-extracted-SDK-with-libcxx-headers subdirectory must resides in the depends/SDKsdirectory.

Preparing repository

If building for a tag:
VERSION=27.0rc2
git fetch
git checkout v$VERSION

Building

./contrib/guix/guix-build

Attesting non-codesigned binaries

./contrib/guix/guix-attest
pushd $GUIX_SIGS_REPO
git switch main
git pull
git checkout -b ${VERSION}-non-codesigned
git add $VERSION
git commit -m "Add attestations by $SIGNER for $VERSION non-codesigned"
git push
popd

Submit a PR to the bitcoin-core/guix.sigs repository on GitHub.
Signing binaries

pushd $DETACHED_SIGS_REPO
git fetch
git checkout v$VERSION
popd
./contrib/guix/guix-codesign

Attesting codesigned binaries

./contrib/guix/guix-attest
pushd $GUIX_SIGS_REPO
git switch main
git pull
git checkout -b ${VERSION}-codesigned
git add $VERSION
git commit -m "Add attestations by $SIGNER for $VERSION codesigned"
git push
popd

Submit a PR to the bitcoin-core/guix.sigs repository on GitHub.
Verifying

pushd $GUIX_SIGS_REPO
git switch main
git pull
popd
./contrib/guix/guix-verify