RIP-25 on Ravencoin Core 4.8.0: security remediation and qualification

.github/scripts/00-install-deps.sh

@@ -64,10 +64,7 @@ elif [[ ${OS} == "osx" ]]; then
     s3curl \
     sleuthkit \
     bison \
-    libtinfo5 \
-    python3-pip
-
-    pip3 install ds-store
+    libtinfo5
 
 elif [[ ${OS} == "linux" || ${OS} == "linux-disable-wallet" || ${OS} == "aarch64" || ${OS} == "aarch64-disable-wallet" ]]; then
     apt -y install \

.github/scripts/02-copy-build-dependencies.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 OS=${1}
 GITHUB_WORKSPACE=${2}
 GITHUB_REF=${3}
@@ -25,11 +27,14 @@ cd depends
 if [[ ${OS} == "windows" ]]; then
     make HOST=x86_64-w64-mingw32 -j2
 elif [[ ${OS} == "osx" ]]; then
-    mkdir SDKs
+    SDK_ARCHIVE=Xcode-11.3.1-11C505-extracted-SDK-with-libcxx-headers.tar.gz
+    SDK_SHA256=436df6dfc7073365d12f8ef6c1fdb060777c720602cc67c2dcf9a59d94290e38
+    mkdir -p SDKs
     cd SDKs
-    curl -O https://bitcoincore.org/depends-sources/sdks/Xcode-11.3.1-11C505-extracted-SDK-with-libcxx-headers.tar.gz
-    tar -zxf Xcode-11.3.1-11C505-extracted-SDK-with-libcxx-headers.tar.gz
-    rm -rf Xcode-11.3.1-11C505-extracted-SDK-with-libcxx-headers.tar.gz
+    curl --fail --location --retry 3 --output "${SDK_ARCHIVE}" "https://bitcoincore.org/depends-sources/sdks/${SDK_ARCHIVE}"
+    echo "${SDK_SHA256}  ${SDK_ARCHIVE}" | sha256sum --check
+    tar -zxf "${SDK_ARCHIVE}"
+    rm -f "${SDK_ARCHIVE}"
     cd ..
     make HOST=x86_64-apple-darwin14 -j2
 elif [[ ${OS} == "linux" || ${OS} == "linux-disable-wallet" ]]; then

.github/scripts/04-configure-build.sh

@@ -2,10 +2,11 @@
 
 OS=${1}
 GITHUB_WORKSPACE=${2}
+EXTRA_OPTS=()
 
 if [[ ! ${OS} || ! ${GITHUB_WORKSPACE} ]]; then
     echo "Error: Invalid options"
-    echo "Usage: ${0} <operating system> <github workspace path> <disable wallet (true | false)>"
+    echo "Usage: ${0} <operating system> <github workspace path>"
     exit 1
 fi
 
@@ -15,25 +16,25 @@ elif [[ ${OS} == "osx" ]]; then
     CONFIG_SITE=${GITHUB_WORKSPACE}/depends/x86_64-apple-darwin14/share/config.site ./configure --prefix=/ --disable-ccache --disable-maintainer-mode --disable-dependency-tracking --enable-reduce-exports --disable-bench --disable-gui-tests GENISOIMAGE=${GITHUB_WORKSPACE}/depends/x86_64-apple-darwin14/native/bin/genisoimage
 elif [[ ${OS} == "linux" || ${OS} == "linux-disable-wallet" ]]; then
     if [[ ${OS} == "linux-disable-wallet" ]]; then
-        EXTRA_OPTS="--disable-wallet"
+        EXTRA_OPTS=(--disable-wallet)
     fi
-    CONFIG_SITE=${GITHUB_WORKSPACE}/depends/x86_64-linux-gnu/share/config.site ./configure --prefix=/ --disable-ccache --disable-maintainer-mode --disable-dependency-tracking --enable-glibc-back-compat --enable-reduce-exports --disable-bench --disable-gui-tests CFLAGS="-O2 -g" CXXFLAGS="-O2 -g" LDFLAGS="-static-libstdc++" ${EXTRA_OPTS}
+    CONFIG_SITE=${GITHUB_WORKSPACE}/depends/x86_64-linux-gnu/share/config.site ./configure --prefix=/ --disable-ccache --disable-maintainer-mode --disable-dependency-tracking --enable-glibc-back-compat --enable-reduce-exports --disable-bench --disable-gui-tests CFLAGS="-O2 -g" CXXFLAGS="-O2 -g" LDFLAGS="-static-libstdc++" "${EXTRA_OPTS[@]}"
 elif [[ ${OS} == "arm32v7" || ${OS} == "arm32v7-disable-wallet" ]]; then
     if [[ ${OS} == "arm32v7-disable-wallet" ]]; then
-        EXTRA_OPTS="--disable-wallet"
-        CONFIG_SITE=${GITHUB_WORKSPACE}/depends/arm-linux-gnueabihf/share/config.site ./configure --prefix=/ --enable-glibc-back-compat --enable-reduce-exports LDFLAGS=-static-libstdc++ --disable-tests --with-libs=no --with-gui=no ${EXTRA_OPTS}
+        EXTRA_OPTS=(--disable-wallet)
+        CONFIG_SITE=${GITHUB_WORKSPACE}/depends/arm-linux-gnueabihf/share/config.site ./configure --prefix=/ --enable-glibc-back-compat --enable-reduce-exports LDFLAGS=-static-libstdc++ --disable-tests --with-libs=no --with-gui=no "${EXTRA_OPTS[@]}"
     else
         CONFIG_SITE=${GITHUB_WORKSPACE}/depends/arm-linux-gnueabihf/share/config.site ./configure --prefix=/ --disable-ccache --disable-maintainer-mode --disable-dependency-tracking --enable-glibc-back-compat --enable-reduce-exports --disable-bench --disable-gui-tests CFLAGS="-O2 -g" CXXFLAGS="-O2 -g" LDFLAGS="-static-libstdc++"
     fi
 elif [[ ${OS} == "aarch64" || ${OS} == "aarch64-disable-wallet" ]]; then
     if [[ ${OS} == "aarch64-disable-wallet" ]]; then
-        EXTRA_OPTS="--disable-wallet"
-        CONFIG_SITE=${GITHUB_WORKSPACE}/depends/aarch64-linux-gnu/share/config.site ./configure --prefix=/ --enable-glibc-back-compat --enable-reduce-exports LDFLAGS=-static-libstdc++ --disable-tests --with-libs=no --with-gui=no ${EXTRA_OPTS}
+        EXTRA_OPTS=(--disable-wallet)
+        CONFIG_SITE=${GITHUB_WORKSPACE}/depends/aarch64-linux-gnu/share/config.site ./configure --prefix=/ --enable-glibc-back-compat --enable-reduce-exports LDFLAGS=-static-libstdc++ --disable-tests --with-libs=no --with-gui=no "${EXTRA_OPTS[@]}"
     else
         CONFIG_SITE=${GITHUB_WORKSPACE}/depends/aarch64-linux-gnu/share/config.site ./configure --prefix=/ --disable-ccache --disable-maintainer-mode --disable-dependency-tracking --enable-glibc-back-compat --enable-reduce-exports --disable-bench --disable-gui-tests CFLAGS="-O2 -g" CXXFLAGS="-O2 -g" LDFLAGS="-static-libstdc++"
     fi
 else
     echo "You must pass an OS."
-    echo "Usage: ${0} <operating system> <github workspace path> <disable wallet (true | false)>"
+    echo "Usage: ${0} <operating system> <github workspace path>"
     exit 1
 fi

.github/scripts/06-package.sh

@@ -1,12 +1,11 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 OS=${1}
 GITHUB_WORKSPACE=${2}
 GITHUB_BASE_REF=${3}
 
-echo "----------------------------------------"
-env
-echo "----------------------------------------"
 
 if [[ ! ${OS} || ! ${GITHUB_WORKSPACE} || ! ${GITHUB_BASE_REF} ]]; then
     echo "Error: Invalid options"
@@ -59,7 +58,11 @@ if [[ ${OS} == "windows" ]]; then
     make install DESTDIR=${STAGE_DIR}/${DISTNAME}
 
     cd ${STAGE_DIR}
-    mv ${DISTNAME}/bin/*.dll ${DISTNAME}/lib/
+    # Depends builds link statically, so there may be no DLLs to move;
+    # a hard glob failure here would discard an otherwise complete build.
+    if compgen -G "${DISTNAME}/bin/*.dll" > /dev/null; then
+        mv ${DISTNAME}/bin/*.dll ${DISTNAME}/lib/
+    fi
     find . -name "lib*.la" -delete
     find . -name "lib*.a" -delete
     rm -rf ${DISTNAME}/lib/pkgconfig
@@ -96,12 +99,28 @@ if [[ ${OS} == "windows" ]]; then
     done
 
 elif [[ ${OS} == "osx" ]]; then
-
+
+    # Use all three checksum-pinned macdeploy modules from depends.
+    native_python_lib="${GITHUB_WORKSPACE}/depends/x86_64-apple-darwin14/native/lib"
+    export PYTHONPATH="${native_python_lib}/python3/dist-packages:${native_python_lib}/python/dist-packages${PYTHONPATH:+:${PYTHONPATH}}"
+    python3 - "${native_python_lib}" <<'PY'
+import importlib
+import os
+import sys
+
+root = os.path.realpath(sys.argv[1])
+for name in ("biplist", "mac_alias", "ds_store"):
+    module = importlib.import_module(name)
+    source = os.path.realpath(module.__file__)
+    if os.path.commonpath((root, source)) != root:
+        raise SystemExit("macOS packaging requires pinned depends module: " + name)
+PY
+
     make install-strip DESTDIR=${STAGE_DIR}/${DISTNAME}
 
     make osx_volname
 
-    make deploydir
+    make PYTHONPATH="${PYTHONPATH}" deploydir
 
     if [[ -e ${GITHUB_WORKSPACE}/dist/Raven-Qt.app/Contents/MacOS/install_cli.sh ]]; then
         chmod +x ${GITHUB_WORKSPACE}/dist/Raven-Qt.app/Contents/MacOS/install_cli.sh
@@ -121,7 +140,7 @@ elif [[ ${OS} == "osx" ]]; then
 
     cd ${GITHUB_WORKSPACE}
 
-    make deploy
+    make PYTHONPATH="${PYTHONPATH}" deploy
 
     ${GITHUB_WORKSPACE}/depends/x86_64-apple-darwin14/native/bin/dmg dmg "Raven-Core.dmg" ${RELEASE_LOCATION}/${DISTNAME}-osx-unsigned.dmg