Merge #6927: backport: merge bitcoin#30423, bitcoin#27038, bitcoin#31048, bitcoin#31099, bitcoin#31172, bitcoin#31450, bitcoin#31608, bitcoin#31818, bitcoin#29881, bitcoin#32458, bitcoin#32400, bitcoin#32760, bitcoin#33178, bitcoin#33312, bitcoin#33780, bitcoin#33181, bitcoin#34102, partial bitcoin#29023, bitcoin#30454, bitcoin#30509, bitcoin#30510, bitcoin#31105, bitcoin#32922, bitcoin#33489, bitcoin#33445 (build backports: part 5)

ad5c299 doc: add release notes (Kittywhiskers Van Gogh)
6350e93 merge bitcoin#34102: capnp 1.3.0 (Kittywhiskers Van Gogh)
e6e4ad0 merge bitcoin#33181: build for Linux HOSTS with `-static-libgcc` (Kittywhiskers Van Gogh)
e403bba merge bitcoin#33780: disable libsanitizer in Linux GCC build (Kittywhiskers Van Gogh)
88108ac partial bitcoin#33445: Update Clang in "tidy" job (Kittywhiskers Van Gogh)
f9686bb partial bitcoin#33489: Drop support for EOL macOS 13 (Kittywhiskers Van Gogh)
4a6de56 merge bitcoin#33312: Disable `UndefinedBinaryOperatorResult` check in `src/ipc` (Kittywhiskers Van Gogh)
00f46c2 merge bitcoin#33178: increase maximum allowed (runtime) GCC to 7 (Kittywhiskers Van Gogh)
49f815d partial bitcoin#32922: use notarized v28.2 binaries and fix macOS detection (Kittywhiskers Van Gogh)
7bf7523 merge bitcoin#32760: capnp 1.2.0 (Kittywhiskers Van Gogh)
369e875 merge bitcoin#32400: Use modern Windows randomness functions (Kittywhiskers Van Gogh)
62cb45b merge bitcoin#32458: move `*-check.py` scripts under `contrib/guix/` (Kittywhiskers Van Gogh)
362013a merge bitcoin#29881: use GCC 13 to build releases (Kittywhiskers Van Gogh)
bfcf58a merge bitcoin#31818: remove test-security/symbol-check scripts (Kittywhiskers Van Gogh)
973eca0 merge bitcoin#31608: Clarify min macOS and Xcode version (Kittywhiskers Van Gogh)
7f80572 merge bitcoin#31450: disable gcov in base-linux-gcc (Kittywhiskers Van Gogh)
e189624 merge bitcoin#31172: increase minimum supported Windows to 10.0 (Kittywhiskers Van Gogh)
8494bd6 partial bitcoin#31105: Update libmultiprocess library (Kittywhiskers Van Gogh)
29c8bd9 merge bitcoin#31099: drop macOS LLVM install instructions (Kittywhiskers Van Gogh)
84b1e17 fix: bump `darwin_cmake_system_version` to match `OSX_MIN_VERSION` (Kittywhiskers Van Gogh)
cdc411d merge bitcoin#31048: Bump minimum supported macOS to 13.0 (Kittywhiskers Van Gogh)
5515a69 partial bitcoin#30510: Add IPC wrapper for Mining interface (Kittywhiskers Van Gogh)
ce6504e merge bitcoin#27038: test for `_FORTIFY_SOURCE` usage in release binaries (Kittywhiskers Van Gogh)
140848d partial bitcoin#30509: Add -ipcbind option to bitcoin-node (Kittywhiskers Van Gogh)
9df31ce partial bitcoin#30454: Introduce CMake-based build system (Kittywhiskers Van Gogh)
310a652 merge bitcoin#30423: simplify `test-security-check` (Kittywhiskers Van Gogh)
3bb0e30 partial bitcoin#29023: add historical release notes for 26.0 (Kittywhiskers Van Gogh)
c725a30 docs: add omitted "Compatibility" heading to release notes template (Kittywhiskers Van Gogh)

Pull request description:

  ## Motivation

  While working on adding support for Rust to our build system (see [dash#7109](#7109)), there were sources of conflict between our current setup and the minimums demanded by Rust and our FFI crate, [`cxx`](https://github.com/dtolnay/cxx). Specifically, Dash Core currently targets building for Windows 7 ([source](https://github.com/dashpay/dash/blob/cc50446936f8436d9ac3a2442bb348d93d8ba314/configure.ac#L818), [`0x601`](https://learn.microsoft.com/en-gb/windows/win32/winprog/using-the-windows-headers)) in direct conflict with the decision by Rusts' maintainers to drop support for Windows 7 effective Rust 1.78 ([source](https://blog.rust-lang.org/2024/02/26/Windows-7/))

  More recent versions of Rust have issues that require additional workarounds (see [`rust-lang/rust#128218`](rust-lang/rust#128218)) to keep support for Windows 7 around and using older versions of Rust is infeasible since both [`cxx`](https://github.com/dtolnay/cxx) and Rust packages currently under evaluation for integration with Dash Core require Rust 1.82+.

  Additionally, non-conformant definitions in the macOS SDK cause issues when attempting to build crates with FFI definitions (see [`dtolnay/cxx#1574`](dtolnay/cxx#1574)) which is resolved by an additional SDK bump that is not in the scope of this PR as it is _above_ the SDK version used upstream but does give cause to also consider a macOS target version bump, which _is_ done by upstream.

  ## Additional Information

  * Dependent on #6919

  * Dependency for #7109

  * macOS 11 (Big Sur) had its support period elapse ~2 years ago ([source](https://endoflife.date/macos)). macOS 14 (Sonoma) is the lowest version of macOS still receiving support from Apple and the new minimum version elected by upstream.

  * Windows 7 had its _extended_ support period elapse ~5 years ago ([source](https://learn.microsoft.com/en-gb/lifecycle/products/windows-7)) with the second lowest version, Windows 8.1, had its _extended_ support period elapse ~2 years ago ([source](https://learn.microsoft.com/en-us/lifecycle/products/windows-81)).

  ## Breaking Changes

  Dash Core binaries will now target Windows 10 and macOS 14 (Sonoma), replacing the previous target Windows 7 and macOS 11 (Big Sur).

  ## Checklist

  - [x] I have performed a self-review of my own code
  - [x] I have commented my code, particularly in hard-to-understand areas **(note: N/A)**
  - [x] I have added or updated relevant unit/integration/functional/e2e tests
  - [x] I have made corresponding changes to the documentation
  - [x] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

ACKs for top commit:
  UdjinM6:
    utACK ad5c299

Tree-SHA512: 650cbc12f2f129770623fd4e62bd7eb77ba0677ae33b765cc8359878633562e2a5c302f86d399400bb798d6a0ac5e6c030f3b8c657b63178f468bbe0d1b246a5

Author: PastaPastaPasta

Makefile.am

@@ -53,8 +53,8 @@ DIST_SHARE = \
   $(top_srcdir)/share/genbuild.sh \
   $(top_srcdir)/share/rpcauth
 
-BIN_CHECKS=$(top_srcdir)/contrib/devtools/symbol-check.py \
-           $(top_srcdir)/contrib/devtools/security-check.py \
+BIN_CHECKS=$(top_srcdir)/contrib/guix/symbol-check.py \
+           $(top_srcdir)/contrib/guix/security-check.py \
            $(top_srcdir)/contrib/devtools/utils.py
 
 WINDOWS_PACKAGING = $(top_srcdir)/share/pixmaps/dash.ico \
@@ -321,17 +321,3 @@ clean-local: clean-docs
 	rm -rf coverage_percent.txt test_dash.coverage/ total.coverage/ fuzz.coverage/ test/tmp/ cache/ $(OSX_APP)
 	rm -rf test/functional/__pycache__ test/functional/test_framework/__pycache__ test/cache share/rpcauth/__pycache__
 	rm -rf dist/
-
-test-security-check:
-if TARGET_DARWIN
-	$(AM_V_at) CXX='$(CXX)' CXXFLAGS='$(CXXFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_MACHO
-	$(AM_V_at) CXX='$(CXX)' CXXFLAGS='$(CXXFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_MACHO
-endif
-if TARGET_WINDOWS
-	$(AM_V_at) CXX='$(CXX)' CXXFLAGS='$(CXXFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_PE
-	$(AM_V_at) CXX='$(CXX)' CXXFLAGS='$(CXXFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_PE
-endif
-if TARGET_LINUX
-	$(AM_V_at) CXX='$(CXX)' CXXFLAGS='$(CXXFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_ELF
-	$(AM_V_at) CXX='$(CXX)' CXXFLAGS='$(CXXFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_ELF
-endif

ci/dash/build_src.sh

@@ -57,7 +57,3 @@ fi
 if [ "${RUN_TIDY}" = "true" ] && [ "${GITHUB_ACTIONS}" != "true" ]; then
   "${BASE_ROOT_DIR}/ci/dash/lint-tidy.sh"
 fi
-
-if [ "$RUN_SECURITY_TESTS" = "true" ]; then
-  make test-security-check
-fi

ci/test/00_setup_env.sh

@@ -39,7 +39,6 @@ export USE_BUSY_BOX=${USE_BUSY_BOX:-false}
 export RUN_UNIT_TESTS=${RUN_UNIT_TESTS:-true}
 export RUN_FUNCTIONAL_TESTS=${RUN_FUNCTIONAL_TESTS:-true}
 export RUN_TIDY=${RUN_TIDY:-false}
-export RUN_SECURITY_TESTS=${RUN_SECURITY_TESTS:-false}
 # By how much to scale the test_runner timeouts (option --timeout-factor).
 # This is needed because some ci machines have slow CPU or disk, so sanitizers
 # might be slow or a reindex might be waiting on disk IO.

ci/test/00_setup_env_mac_native_x86_64.sh

@@ -15,5 +15,3 @@ export CI_OS_NAME="macos"
 export NO_DEPENDS=1
 export OSX_SDK=""
 export CCACHE_MAXSIZE=300M
-
-export RUN_SECURITY_TESTS="true"

ci/test/00_setup_env_win64.sh

@@ -11,7 +11,6 @@ export HOST=x86_64-w64-mingw32
 export DPKG_ADD_ARCH="i386"
 export PACKAGES="python3 nsis g++-mingw-w64-x86-64-posix wine-binfmt wine64 wine32 file"
 export RUN_FUNCTIONAL_TESTS=false
-export RUN_SECURITY_TESTS="false"
 export GOAL="deploy"
 # Prior to 11.0.0, the mingw-w64 headers were missing noreturn attributes, causing warnings when
 # cross-compiling for Windows. https://sourceforge.net/p/mingw-w64/bugs/306/

configure.ac

@@ -815,7 +815,7 @@ case $host in
        AC_MSG_ERROR([windres not found])
      fi
 
-     CORE_CPPFLAGS="$CORE_CPPFLAGS -D_MT -DWIN32 -D_WINDOWS -D_WIN32_WINNT=0x0601 -D_WIN32_IE=0x0501 -DWIN32_LEAN_AND_MEAN"
+     CORE_CPPFLAGS="$CORE_CPPFLAGS -D_MT -DWIN32 -D_WINDOWS -D_WIN32_WINNT=0x0A00 -D_WIN32_IE=0x0A00 -DWIN32_LEAN_AND_MEAN"
      dnl Prevent the definition of min/max macros.
      dnl We always want to use the standard library.
      CORE_CPPFLAGS="$CORE_CPPFLAGS -DNOMINMAX"
@@ -828,8 +828,10 @@ case $host in
      archive_cmds_CXX="\$CC -shared \$libobjs \$deplibs \$compiler_flags -static -o \$output_objdir/\$soname \${wl}--enable-auto-image-base -Xlinker --out-implib -Xlinker \$lib"
      postdeps_CXX=
 
-     dnl We require Windows 7 (NT 6.1) or later
-     AX_CHECK_LINK_FLAG([-Wl,--major-subsystem-version -Wl,6 -Wl,--minor-subsystem-version -Wl,1], [CORE_LDFLAGS="$CORE_LDFLAGS -Wl,--major-subsystem-version -Wl,6 -Wl,--minor-subsystem-version -Wl,1"], [], [$LDFLAG_WERROR])
+     dnl We support Windows 10+, however it's not possible to set these values accordingly,
+     dnl due to a bug in mingw-w64. See https://sourceforge.net/p/mingw-w64/bugs/968/.
+     dnl As a best effort, target Windows 8.
+     AX_CHECK_LINK_FLAG([-Wl,--major-subsystem-version -Wl,6 -Wl,--minor-subsystem-version -Wl,2], [CORE_LDFLAGS="$CORE_LDFLAGS -Wl,--major-subsystem-version -Wl,6 -Wl,--minor-subsystem-version -Wl,2"], [], [$LDFLAG_WERROR])
 
      dnl Avoid the use of aligned vector instructions when building for Windows.
      dnl See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=54412.
@@ -1073,8 +1075,7 @@ if test "$use_hardening" != "no"; then
 
   case $host in
     *mingw*)
-      dnl stack-clash-protection doesn't compile with GCC 10 and earlier.
-      dnl In any case, it is a no-op for Windows.
+      dnl stack-clash-protection is a no-op for Windows.
       dnl See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90458 for more details.
       ;;
     *)
@@ -2054,6 +2055,8 @@ AM_COND_IF([HAVE_DOXYGEN], [AC_CONFIG_FILES([doc/Doxyfile])])
 AC_CONFIG_LINKS([contrib/filter-lcov.py:contrib/filter-lcov.py])
 AC_CONFIG_LINKS([src/.bear-tidy-config:src/.bear-tidy-config])
 AC_CONFIG_LINKS([src/.clang-tidy:src/.clang-tidy])
+AC_CONFIG_LINKS([src/ipc/.clang-tidy:src/ipc/.clang-tidy])
+AC_CONFIG_LINKS([src/test/.clang-tidy:src/test/.clang-tidy])
 AC_CONFIG_LINKS([test/functional/test_runner.py:test/functional/test_runner.py])
 AC_CONFIG_LINKS([test/fuzz/test_runner.py:test/fuzz/test_runner.py])
 AC_CONFIG_LINKS([test/util/test_runner.py:test/util/test_runner.py])

contrib/devtools/README.md

@@ -171,35 +171,6 @@ optimize-pngs.py
 A script to optimize png files in the dash
 repository (requires pngcrush).
 
-security-check.py and test-security-check.py
-============================================
-
-Perform basic security checks on a series of executables.
-
-symbol-check.py
-===============
-
-A script to check that release executables only contain
-certain symbols and are only linked against allowed libraries.
-
-For Linux this means checking for allowed gcc, glibc and libstdc++ version symbols.
-This makes sure they are still compatible with the minimum supported distribution versions.
-
-For macOS and Windows we check that the executables are only linked against libraries we allow.
-
-Example usage:
-
-    find ../path/to/executables -type f -executable | xargs python3 contrib/devtools/symbol-check.py
-
-If no errors occur the return value will be 0 and the output will be empty.
-
-If there are any errors the return value will be 1 and output like this will be printed:
-
-    .../64/test_dash: symbol memcpy from unsupported version GLIBC_2.14
-    .../64/test_dash: symbol __fdelt_chk from unsupported version GLIBC_2.15
-    .../64/test_dash: symbol std::out_of_range::~out_of_range() from unsupported version GLIBCXX_3.4.15
-    .../64/test_dash: symbol _ZNSt8__detail15_List_nod from unsupported version GLIBCXX_3.4.15
-
 update-translations.py
 ======================