4d2d2a7bc3
- the windows build broke with 184e122c36
- upstream fix being pulled in is https://github.com/pyinstaller/pyinstaller/pull/6701
log excerpt of failed build:
```
💬 INFO: Installing PyInstaller.
Processing c:\electrum\contrib\build-wine\.cache\win32\pyinstaller
Preparing metadata (pyproject.toml) ... error
error: subprocess-exited-with-error
× Preparing metadata (pyproject.toml) did not run successfully.
│ exit code: 1
╰─> [42 lines of output]
Traceback (most recent call last):
File "C:\python3\lib\site-packages\pip\_vendor\pep517\in_process\_in_process.py", line 363, in <
module>
main()
File "C:\python3\lib\site-packages\pip\_vendor\pep517\in_process\_in_process.py", line 345, in m
ain
json_out['return_val'] = hook(**hook_input['kwargs'])
File "C:\python3\lib\site-packages\pip\_vendor\pep517\in_process\_in_process.py", line 164, in p
repare_metadata_for_build_wheel
return hook(metadata_directory, config_settings)
File "C:\python3\lib\site-packages\setuptools\build_meta.py", line 188, in prepare_metadata_for_
build_wheel
self.run_setup()
File "C:\python3\lib\site-packages\setuptools\build_meta.py", line 281, in run_setup
super(_BuildMetaLegacyBackend,
File "C:\python3\lib\site-packages\setuptools\build_meta.py", line 174, in run_setup
exec(compile(code, __file__, 'exec'), locals())
File "setup.py", line 249, in <module>
setup(
File "C:\python3\lib\site-packages\setuptools\__init__.py", line 87, in setup
return distutils.core.setup(**attrs)
File "C:\python3\lib\site-packages\setuptools\_distutils\core.py", line 122, in setup
dist.parse_config_files()
File "C:\python3\lib\site-packages\setuptools\dist.py", line 850, in parse_config_files
setupcfg.parse_configuration(
File "C:\python3\lib\site-packages\setuptools\config\setupcfg.py", line 167, in parse_configurat
ion
meta.parse()
File "C:\python3\lib\site-packages\setuptools\config\setupcfg.py", line 446, in parse
section_parser_method(section_options)
File "C:\python3\lib\site-packages\setuptools\config\setupcfg.py", line 417, in parse_section
self[name] = value
File "C:\python3\lib\site-packages\setuptools\config\setupcfg.py", line 238, in __setitem__
value = parser(value)
File "C:\python3\lib\site-packages\setuptools\config\setupcfg.py", line 552, in _parse_version
return expand.version(self._parse_attr(value, self.package_dir, self.root_dir))
File "C:\python3\lib\site-packages\setuptools\config\setupcfg.py", line 372, in _parse_attr
return expand.read_attr(attr_desc, package_dir, root_dir)
File "C:\python3\lib\site-packages\setuptools\config\expand.py", line 194, in read_attr
module = _load_spec(spec, module_name)
File "C:\python3\lib\site-packages\setuptools\config\expand.py", line 214, in _load_spec
spec.loader.exec_module(module) # type: ignore
File "<frozen importlib._bootstrap_external>", line 850, in exec_module
File "<frozen importlib._bootstrap>", line 228, in _call_with_frames_removed
File "C:\electrum\contrib\build-wine\.cache\win32\pyinstaller\PyInstaller.py", line 15, in <modu
le>
from PyInstaller.__main__ import run
ModuleNotFoundError: No module named 'PyInstaller.__main__'; 'PyInstaller' is not a package
[end of output]
note: This error originates from a subprocess, and is likely not a problem with pip.
error: metadata-generation-failed
× Encountered error while generating package metadata.
╰─> See above for output.
note: This is an issue with the package mentioned above, not pip.
hint: See above for details.
🗯 ERROR: prepare-wine failed
```
Windows binaries
✓ These binaries should be reproducible, meaning you should be able to generate binaries that match the official releases.
This assumes an Ubuntu (x86_64) host, but it should not be too hard to adapt to another similar system.
-
Install Docker
See
contrib/docker_notes.md.Note: older versions of Docker might not work well (see #6971). If having problems, try to upgrade to at least
docker 20.10. -
Build Windows binaries
$ ./build.shIf you want reproducibility, try instead e.g.:
$ ELECBUILD_COMMIT=HEAD ELECBUILD_NOCACHE=1 ./build.sh -
The generated binaries are in
./contrib/build-wine/dist.
Code Signing
Electrum Windows builds are signed with a Microsoft Authenticode™ code signing certificate in addition to the GPG-based signatures.
The advantage of using Authenticode is that Electrum users won't receive a Windows SmartScreen warning when starting it.
The release signing procedure involves a signer (the holder of the certificate/key) and one or multiple trusted verifiers:
| Signer | Verifier |
|---|---|
Build .exe files using make_win.sh |
|
Sign .exe with ./sign.sh |
|
| Upload signed files to download server | |
Build .exe files using make_win.sh |
|
Compare files using unsign.sh |
|
Sign .exe file using gpg -b |
| Signer and verifiers: |
|---|
Upload signatures to 'electrum-signatures' repo, as $version/$filename.$builder.asc |
Verify Integrity of signed binary
Every user can verify that the official binary was created from the source code in this repository. To do so, the Authenticode signature needs to be stripped since the signature is not reproducible.
This procedure removes the differences between the signed and unsigned binary:
- Remove the signature from the signed binary using osslsigncode or signtool.
- Set the COFF image checksum for the signed binary to 0x0. This is necessary because pyinstaller doesn't generate a checksum.
- Append null bytes to the unsigned binary until the byte count is a multiple of 8.
The script unsign.sh performs these steps.
FAQ
How to investigate diff between binaries if reproducibility fails?
pyi-archive_viewer is needed, for that run $ pip install pyinstaller.
As a first pass overview, run:
pyi-archive_viewer -l electrum-*.exe1 > f1
pyi-archive_viewer -l electrum-*.exe2 > f2
diff f1 f2 > d
cat d
Then investigate manually:
$ pyi-archive_viewer electrum-*.exe1
? help