chore: release v21.1.1

.github/workflows/guix-build.yml

@@ -1,15 +1,20 @@
 name: Guix Build
 
+permissions:
+  packages: write
+  id-token: write
+  attestations: write
+
 on:
-  pull_request:
-    types: [ labeled ]
-  workflow_dispatch:
+  pull_request_target:
+  push:
 
 jobs:
-  build:
-    runs-on: [ "self-hosted", "linux", "x64", "ubuntu-core" ]
-    if: contains(github.event.pull_request.labels.*.name, 'guix-build')
-    timeout-minutes: 480
+  build-image:
+    runs-on: ubuntu-latest
+    outputs:
+      image-tag: ${{ steps.prepare.outputs.image-tag }}
+      repo-name: ${{ steps.prepare.outputs.repo-name }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -22,37 +27,72 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Commit variables
-        id: dockerfile
+        id: prepare
         run: |
           echo "hash=$(sha256sum ./dash/contrib/containers/guix/Dockerfile | cut -d ' ' -f1)" >> $GITHUB_OUTPUT
           echo "host_user_id=$(id -u)" >> $GITHUB_OUTPUT
           echo "host_group_id=$(id -g)" >> $GITHUB_OUTPUT
+          BRANCH_NAME=$(echo "${GITHUB_REF##*/}" | tr '[:upper:]' '[:lower:]')
+          REPO_NAME=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
+          echo "::set-output name=image-tag::${BRANCH_NAME}"
+          echo "::set-output name=repo-name::${REPO_NAME}"
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: ${{ github.workspace }}/dash
           build-args: |
-            USER_ID=${{ steps.dockerfile.outputs.host_user_id }}
-            GROUP_ID=${{ steps.dockerfile.outputs.host_group_id }}
+            USER_ID=${{ steps.prepare.outputs.host_user_id }}
+            GROUP_ID=${{ steps.prepare.outputs.host_group_id }}
           build-contexts: |
             docker_root=${{ github.workspace }}/dash/contrib/containers/guix
           file: ./dash/contrib/containers/guix/Dockerfile
-          load: true
-          tags: guix_ubuntu:latest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          push: true
+          tags: |
+            ghcr.io/${{ steps.prepare.outputs.repo-name }}/dashcore-guix-builder:${{ steps.prepare.outputs.image-tag }}
+            ghcr.io/${{ steps.prepare.outputs.repo-name }}/dashcore-guix-builder:latest
+          cache-from: type=registry,ref=ghcr.io/${{ steps.prepare.outputs.repo-name }}/dashcore-guix-builder:latest
+          cache-to: type=inline,mode=max
+
+  build:
+    needs: build-image
+    # runs-on: [ "self-hosted", "linux", "x64", "ubuntu-core" ]
+    runs-on: ubuntu-latest
+#    if: ${{ contains(github.event.pull_request.labels.*.name, 'guix-build') }}
+    strategy:
+      matrix:
+        build_target: [x86_64-linux-gnu, arm-linux-gnueabihf, aarch64-linux-gnu, riscv64-linux-gnu, x86_64-w64-mingw32, x86_64-apple-darwin, arm64-apple-darwin]
+
+    timeout-minutes: 480
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: dash
+          fetch-depth: 0
 
-      - name: Restore Guix cache and depends
+      - name: Cache Guix and depends
         id: guix-cache-restore
-        uses: actions/cache/restore@v3
+        uses: actions/cache@v3
         with:
           path: |
             ${{ github.workspace }}/.cache
             ${{ github.workspace }}/dash/depends/built
             ${{ github.workspace }}/dash/depends/sources
             ${{ github.workspace }}/dash/depends/work
-          key: ${{ runner.os }}-guix
+            /gnu/store
+          key: ${{ runner.os }}-guix-${{ matrix.build_target }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-guix-${{ matrix.build_target }}
+            ${{ runner.os }}-guix-
 
       - name: Create .cache folder if missing
         if: steps.guix-cache-restore.outputs.cache-hit != 'true'
@@ -67,8 +107,8 @@ jobs:
             -v ${{ github.workspace }}/dash:/src/dash \
             -v ${{ github.workspace }}/.cache:/home/ubuntu/.cache \
             -w /src/dash \
-            guix_ubuntu:latest && \
-          docker exec guix-daemon bash -c '/usr/local/bin/guix-start'
+            ghcr.io/${{ needs.build-image.outputs.repo-name }}/dashcore-guix-builder:${{ needs.build-image.outputs.image-tag }} && \
+          docker exec guix-daemon bash -c 'HOSTS=${{ matrix.build_target }} /usr/local/bin/guix-start'
 
       - name: Ensure build passes
         run: |
@@ -77,17 +117,19 @@ jobs:
             exit 1
           fi
 
-      - name: Save Guix cache and depends
-        id: guix-cache-save
-        uses: actions/cache/save@v3
+      - name: Compute SHA256 checksums
+        continue-on-error: true # It will complain on depending on only some hosts
+        run: |
+          HOSTS=${{ matrix.build_target }} ./dash/contrib/containers/guix/scripts/guix-check ${{ github.workspace }}/dash
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
         with:
+          name: guix-artifacts-${{ matrix.build_target }}
           path: |
-            ${{ github.workspace }}/.cache
-            ${{ github.workspace }}/dash/depends/built
-            ${{ github.workspace }}/dash/depends/sources
-            ${{ github.workspace }}/dash/depends/work
-          key: ${{ steps.guix-cache-restore.outputs.cache-primary-key }}
+            ${{ github.workspace }}/dash/guix-build*/output/${{ matrix.build_target }}/
 
-      - name: Compute SHA256 checksums
-        run: |
-          ./dash/contrib/containers/guix/scripts/guix-check ${{ github.workspace }}/dash
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ${{ github.workspace }}/dash/guix-build*/output/${{ matrix.build_target }}/*

configure.ac

@@ -2,7 +2,7 @@ AC_PREREQ([2.69])
 dnl Don't forget to push a corresponding tag when updating any of _CLIENT_VERSION_* numbers
 define(_CLIENT_VERSION_MAJOR, 21)
 define(_CLIENT_VERSION_MINOR, 1)
-define(_CLIENT_VERSION_BUILD, 0)
+define(_CLIENT_VERSION_BUILD, 1)
 define(_CLIENT_VERSION_IS_RELEASE, true)
 define(_COPYRIGHT_YEAR, 2024)
 define(_COPYRIGHT_HOLDERS,[The %s developers])

contrib/builder-keys/kittywhiskers.pgp

@@ -0,0 +1,32 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEZZs7ABYJKwYBBAHaRw8BAQdAxvpS5zLLn9agjKg1bpMyHtKROTC8SLTl3AZm
+b4DKXJq0P0tpdHR5d2hpc2tlcnMgVmFuIEdvZ2ggPDYzMTg5NTMxK2t3dmdAdXNl
+cnMubm9yZXBseS5naXRodWIuY29tPoiaBBMWCABCAhsDBQkDw7iAAheAAhkBFiEE
+lpGHqOdP5AqKSAZ0MM0MBl5cSq0FAmbpq2gFCwkIBwIGFQoJCAsCBRYCAwEAAh4F
+AAoJEDDNDAZeXEqt6D4BALOgavknWXzg3zyBI4rzqS2Qq1qrDl0AVohpYQYJrUZ6
+AP92LejS8DyeR4NZuUeP4gCxL/0wOydz6LkmEefaTvNiD7RIS2l0dHl3aGlza2Vy
+cyBWYW4gR29naCA8NjMxODk1MzEra2l0dHl3aGlza2Vyc0B1c2Vycy5ub3JlcGx5
+LmdpdGh1Yi5jb20+iJcEExYIAD8CGwMFCQPDuIACF4AWIQSWkYeo50/kCopIBnQw
+zQwGXlxKrQUCZumraQULCQgHAgYVCgkICwIFFgIDAQACHgUACgkQMM0MBl5cSq3B
+zAD/T6dYqUtzIuZjIIBXisBMISNTHQxRv1KH3txuN+lCW/UBAIMV6Y41aIqbGnI2
+ADm+WYFsnABokj+mT5GZBuqfEYQEtEdLaXR0eXdoaXNrZXJzIFZhbiBHb2doIDw2
+MDk4OTc0LWtpdHR5d2hpc2tlcnNAdXNlcnMubm9yZXBseS5naXRsYWIuY29tPoiX
+BBMWCAA/AhsDBQkDw7iAAheAFiEElpGHqOdP5AqKSAZ0MM0MBl5cSq0FAmbpq2kF
+CwkIBwIGFQoJCAsCBRYCAwEAAh4FAAoJEDDNDAZeXEqt2D0BAIZOVRQgvP6DZeXc
+ONNZcFGp3mrbumudjsoCCiDTS/PZAP48LFSFBB8NBcXgjj1edktii9AN3JYyW+yF
+60uLMN4NAbQvS2l0dHl3aGlza2VycyBWYW4gR29naCA8a2l0dHl3aGlza2Vyc0Bk
+YXNoLm9yZz6IlwQTFgoAPwIbAwUJA8O4gAIXgBYhBJaRh6jnT+QKikgGdDDNDAZe
+XEqtBQJm6atpBQsJCAcCBhUKCQgLAgUWAgMBAAIeBQAKCRAwzQwGXlxKrSHfAQCU
+Tu3DPWNWj8weotN4NKoShfsMrIEEeKqv1ykLc1K2lwD8CwEBUG69Pl8NFWMElvam
+6wu9OWtOKp9xBkFS+CjM8A60NktpdHR5d2hpc2tlcnMgVmFuIEdvZ2ggPGt3dmdA
+dXNlcnMubm9yZXBseS5naXRodWIuY29tPoiXBBMWCgA/AhsDBQkDw7iAAheAFiEE
+lpGHqOdP5AqKSAZ0MM0MBl5cSq0FAmbpq2kFCwkIBwIGFQoJCAsCBRYCAwEAAh4F
+AAoJEDDNDAZeXEqt4YAA/22FrVJGDOeZVYRNLjFL34+YjXEyTO5dACjZ8jV2/uHD
+AQDB9osQDYr/lDfuMMSPZhufAryHIWBJp/e8AwHwJ65aALg4BGWbOwASCisGAQQB
+l1UBBQEBB0DCbqznf45arlTBDkpS76ineVKFabpOa3vohGKIKJ+5FAMBCAeIfgQY
+FggAJhYhBJaRh6jnT+QKikgGdDDNDAZeXEqtBQJlmzsAAhsMBQkDw7iAAAoJEDDN
+DAZeXEqtUvEBALBrYJ7jRRCwBMBTG2doiFupibGQh2vN46gKSrXzYSG9AQDIXcCJ
+moGvMWiiBz71Wr9JZ7/ZV6rcRE1YXfM06G6gCQ==
+=gtD4
+-----END PGP PUBLIC KEY BLOCK-----