Skip to content

build: update monero submodule to add default device locking [wip] #120

build: update monero submodule to add default device locking [wip]

build: update monero submodule to add default device locking [wip] #120

Workflow file for this run

name: Build
on:
push:
branches: [ master ]
tags: [ 'v*' ]
pull_request:
branches:
- master
workflow_dispatch:
permissions:
contents: read
jobs:
ubuntu:
name: ${{ matrix.arch }}
runs-on: ${{ matrix.os }}
# build in old-distro containers so the libraries run on older glibc;
# arm64 uses debian:12 for a binutils that can link randomx aarch64 relocations
container: ${{ matrix.container }}
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-24.04
container: debian:11
arch: linux-x86_64
march: x86-64
filearch: x86-64
glibc_floor: GLIBC_2.31
- os: ubuntu-24.04-arm
container: debian:12
arch: linux-arm64
march: armv8-a
filearch: aarch64
glibc_floor: GLIBC_2.36
steps:
- name: Install git
run: |
apt update
apt install -y git ca-certificates
git config --global --add safe.directory '*'
- name: Checkout repository
uses: actions/checkout@v5
with:
submodules: recursive
- name: Install dependencies
run: |
apt install -y build-essential cmake pkg-config file perl wget libzmq3-dev libunbound-dev libsodium-dev libunwind-dev liblzma-dev libreadline-dev libexpat1-dev libpgm-dev libhidapi-dev libusb-1.0-0-dev libprotobuf-dev protobuf-compiler libudev-dev python3 ccache git curl autoconf libtool gperf bison flex nettle-dev libevent-dev
# record versions of the distro libraries that get statically linked into the shipped binary
dpkg -s libsodium-dev libprotobuf-dev | grep -E '^(Package|Version)'
- name: Install openssl
run: |
# distro openssl 1.1 is near end of life; build the current LTS statically (/etc/ssl matches most distros' CA layout)
wget https://github.com/openssl/openssl/releases/download/openssl-3.5.7/openssl-3.5.7.tar.gz
echo "a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8 openssl-3.5.7.tar.gz" | sha256sum -c
tar xzf openssl-3.5.7.tar.gz
cd openssl-3.5.7
./config --prefix=/usr/local --openssldir=/etc/ssl --libdir=lib no-shared no-tests -fPIC
make -j3
make install_sw
- name: Install expat
run: |
wget https://github.com/libexpat/libexpat/releases/download/R_2_7_1/expat-2.7.1.tar.bz2
echo "45c98ae1e9b5127325d25186cf8c511fa814078e9efeae7987a574b482b79b3d expat-2.7.1.tar.bz2" | sha256sum -c
tar -xf expat-2.7.1.tar.bz2
cd expat-2.7.1
./configure --enable-static --disable-shared --with-pic
make
make install
- name: Install unbound
run: |
wget https://www.nlnetlabs.nl/downloads/unbound/unbound-1.22.0.tar.gz
echo "c5dd1bdef5d5685b2cedb749158dd152c52d44f65529a34ac15cd88d4b1b3d43 unbound-1.22.0.tar.gz" | sha256sum -c
tar xzf unbound-1.22.0.tar.gz
cd unbound-1.22.0
./configure --with-libexpat=/usr/local --with-ssl=/usr/local --enable-static --disable-shared --with-pic
make
make install
- name: Install libusb
run: |
wget https://github.com/libusb/libusb/releases/download/v1.0.27/libusb-1.0.27.tar.bz2
echo "ffaa41d741a8a3bee244ac8e54a72ea05bf2879663c098c82fc5757853441575 libusb-1.0.27.tar.bz2" | sha256sum -c
tar -xf libusb-1.0.27.tar.bz2
cd libusb-1.0.27
./configure --disable-shared --disable-udev --with-pic
make
make install
- name: Install hidapi
run: |
wget https://github.com/libusb/hidapi/archive/refs/tags/hidapi-0.14.0.tar.gz
echo "a5714234abe6e1f53647dd8cba7d69f65f71c558b7896ed218864ffcf405bcbd hidapi-0.14.0.tar.gz" | sha256sum -c
tar xzf hidapi-0.14.0.tar.gz
cd hidapi-hidapi-0.14.0
cmake -B build -DBUILD_SHARED_LIBS=OFF -DHIDAPI_WITH_HIDRAW=OFF -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DCMAKE_POLICY_VERSION_MINIMUM=3.5 .
cmake --build build
cmake --install build
- name: Install boost
run: |
# PIC static boost, same version on all platforms (no distro boost so headers and archives match)
wget https://archives.boost.io/release/1.85.0/source/boost_1_85_0.tar.bz2
echo "7009fe1faa1697476bdc7027703a2badb84e849b7b0baad5086b087b971f8617 boost_1_85_0.tar.bz2" | sha256sum -c
tar xf boost_1_85_0.tar.bz2
cd boost_1_85_0
./bootstrap.sh --with-libraries=chrono,date_time,filesystem,locale,program_options,regex,serialization,system,thread
./b2 -j3 cxxflags=-fPIC cflags=-fPIC link=static runtime-link=shared boost.locale.icu=off install
- name: Build monero-project
run: |
cd external/monero-project
mkdir -p build/release
cd build/release
cmake -DSTATIC=ON -DBUILD_64=ON -DARCH="${{ matrix.march }}" -DCMAKE_BUILD_TYPE=Release -DUSE_DEVICE_TREZOR=OFF ../../
make -j3 wallet cryptonote_protocol
cd ../../../../
- name: Build monero-cpp libraries
run: |
mkdir -p build
cd build
cmake -DSTATIC=ON -DBOOST_ROOT=/usr/local -DBoost_NO_SYSTEM_PATHS=ON -DBUILD_SAMPLE=ON -DBUILD_SCRATCHPAD=ON -DBUILD_TESTS=ON ..
cmake --build . -j3
cd ..
- name: Verify libraries
run: |
file build/libmonero-cpp.so | grep -q '${{ matrix.filearch }}' || { echo "wrong architecture: $(file build/libmonero-cpp.so)"; exit 1; }
ldd build/libmonero-cpp.so
floor=$(objdump -T build/libmonero-cpp.so | grep -o 'GLIBC_[0-9.]*' | sort -uV | tail -1)
echo "glibc floor: $floor"
test "$(printf '%s\n${{ matrix.glibc_floor }}\n' "$floor" | sort -V | tail -1)" = "${{ matrix.glibc_floor }}" || { echo "glibc floor $floor exceeds ${{ matrix.glibc_floor }}"; exit 1; }
if ldd build/libmonero-cpp.so | grep -vE 'linux-vdso|ld-linux|libc\.so|libm\.so|libpthread\.so|librt\.so|libdl\.so'; then
echo "library is not standalone: unexpected dynamic dependencies above"; exit 1
fi
nm -D --defined-only build/libmonero-cpp.so | grep -q monero_wallet_full || { echo "missing monero-cpp api exports"; exit 1; }
# --exclude-libs hides the static closure; check for leaked dependency symbols
if nm -D --defined-only build/libmonero-cpp.so | grep -E ' (SSL_|EVP_|BN_)'; then
echo "static closure symbols are exported"; exit 1
fi
nm build/libmonero-cpp.a | grep -q monero_wallet_full || { echo "missing api in static library"; exit 1; }
- name: Upload monero-cpp shared library
uses: actions/upload-artifact@v7
with:
name: libmonero-cpp-${{ matrix.arch }}
path: build/libmonero-cpp.so
- name: Upload monero-cpp static library
uses: actions/upload-artifact@v7
with:
name: libmonero-cpp-${{ matrix.arch }}-static
path: build/libmonero-cpp.a
windows:
name: windows
runs-on: windows-latest
defaults:
run:
shell: msys2 {0}
steps:
- name: Checkout repository
uses: actions/checkout@v5
with:
submodules: recursive
- name: Setup MSYS2 MINGW64
uses: msys2/setup-msys2@v2
with:
msystem: MINGW64
update: true
install: >-
mingw-w64-x86_64-toolchain
mingw-w64-x86_64-cmake
mingw-w64-x86_64-openssl
mingw-w64-x86_64-zeromq
mingw-w64-x86_64-libsodium
mingw-w64-x86_64-hidapi
mingw-w64-x86_64-unbound
mingw-w64-x86_64-protobuf
mingw-w64-x86_64-libusb
mingw-w64-x86_64-expat
mingw-w64-x86_64-ntldd
git
make
gettext
base-devel
wget
- name: Install ICU v75.1
shell: msys2 {0}
run: |
wget https://repo.msys2.org/mingw/mingw64/mingw-w64-x86_64-icu-75.1-2-any.pkg.tar.zst
echo "bf57882d43efcdfd746463613ea982c69b64aa4ba9bed4cb24c02a81ad06c3a9 mingw-w64-x86_64-icu-75.1-2-any.pkg.tar.zst" | sha256sum -c
pacman -U --noconfirm mingw-w64-x86_64-icu-75.1-2-any.pkg.tar.zst
- name: Install boost v1.87.0
shell: msys2 {0}
run: |
wget https://repo.msys2.org/mingw/mingw64/mingw-w64-x86_64-boost-1.87.0-3-any.pkg.tar.zst
echo "241919a5885a9270d0e0937e71cf5e146c2a8cabecc2714f09248350181cb1b6 mingw-w64-x86_64-boost-1.87.0-3-any.pkg.tar.zst" | sha256sum -c
pacman -U --noconfirm mingw-w64-x86_64-boost-1.87.0-3-any.pkg.tar.zst
# record versions of the msys2 libraries that get statically linked into the shipped binary
pacman -Q | grep mingw-w64 | sort
- name: Build monero-project
shell: msys2 {0}
run: |
cd external/monero-project
mkdir -p build/release
cd build/release
cmake -G "MSYS Makefiles" \
-D STATIC=ON \
-D ARCH="x86-64" \
-D BUILD_64=ON \
-D CMAKE_BUILD_TYPE=Release \
-D BUILD_TAG="win-x64" \
-D CMAKE_TOOLCHAIN_FILE="../../cmake/64-bit-toolchain.cmake" \
-D MSYS2_FOLDER=$(cd $MINGW_PREFIX/.. && pwd -W) \
-D USE_DEVICE_TREZOR=OFF \
../../
make wallet cryptonote_protocol
- name: Build monero-cpp libraries
shell: msys2 {0}
run: |
mkdir -p build
cd build
cmake -DSTATIC=ON -DBUILD_SAMPLE=ON -DBUILD_SCRATCHPAD=ON -DBUILD_TESTS=ON ..
cmake --build .
cd ..
- name: Verify libraries
shell: msys2 {0}
run: |
objdump -f build/libmonero-cpp.dll | grep -q "x86-64" || { echo "wrong architecture"; exit 1; }
ntldd build/libmonero-cpp.dll
if ntldd build/libmonero-cpp.dll | grep -iE "mingw|msys|not found"; then
echo "library is not standalone: unexpected dynamic dependencies above"; exit 1
fi
# allow-list imports by name so a dependency resolving outside msys2 paths still fails
if ntldd build/libmonero-cpp.dll | grep -ivE "ntdll|kernel32|kernelbase|msvcrt|ws2_32|advapi32|user32|shell32|ole32|oleaut32|rpcrt4|crypt32|bcrypt|secur32|dnsapi|iphlpapi|setupapi|cfgmgr32|gdi32|winmm|userenv|version\.dll|api-ms-win" | grep -iE "\.dll"; then
echo "library is not standalone: unexpected dynamic dependencies above"; exit 1
fi
objdump -p build/libmonero-cpp.dll | grep -q monero_wallet_full || { echo "missing monero-cpp api exports"; exit 1; }
# --exclude-libs hides the static closure; check for leaked dependency symbols
if objdump -p build/libmonero-cpp.dll | grep -E '\s(SSL_|EVP_|BN_)'; then
echo "static closure symbols are exported"; exit 1
fi
nm build/libmonero-cpp.a | grep -q monero_wallet_full || { echo "missing api in static library"; exit 1; }
- name: Upload monero-cpp shared library
uses: actions/upload-artifact@v7
with:
name: libmonero-cpp-windows-x86_64
path: |
build/libmonero-cpp.dll
build/libmonero-cpp.dll.a
- name: Upload monero-cpp static library
uses: actions/upload-artifact@v7
with:
name: libmonero-cpp-windows-x86_64-static
path: build/libmonero-cpp.a
mac-os:
name: ${{ matrix.arch }}
runs-on: ${{ matrix.os }}
env:
MACOSX_DEPLOYMENT_TARGET: "11.0"
strategy:
fail-fast: false
matrix:
include:
- os: macos-15
arch: mac-arm64
march: armv8-a
filearch: arm64
- os: macos-15-intel
arch: mac-x86_64
march: x86-64
filearch: x86_64
steps:
- name: Checkout repository
uses: actions/checkout@v5
with:
submodules: recursive
- name: Install dependencies
run: |
HOMEBREW_NO_AUTO_UPDATE=1 brew install libsodium openssl zmq libpgm miniupnpc expat libunwind-headers protobuf unbound libevent libnghttp2
# record versions of the brew libraries that get statically linked into the shipped binary
brew list --versions | sort
- name: Install hidapi (static)
run: |
# brew ships no static hidapi; build from source so the library is standalone
curl -fsSLO https://github.com/libusb/hidapi/archive/refs/tags/hidapi-0.14.0.tar.gz
echo "a5714234abe6e1f53647dd8cba7d69f65f71c558b7896ed218864ffcf405bcbd hidapi-0.14.0.tar.gz" | shasum -a 256 -c
tar xzf hidapi-0.14.0.tar.gz
cd hidapi-hidapi-0.14.0
cmake -B build -DBUILD_SHARED_LIBS=OFF -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DCMAKE_POLICY_VERSION_MINIMUM=3.5 .
cmake --build build
sudo cmake --install build
- name: Install boost
run: |
# brew ships no static boost; build from source (also keeps its objects at the 11.0 deployment target)
curl -fsSLO https://archives.boost.io/release/1.85.0/source/boost_1_85_0.tar.bz2
echo "7009fe1faa1697476bdc7027703a2badb84e849b7b0baad5086b087b971f8617 boost_1_85_0.tar.bz2" | shasum -a 256 -c
tar xf boost_1_85_0.tar.bz2
cd boost_1_85_0
./bootstrap.sh --with-libraries=chrono,date_time,filesystem,locale,program_options,regex,serialization,system,thread
./b2 -j3 cxxflags=-fPIC cflags=-fPIC link=static runtime-link=shared boost.locale.icu=off
sudo -E ./b2 -j3 cxxflags=-fPIC cflags=-fPIC link=static runtime-link=shared boost.locale.icu=off install
- name: Build monero-project
run: |
cd external/monero-project
mkdir -p build/release
cd build/release
cmake -DSTATIC=ON -DBUILD_64=ON -DARCH="${{ matrix.march }}" -DCMAKE_BUILD_TYPE=Release -DUSE_DEVICE_TREZOR=OFF ../../
make -j3 wallet cryptonote_protocol
cd ../../../../
- name: Build monero-cpp libraries
run: |
mkdir -p build
cd build
cmake -DSTATIC=ON -DBOOST_ROOT=/usr/local -DBoost_NO_SYSTEM_PATHS=ON -DBUILD_SAMPLE=ON -DBUILD_SCRATCHPAD=ON -DBUILD_TESTS=ON ..
cmake --build . -j3
cd ..
- name: Verify libraries
run: |
lipo -archs build/libmonero-cpp.dylib | grep -qx '${{ matrix.filearch }}' || { echo "wrong architecture: $(lipo -archs build/libmonero-cpp.dylib)"; exit 1; }
otool -L build/libmonero-cpp.dylib
otool -l build/libmonero-cpp.dylib | grep minos
otool -l build/libmonero-cpp.dylib | grep -q 'minos 11.0' || { echo "unexpected macOS deployment target"; exit 1; }
if otool -L build/libmonero-cpp.dylib | tail -n +2 | grep -vE '@rpath/libmonero-cpp\.dylib|/usr/lib/|/System/Library/'; then
echo "library is not standalone: unexpected dynamic dependencies above"; exit 1
fi
nm -gU build/libmonero-cpp.dylib | grep -q monero_wallet_full || { echo "missing monero-cpp api exports"; exit 1; }
nm build/libmonero-cpp.a | grep -q monero_wallet_full || { echo "missing api in static library"; exit 1; }
- name: Upload monero-cpp shared library
uses: actions/upload-artifact@v7
with:
name: libmonero-cpp-${{ matrix.arch }}
path: build/libmonero-cpp.dylib
- name: Upload monero-cpp static library
uses: actions/upload-artifact@v7
with:
name: libmonero-cpp-${{ matrix.arch }}-static
path: build/libmonero-cpp.a
release:
name: release
runs-on: ubuntu-24.04
needs: [ubuntu, windows, mac-os]
if: startsWith(github.ref, 'refs/tags/')
permissions:
contents: write
steps:
- name: Download artifacts
uses: actions/download-artifact@v7
with:
pattern: libmonero-cpp-*
path: artifacts
- name: Package platform archives
run: |
mkdir release
for arch in linux-x86_64 linux-arm64 mac-arm64 mac-x86_64 windows-x86_64; do
staging="monero-cpp-$GITHUB_REF_NAME-$arch"
mkdir "$staging"
cp "artifacts/libmonero-cpp-$arch"/* "artifacts/libmonero-cpp-$arch-static"/* "$staging"/
if [ "$arch" = windows-x86_64 ]; then zip -qr "release/$staging.zip" "$staging"; else tar czf "release/$staging.tar.gz" "$staging"; fi
done
ls -l release
- name: Attach archives to release
uses: softprops/action-gh-release@v2
with:
name: monero-cpp-${{ github.ref_name }}
files: release/*
generate_release_notes: true
draft: true # publish this draft after reviewing the notes; a separate release would have no assets