From 2541d06b6a91850e5aad537045259ef93b26a8c5 Mon Sep 17 00:00:00 2001 From: everoddandeven Date: Sat, 7 Nov 2026 02:51:02 +0100 Subject: [PATCH 1/3] release: look at more runs of main to find the builds of the tag gh run list shows the 20 latest runs by default, and the release looks there for the successful run of each workflow on the commit that is tagged. Main gets a run of each workflow for every push, so a commit that is not among the latest few, say after a series of docs commits, was reported as never built. Look at the latest 200. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2ea7677..0b54000 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -45,7 +45,7 @@ jobs: for wf in build-macos.yml build-windows.yml test.yml; do key=$(echo "${wf%.*}" | tr '-' '_') run_id=$(gh run list --repo "${{ github.repository }}" --workflow "$wf" \ - --branch main --status success --json databaseId,headSha \ + --branch main --status success --limit 200 --json databaseId,headSha \ --jq ".[] | select(.headSha == \"${{ github.sha }}\") | .databaseId" | head -n1) if [ -z "$run_id" ]; then echo "::error::No successful $wf run on main for commit ${{ github.sha }}. Push to main and wait for it to build before tagging." From 74d4fe9326a6899277f4fff35e70b87698dec0f8 Mon Sep 17 00:00:00 2001 From: everoddandeven Date: Sat, 7 Nov 2026 02:51:13 +0100 Subject: [PATCH 2/3] release: publish the SHA256 sums of the assets The draft release has 12 deb packages, the wheels of macOS and Windows and the coverage report, and nothing to check a download against. Add a SHA256SUMS file, which sha256sum -c reads. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0b54000..1fb3002 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -113,6 +113,11 @@ jobs: mkdir -p ../release-assets zip -r ../release-assets/coverage_monero_cpp_html.zip coverage_monero_cpp_html + # to check a download against what the workflow published: sha256sum -c SHA256SUMS + - name: Checksum the assets + working-directory: release-assets + run: sha256sum -- *.deb *.whl *.zip > SHA256SUMS + - name: Create draft release env: GH_TOKEN: ${{ github.token }} @@ -122,4 +127,4 @@ jobs: --draft \ --title "${{ github.ref_name }}" \ --generate-notes \ - release-assets/*.deb release-assets/*.whl release-assets/*.zip + release-assets/*.deb release-assets/*.whl release-assets/*.zip release-assets/SHA256SUMS From b0a751f880e1ae710ffc7cba472c99b9847e52c7 Mon Sep 17 00:00:00 2001 From: everoddandeven Date: Sat, 7 Nov 2026 02:51:46 +0100 Subject: [PATCH 3/3] build: export only PyInit_monero from the module The binaries are already stripped of debug information and local symbols, on linux by dh_strip and by pybind11 on the other platforms, but the linker still exports every symbol of the static libraries that go into the module, those of monero-project and monero-cpp: 27330 dynamic symbols in the deb of Ubuntu 24.04, from 6919 to 10911 in the macOS wheels and 1100 in the Windows one, where a python module needs one. They are a part of the size of the module and can clash with the symbols that another extension of the same process brings, a boost or a protobuf for one. Hide the ones of the archives with --exclude-libs ALL on linux and on mingw, and export only PyInit_monero on macOS, where -dead_strip then also drops what is no longer reachable. The effect is the one wanted on a small library made of a static one, but it has not been measured on the module, which a build of CI will tell. Co-Authored-By: Claude Sonnet 5.5 --- CMakeLists.txt | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index c59ceca..2a97f3e 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -351,4 +351,14 @@ set(MONERO_PYTHON_LINK_LIBS target_link_libraries(monero PRIVATE ${MONERO_PYTHON_LINK_LIBS}) +# A python module has to export PyInit_monero and nothing else. Left to itself the linker also exports every +# symbol of the static libraries it takes in, those of monero-project and monero-cpp: about 27000 on linux, from +# 7000 to 11000 on macOS and 1100 on windows. They make the module bigger and can clash with the symbols that +# another extension of the same process brings, a boost or a protobuf for one. +if(APPLE) + target_link_options(monero PRIVATE -Wl,-dead_strip -Wl,-exported_symbol,_PyInit_monero) +elseif(CMAKE_CXX_COMPILER_ID STREQUAL "GNU" OR CMAKE_CXX_COMPILER_ID MATCHES "Clang") + target_link_options(monero PRIVATE -Wl,--exclude-libs,ALL -Wl,--gc-sections) +endif() + install(TARGETS monero DESTINATION .)