guix: Codesigned Dress Rehearsal Release of `v21.99-guixtest1`

[dongcarl]

Let's use this Issue as a non-IRC place for discussion of our dress rehearsal release of v21.99-guixtest1.

Overall, the process looks like:

0. Check out the v21.99-guixtest1 tag
1. env [ FOO=bar... ] ./contrib/guix/guix-build (add additional env vars as necessary)
2. Codesigners only:
   1. Copy guix-build-v21.99-guixtest1/output/x86_64-apple-darwin18/bitcoin-v21.99-guixtest1-osx-unsigned.tar.gz and guix-build-v21.99-guixtest1/output/x86_64-w64-mingw32/bitcoin-v21.99-guixtest1-win-unsigned.tar.gz to signing computer
   2. Codesign with ./detached-sig-create.sh inside the tarball
   3. Upload contents of signature-{osx,win}.tar.gz to https://github.com/bitcoin-core/bitcoin-detached-sigs (as a new tag)
3. Checkout new tag for bitcoin-core/bitcoin-detached-sigs with the detached signatures
4. env [ FOO=bar... ] DETACHED_SIGS_REPO=<path/to/bitcoin-detached-sigs> ./contrib/guix/guix-codesign (modify env vars as necessary)
5. Make sure guix.sigs is cloned and updated
6. env GUIX_SIGS_REPO=<path/to/guix.sigs> SIGNER=0x96AB007F1A7ED999=dongcarl ./contrib/guix/guix-attest (modify env vars as necessary)
7. Commit your new signatures and SHA256SUMS in guix.sigs
8. Optionally, after there are multiple signatures in guix.sigs: env GUIX_SIGS_REPO=<path/to/guix.sigs> ./contrib/guix/guix-verify

[hebasto]

So, we are not uploading attestations for non-codesigned binaries, are we?

[achow101]

So, we are not uploading attestations for non-codesigned binaries, are we?

We should be

[Emzy]

tested ACK
Works like described.