Merge pull request #6156

443b1e9 make d2h et al. constant-time (jtgrassie)
make d2h et al. constant-time
2025-12-06 12:51:24 -08:00 · 2019-11-19 10:01:03 -06:00 · 2019-11-19 04:20:04 -05:00 · 2019-11-18 14:59:10 -06:00 · 2019-11-18 13:25:58 -06:00 · 2019-11-18 13:23:52 -06:00
54 changed files with 880 additions and 251 deletions
--- a/README.md
+++ b/README.md
@@ -153,7 +153,7 @@ Dates are provided in the format YYYY-MM-DD.
 | 1686275                        | 2018-10-19 | v9                | v0.13.0.0              | v0.13.0.4                  | bulletproofs required
 | 1788000                        | 2019-03-09 | v10               | v0.14.0.0              | v0.14.1.2                  | New PoW based on Cryptonight-R, new block weight algorithm, slightly more efficient RingCT format
 | 1788720                        | 2019-03-10 | v11               | v0.14.0.0              | v0.14.1.2                  | forbid old RingCT transaction format
-| 1978433                        | 2019-11-30* | v12                | v0.15.0.0              | v0.15.0.0                  | New PoW based on RandomX, only allow >= 2 outputs, change to the block median used to calculate penalty, v1 coinbases are forbidden, rct sigs in coinbase forbidden, 10 block lock time for incoming transactions
+| 1978433                        | 2019-11-30* | v12                | v0.15.0.0              | v0.15.0.1                  | New PoW based on RandomX, only allow >= 2 outputs, change to the block median used to calculate penalty, v1 coinbases are forbidden, rct sigs in coinbase forbidden, 10 block lock time for incoming transactions
 | XXXXXXX                        | XXX-XX-XX | XXX                | vX.XX.X.X              | vX.XX.X.X                  | XXX |

 X's indicate that these details have not been determined as of commit date.
@@ -315,7 +315,7 @@ Tested on a Raspberry Pi Zero with a clean install of minimal Raspbian Stretch (
    ```bash
    git clone https://github.com/monero-project/monero.git
    cd monero
-    git checkout tags/v0.15.0.0
+    git checkout tags/v0.15.0.1
    ```

 * Build:
@@ -432,10 +432,10 @@ application.
    cd monero
    ```

-* If you would like a specific [version/tag](https://github.com/monero-project/monero/tags), do a git checkout for that version. eg. 'v0.15.0.0'. If you don't care about the version and just want binaries from master, skip this step:
+* If you would like a specific [version/tag](https://github.com/monero-project/monero/tags), do a git checkout for that version. eg. 'v0.15.0.1'. If you don't care about the version and just want binaries from master, skip this step:
 	
    ```bash
-    git checkout v0.15.0.0
+    git checkout v0.15.0.1
    ```

 * If you are on a 64-bit system, run:
--- a/contrib/depends/Makefile
+++ b/contrib/depends/Makefile
@@ -53,8 +53,12 @@ endif
 host_arch=$(firstword $(subst -, ,$(canonical_host)))
 host_vendor=$(word 2,$(subst -, ,$(canonical_host)))
 full_host_os:=$(subst $(host_arch)-$(host_vendor)-,,$(canonical_host))
+host_os:=$(findstring android,$(full_host_os))
+ifeq ($(host_os),)
 host_os:=$(findstring linux,$(full_host_os))
+endif
 host_os+=$(findstring darwin,$(full_host_os))
+host_os+=$(findstring freebsd,$(full_host_os))
 host_os+=$(findstring mingw32,$(full_host_os))
 host_os:=$(strip $(host_os))
 ifeq ($(host_os),)
@@ -71,9 +75,15 @@ endif
 ifeq ($(host_os),linux)
 host_cmake=Linux
 endif
+ifeq ($(host_os),freebsd)
+host_cmake=FreeBSD
+endif
 ifeq ($(host_os),darwin)
 host_cmake=Darwin
 endif
+ifeq ($(host_os),android)
+host_cmake=Android
+endif

 AT_$(V):=
 AT_:=@
--- a/contrib/depends/builders/default.mk
+++ b/contrib/depends/builders/default.mk
@@ -17,4 +17,4 @@ define add_build_flags_func
 build_$(build_arch)_$(build_os)_$1 += $(build_$(build_os)_$1)
 build_$1=$$(build_$(build_arch)_$(build_os)_$1)
 endef
-$(foreach flags, CFLAGS CXXFLAGS LDFLAGS, $(eval $(call add_build_flags_func,$(flags))))
+$(foreach flags, CFLAGS CXXFLAGS ARFLAGS LDFLAGS, $(eval $(call add_build_flags_func,$(flags))))
--- a/contrib/depends/funcs.mk
+++ b/contrib/depends/funcs.mk
@@ -10,6 +10,7 @@ $(1)_libtool=$($($(1)_type)_LIBTOOL)
 $(1)_nm=$($($(1)_type)_NM)
 $(1)_cflags=$($($(1)_type)_CFLAGS) $($($(1)_type)_$(release_type)_CFLAGS)
 $(1)_cxxflags=$($($(1)_type)_CXXFLAGS) $($($(1)_type)_$(release_type)_CXXFLAGS)
+$(1)_arflags=$($($(1)_type)_ARFLAGS) $($($(1)_type)_$(release_type)_ARFLAGS)
 $(1)_ldflags=$($($(1)_type)_LDFLAGS) $($($(1)_type)_$(release_type)_LDFLAGS) -L$($($(1)_type)_prefix)/lib
 $(1)_cppflags=$($($(1)_type)_CPPFLAGS) $($($(1)_type)_$(release_type)_CPPFLAGS) -I$($($(1)_type)_prefix)/include
 $(1)_recipe_hash:=
@@ -102,6 +103,11 @@ $(1)_cxxflags+=$($(1)_cxxflags_$(host_arch)) $($(1)_cxxflags_$(host_arch)_$(rele
 $(1)_cxxflags+=$($(1)_cxxflags_$(host_os)) $($(1)_cxxflags_$(host_os)_$(release_type))
 $(1)_cxxflags+=$($(1)_cxxflags_$(host_arch)_$(host_os)) $($(1)_cxxflags_$(host_arch)_$(host_os)_$(release_type))

+$(1)_arflags+=$($(1)_arflags_$(release_type))
+$(1)_arflags+=$($(1)_arflags_$(host_arch)) $($(1)_arflags_$(host_arch)_$(release_type))
+$(1)_arflags+=$($(1)_arflags_$(host_os)) $($(1)_arflags_$(host_os)_$(release_type))
+$(1)_arflags+=$($(1)_arflags_$(host_arch)_$(host_os)) $($(1)_arflags_$(host_arch)_$(host_os)_$(release_type))
+
 $(1)_cppflags+=$($(1)_cppflags_$(release_type))
 $(1)_cppflags+=$($(1)_cppflags_$(host_arch)) $($(1)_cppflags_$(host_arch)_$(release_type))
 $(1)_cppflags+=$($(1)_cppflags_$(host_os)) $($(1)_cppflags_$(host_os)_$(release_type))
@@ -143,6 +149,9 @@ endif
 ifneq ($($(1)_ar),)
 $(1)_autoconf += AR="$$($(1)_ar)"
 endif
+ifneq ($($(1)_arflags),)
+$(1)_autoconf += ARFLAGS="$$($(1)_arflags)"
+endif
 ifneq ($($(1)_cflags),)
 $(1)_autoconf += CFLAGS="$$($(1)_cflags)"
 endif
--- a/contrib/depends/hosts/android.mk
+++ b/contrib/depends/hosts/android.mk
@@ -0,0 +1,22 @@
+ANDROID_API=21
+
+ifeq ($(host_arch),arm)
+host_toolchain=arm-linux-androideabi-
+endif
+
+android_CC=$(host_toolchain)clang
+android_CXX=$(host_toolchain)clang++
+android_RANLIB=:
+
+android_CFLAGS=-pipe
+android_CXXFLAGS=$(android_CFLAGS)
+android_ARFLAGS=crsD
+
+android_release_CFLAGS=-O2
+android_release_CXXFLAGS=$(android_release_CFLAGS)
+
+android_debug_CFLAGS=-g -O0
+android_debug_CXXFLAGS=$(android_debug_CFLAGS)
+
+android_native_toolchain=android_ndk
+
--- a/contrib/depends/hosts/darwin.mk
+++ b/contrib/depends/hosts/darwin.mk
@@ -7,6 +7,7 @@ darwin_CXX=clang++ -target $(host) -mmacosx-version-min=$(OSX_MIN_VERSION) --sys

 darwin_CFLAGS=-pipe
 darwin_CXXFLAGS=$(darwin_CFLAGS)
+darwin_ARFLAGS=cr

 darwin_release_CFLAGS=-O1
 darwin_release_CXXFLAGS=$(darwin_release_CFLAGS)
--- a/contrib/depends/hosts/default.mk
+++ b/contrib/depends/hosts/default.mk
@@ -23,4 +23,4 @@ host_$(release_type)_$1 = $$($(host_arch)_$(host_os)_$(release_type)_$1)
 endef

 $(foreach tool,CC CXX AR RANLIB STRIP NM LIBTOOL OTOOL INSTALL_NAME_TOOL,$(eval $(call add_host_tool_func,$(tool))))
-$(foreach flags,CFLAGS CXXFLAGS CPPFLAGS LDFLAGS, $(eval $(call add_host_flags_func,$(flags))))
+$(foreach flags,CFLAGS CXXFLAGS ARFLAGS CPPFLAGS LDFLAGS, $(eval $(call add_host_flags_func,$(flags))))
--- a/contrib/depends/hosts/freebsd.mk
+++ b/contrib/depends/hosts/freebsd.mk
@@ -0,0 +1,18 @@
+freebsd_CC=clang-8
+freebsd_CXX=clang++-8
+freebsd_AR=ar
+freebsd_RANLIB=ranlib
+freebsd_NM=nm
+
+freebsd_CFLAGS=-pipe
+freebsd_CXXFLAGS=$(freebsd_CFLAGS)
+freebsd_ARFLAGS=cr
+
+freebsd_release_CFLAGS=-O2
+freebsd_release_CXXFLAGS=$(freebsd_release_CFLAGS)
+
+freebsd_debug_CFLAGS=-g -O0
+freebsd_debug_CXXFLAGS=$(freebsd_debug_CFLAGS)
+
+freebsd_native_toolchain=freebsd_base
+
--- a/contrib/depends/hosts/linux.mk
+++ b/contrib/depends/hosts/linux.mk
@@ -1,5 +1,6 @@
 linux_CFLAGS=-pipe
 linux_CXXFLAGS=$(linux_CFLAGS)
+linux_ARFLAGS=cr

 linux_release_CFLAGS=-O2
 linux_release_CXXFLAGS=$(linux_release_CFLAGS)
--- a/contrib/depends/hosts/mingw32.mk
+++ b/contrib/depends/hosts/mingw32.mk
@@ -1,5 +1,6 @@
 mingw32_CFLAGS=-pipe
 mingw32_CXXFLAGS=$(mingw32_CFLAGS)
+mingw32_ARFLAGS=cr

 mingw32_release_CFLAGS=-O2
 mingw32_release_CXXFLAGS=$(mingw32_release_CFLAGS)
--- a/contrib/depends/packages/android_ndk.mk
+++ b/contrib/depends/packages/android_ndk.mk
@@ -0,0 +1,22 @@
+package=android_ndk
+$(package)_version=17b
+$(package)_download_path=https://dl.google.com/android/repository/
+$(package)_file_name=android-ndk-r$($(package)_version)-linux-x86_64.zip
+$(package)_sha256_hash=5dfbbdc2d3ba859fed90d0e978af87c71a91a5be1f6e1c40ba697503d48ccecd
+
+define $(package)_set_vars
+$(package)_config_opts_arm=--arch arm
+$(package)_config_opts_aarch64=--arch arm64
+endef
+
+define $(package)_extract_cmds
+  echo $($(package)_sha256_hash) $($(1)_source_dir)/$($(package)_file_name) | sha256sum -c &&\
+  unzip -q $($(1)_source_dir)/$($(package)_file_name)
+endef
+
+define $(package)_stage_cmds
+  android-ndk-r$($(package)_version)/build/tools/make_standalone_toolchain.py --api 21 \
+    --install-dir $(build_prefix) --stl=libc++ $($(package)_config_opts) &&\
+  mv $(build_prefix) $($(package)_staging_dir)/$(host_prefix)
+endef
+
--- a/contrib/depends/packages/boost.mk
+++ b/contrib/depends/packages/boost.mk
@@ -3,6 +3,8 @@ $(package)_version=1_64_0
 $(package)_download_path=https://dl.bintray.com/boostorg/release/1.64.0/source/
 $(package)_file_name=$(package)_$($(package)_version).tar.bz2
 $(package)_sha256_hash=7bcc5caace97baa948931d712ea5f37038dbb1c5d89b43ad4def4ed7cb683332
+$(package)_dependencies=libiconv
+$(package)_patches=fix_aroptions.patch

 define $(package)_set_vars
 $(package)_config_opts_release=variant=release
@@ -10,6 +12,7 @@ $(package)_config_opts_debug=variant=debug
 $(package)_config_opts=--layout=tagged --build-type=complete --user-config=user-config.jam
 $(package)_config_opts+=threading=multi link=static -sNO_BZIP2=1 -sNO_ZLIB=1
 $(package)_config_opts_linux=threadapi=pthread runtime-link=shared
+$(package)_config_opts_android=threadapi=pthread runtime-link=static target-os=android
 $(package)_config_opts_darwin=--toolset=darwin-4.2.1 runtime-link=shared
 $(package)_config_opts_mingw32=binary-format=pe target-os=windows threadapi=win32 runtime-link=static
 $(package)_config_opts_x86_64_mingw32=address-model=64
@@ -22,10 +25,12 @@ $(package)_archiver_darwin=$($(package)_libtool)
 $(package)_config_libraries=chrono,filesystem,program_options,system,thread,test,date_time,regex,serialization,locale
 $(package)_cxxflags=-std=c++11
 $(package)_cxxflags_linux=-fPIC
+$(package)_cxxflags_freebsd=-fPIC
 endef

 define $(package)_preprocess_cmds
-  echo "using $(boost_toolset_$(host_os)) : : $($(package)_cxx) : <cxxflags>\"$($(package)_cxxflags) $($(package)_cppflags)\" <linkflags>\"$($(package)_ldflags)\" <archiver>\"$(boost_archiver_$(host_os))\" <striper>\"$(host_STR    IP)\"  <ranlib>\"$(host_RANLIB)\" <rc>\"$(host_WINDRES)\" : ;" > user-config.jam
+  patch -p1 < $($(package)_patch_dir)/fix_aroptions.patch &&\
+  echo "using $(boost_toolset_$(host_os)) : : $($(package)_cxx) : <cxxflags>\"$($(package)_cxxflags) $($(package)_cppflags)\" <linkflags>\"$($(package)_ldflags)\" <archiver>\"$(boost_archiver_$(host_os))\" <arflags>\"$($(package)_arflags)\" <striper>\"$(host_STRIP)\"  <ranlib>\"$(host_RANLIB)\" <rc>\"$(host_WINDRES)\" : ;" > user-config.jam
 endef

 define $(package)_config_cmds
--- a/contrib/depends/packages/eudev.mk
+++ b/contrib/depends/packages/eudev.mk
@@ -9,7 +9,7 @@ define $(package)_set_vars
 endef

 define $(package)_config_cmds
-  $($(package)_autoconf)
+  $($(package)_autoconf) AR_FLAGS=$($(package)_arflags)
 endef

 define $(package)_build_cmd
--- a/contrib/depends/packages/freebsd_base.mk
+++ b/contrib/depends/packages/freebsd_base.mk
@@ -0,0 +1,23 @@
+package=freebsd_base
+$(package)_version=11.3
+$(package)_download_path=https://download.freebsd.org/ftp/releases/amd64/$($(package)_version)-RELEASE/
+$(package)_download_file=base.txz
+$(package)_file_name=freebsd-base-$($(package)_version).txz
+$(package)_sha256_hash=4599023ac136325b86f2fddeec64c1624daa83657e40b00b2ef944c81463a4ff
+
+define $(package)_extract_cmds
+  echo $($(package)_sha256_hash) $($(1)_source_dir)/$($(package)_file_name) | sha256sum -c &&\
+  tar xf $($(1)_source_dir)/$($(package)_file_name) ./lib/ ./usr/lib/ ./usr/include/
+endef
+
+define $(package)_build_cmds
+  mkdir bin &&\
+  echo "exec /usr/bin/clang-8 -target x86_64-unknown-freebsd$($(package)_version) --sysroot=$(host_prefix)/native $$$$""@" > bin/clang-8 &&\
+  echo "exec /usr/bin/clang++-8 -target x86_64-unknown-freebsd$($(package)_version) --sysroot=$(host_prefix)/native $$$$""@" > bin/clang++-8 &&\
+  chmod 755 bin/*
+endef
+
+define $(package)_stage_cmds
+  mkdir $($(package)_staging_dir)/$(host_prefix)/native &&\
+  mv bin lib usr $($(package)_staging_dir)/$(host_prefix)/native
+endef
--- a/contrib/depends/packages/hidapi.mk
+++ b/contrib/depends/packages/hidapi.mk
@@ -18,7 +18,7 @@ endef

 define $(package)_config_cmds
  ./bootstrap &&\
-  $($(package)_autoconf) $($(package)_config_opts)
+  $($(package)_autoconf) $($(package)_config_opts) AR_FLAGS=$($(package)_arflags)
 endef

 define $(package)_build_cmds
--- a/contrib/depends/packages/libiconv.mk
+++ b/contrib/depends/packages/libiconv.mk
@@ -10,6 +10,7 @@ define $(package)_set_vars
  $(package)_config_opts=--enable-static
  $(package)_config_opts=--disable-shared
  $(package)_config_opts_linux=--with-pic
+  $(package)_config_opts_freebsd=--with-pic
 endef

 define $(package)_preprocess_cmds
@@ -18,7 +19,7 @@ define $(package)_preprocess_cmds
 endef

 define $(package)_config_cmds
-  $($(package)_autoconf)
+  $($(package)_autoconf) AR_FLAGS=$($(package)_arflags)
 endef

 define $(package)_build_cmds
--- a/contrib/depends/packages/libusb.mk
+++ b/contrib/depends/packages/libusb.mk
@@ -19,11 +19,11 @@ ifneq ($(host_os),darwin)
  define $(package)_config_cmds
    cp -f $(BASEDIR)/config.guess config.guess &&\
    cp -f $(BASEDIR)/config.sub config.sub &&\
-    $($(package)_autoconf)
+    $($(package)_autoconf) AR_FLAGS=$($(package)_arflags)
  endef
 else
  define $(package)_config_cmds
-    $($(package)_autoconf)
+    $($(package)_autoconf) AR_FLAGS=$($(package)_arflags)
  endef
 endif

--- a/contrib/depends/packages/native_cctools.mk
+++ b/contrib/depends/packages/native_cctools.mk
@@ -10,6 +10,7 @@ $(package)_clang_download_file=clang+llvm-$($(package)_clang_version)-x86_64-lin
 $(package)_clang_file_name=clang-llvm-$($(package)_clang_version)-x86_64-linux-gnu-ubuntu-14.04.tar.xz
 $(package)_clang_sha256_hash=99b28a6b48e793705228a390471991386daa33a9717cd9ca007fcdde69608fd9
 $(package)_extra_sources=$($(package)_clang_file_name)
+$(package)_patches=skip_otool.patch

 define $(package)_fetch_cmds
 $(call fetch_file,$(package),$($(package)_download_path),$($(package)_download_file),$($(package)_file_name),$($(package)_sha256_hash)) && \
@@ -37,7 +38,10 @@ $(package)_cc=$($(package)_extract_dir)/toolchain/bin/clang
 $(package)_cxx=$($(package)_extract_dir)/toolchain/bin/clang++
 endef

+# If clang gets updated to a version with a fix for https://reviews.llvm.org/D50559
+# then the patch that skips otool can be removed.
 define $(package)_preprocess_cmds
+  patch -p0 < $($(package)_patch_dir)/skip_otool.patch && \
  cd $($(package)_build_subdir); ./autogen.sh && \
  sed -i.old "/define HAVE_PTHREADS/d" ld64/src/ld/InputFiles.h
 endef
--- a/contrib/depends/packages/ncurses.mk
+++ b/contrib/depends/packages/ncurses.mk
@@ -7,7 +7,7 @@ $(package)_patches=fallback.c

 define $(package)_set_vars
  $(package)_build_opts=CC="$($(package)_cc)"
-  $(package)_config_env=AR="$($(package)_ar)" RANLIB="$($(package)_ranlib)" CC="$($(package)_cc)"
+  $(package)_config_env=AR="$($(package)_ar)" RANLIB="$($(package)_ranlib)" CC="$($(package)_cc)" ARFLAGS=$($(package)_arflags) cf_cv_ar_flags=""
  $(package)_config_env_darwin=RANLIB="$(host_prefix)/native/bin/x86_64-apple-darwin11-ranlib" AR="$(host_prefix)/native/bin/x86_64-apple-darwin11-ar" CC="$(host_prefix)/native/bin/$($(package)_cc)"
  $(package)_config_opts=--prefix=$(host_prefix)
  $(package)_config_opts+=--disable-shared
--- a/contrib/depends/packages/openssl.mk
+++ b/contrib/depends/packages/openssl.mk
@@ -3,9 +3,10 @@ $(package)_version=1.0.2r
 $(package)_download_path=https://www.openssl.org/source
 $(package)_file_name=$(package)-$($(package)_version).tar.gz
 $(package)_sha256_hash=ae51d08bba8a83958e894946f15303ff894d75c2b8bbd44a852b64e3fe11d0d6
+$(package)_patches=fix_arflags.patch

 define $(package)_set_vars
-$(package)_config_env=AR="$($(package)_ar)" RANLIB="$($(package)_ranlib)" CC="$($(package)_cc)"
+$(package)_config_env=AR="$($(package)_ar)" ARFLAGS=$($(package)_arflags) RANLIB="$($(package)_ranlib)" CC="$($(package)_cc)"
 $(package)_config_opts=--prefix=$(host_prefix) --openssldir=$(host_prefix)/etc/openssl
 $(package)_config_opts+=no-capieng
 $(package)_config_opts+=no-dso
@@ -36,10 +37,13 @@ $(package)_config_opts+=no-zlib
 $(package)_config_opts+=no-zlib-dynamic
 $(package)_config_opts+=$($(package)_cflags) $($(package)_cppflags)
 $(package)_config_opts_linux=-fPIC -Wa,--noexecstack
+$(package)_config_opts_freebsd=-fPIC -Wa,--noexecstack
 $(package)_config_opts_x86_64_linux=linux-x86_64
 $(package)_config_opts_i686_linux=linux-generic32
 $(package)_config_opts_arm_linux=linux-generic32
 $(package)_config_opts_aarch64_linux=linux-generic64
+$(package)_config_opts_arm_android=--static android-armv7 no-asm
+$(package)_config_opts_aarch64_android=--static android no-asm
 $(package)_config_opts_riscv64_linux=linux-generic64
 $(package)_config_opts_mipsel_linux=linux-generic32
 $(package)_config_opts_mips_linux=linux-generic32
@@ -47,11 +51,14 @@ $(package)_config_opts_powerpc_linux=linux-generic32
 $(package)_config_opts_x86_64_darwin=darwin64-x86_64-cc
 $(package)_config_opts_x86_64_mingw32=mingw64
 $(package)_config_opts_i686_mingw32=mingw
+$(package)_config_opts_x86_64_freebsd=BSD-x86_64
 endef

 define $(package)_preprocess_cmds
  sed -i.old "/define DATE/d" util/mkbuildinf.pl && \
-  sed -i.old "s|engines apps test|engines|" Makefile.org
+  sed -i.old "s|engines apps test|engines|" Makefile.org && \
+  sed -i -e "s/-mandroid //" Configure && \
+  patch < $($(package)_patch_dir)/fix_arflags.patch
 endef

 define $(package)_config_cmds
--- a/contrib/depends/packages/packages.mk
+++ b/contrib/depends/packages/packages.mk
@@ -1,10 +1,22 @@
-packages:=boost openssl zeromq cppzmq expat ldns libiconv hidapi protobuf libusb
-native_packages := native_ccache native_protobuf
+packages:=boost openssl zeromq libiconv

-darwin_native_packages = native_biplist native_ds_store native_mac_alias
-darwin_packages = sodium-darwin ncurses readline 
+native_packages := native_ccache

-linux_packages = eudev ncurses readline sodium
+hardware_packages := hidapi protobuf libusb
+hardware_native_packages := native_protobuf
+
+android_native_packages = android_ndk
+android_packages = ncurses readline sodium
+
+darwin_native_packages = native_biplist native_ds_store native_mac_alias $(hardware_native_packages)
+darwin_packages = sodium ncurses readline $(hardware_packages)
+
+# not really native...
+freebsd_native_packages = freebsd_base
+freebsd_packages = ncurses readline sodium
+
+linux_packages = eudev ncurses readline sodium $(hardware_packages)
+linux_native_packages = $(hardware_native_packages)
 qt_packages = qt

 ifeq ($(build_tests),ON)
@@ -15,10 +27,8 @@ ifneq ($(host_arch),riscv64)
 linux_packages += unwind
 endif

-ifeq ($(host_os),mingw32)
-packages += icu4c
-packages += sodium
-endif
+mingw32_packages = icu4c sodium $(hardware_packages)
+mingw32_native_packages = $(hardware_native_packages)

 ifneq ($(build_os),darwin)
 darwin_native_packages += native_cctools native_cdrkit native_libdmg-hfsplus
--- a/contrib/depends/packages/protobuf.mk
+++ b/contrib/depends/packages/protobuf.mk
@@ -12,7 +12,7 @@ define $(package)_set_vars
 endef

 define $(package)_config_cmds
-  $($(package)_autoconf)
+  $($(package)_autoconf) AR_FLAGS=$($(package)_arflags)
 endef

 define $(package)_build_cmds
--- a/contrib/depends/packages/readline.mk
+++ b/contrib/depends/packages/readline.mk
@@ -7,7 +7,7 @@ $(package)_dependencies=ncurses

 define $(package)_set_vars
  $(package)_build_opts=CC="$($(package)_cc)"
-  $(package)_config_env=AR="$($(package)_ar)" RANLIB="$($(package)_ranlib)" CC="$($(package)_cc)" LDFLAGS="-L$(host_prefix)/lib"
+  $(package)_config_env=AR="$($(package)_ar)" RANLIB="$($(package)_ranlib)" CC="$($(package)_cc)" LDFLAGS="-L$(host_prefix)/lib" ARFLAGS=$($(package)_arflags)
  $(package)_config_env_darwin=RANLIB="$(host_prefix)/native/bin/x86_64-apple-darwin11-ranlib" AR="$(host_prefix)/native/bin/x86_64-apple-darwin11-ar" CC="$(host_prefix)/native/bin/$($(package)_cc)"
  $(package)_config_opts+=--prefix=$(host_prefix)
  $(package)_config_opts+=--exec-prefix=$(host_prefix)
--- a/contrib/depends/packages/sodium-darwin.mk
+++ b/contrib/depends/packages/sodium-darwin.mk
@@ -1,30 +0,0 @@
-package=sodium-darwin
-$(package)_version=1.0.16
-$(package)_download_path=https://download.libsodium.org/libsodium/releases/
-$(package)_file_name=libsodium-$($(package)_version).tar.gz
-$(package)_sha256_hash=eeadc7e1e1bcef09680fb4837d448fbdf57224978f865ac1c16745868fbd0533
-
-define $(package)_set_vars
-$(package)_build_opts_darwin=OS=Darwin LIBTOOL="$($(package)_libtool)"
-$(package)_config_opts=--enable-static --disable-shared
-$(package)_config_opts+=--prefix=$(host_prefix)
-endef
-
-define $(package)_config_cmds
-  ./autogen.sh &&\
-  $($(package)_autoconf) $($(package)_config_opts) RANLIB="$(host_prefix)/native/bin/x86_64-apple-darwin11-ranlib" AR="$(host_prefix)/native/bin/x86_64-apple-darwin11-ar" CC="$(host_prefix)/native/bin/$($(package)_cc)"
-endef
-
-define $(package)_build_cmds
-  echo "path is problematic here" &&\
-  make
-endef
-
-define $(package)_stage_cmds
-  $(MAKE) DESTDIR=$($(package)_staging_dir) install
-endef
-
-define $(package)_postprocess_cmds
-  rm lib/*.la
-endef
-
--- a/contrib/depends/packages/sodium.mk
+++ b/contrib/depends/packages/sodium.mk
@@ -8,12 +8,14 @@ $(package)_patches=fix-whitespace.patch
 define $(package)_set_vars
 $(package)_config_opts=--enable-static --disable-shared
 $(package)_config_opts+=--prefix=$(host_prefix)
+$(package)_config_opts_android=RANLIB=$($(package)_ranlib) AR=$($(package)_ar) CC=$($(package)_cc)
+$(package)_config_opts_darwin=RANLIB="$(host_prefix)/native/bin/x86_64-apple-darwin11-ranlib" AR="$(host_prefix)/native/bin/x86_64-apple-darwin11-ar" CC="$(host_prefix)/native/bin/$($(package)_cc)"
 endef

 define $(package)_config_cmds
  ./autogen.sh &&\
  patch -p1 < $($(package)_patch_dir)/fix-whitespace.patch &&\
-  $($(package)_autoconf) $($(package)_config_opts)
+  $($(package)_autoconf) $($(package)_config_opts) AR_FLAGS=$($(package)_arflags)
 endef

 define $(package)_build_cmds
--- a/contrib/depends/packages/unwind.mk
+++ b/contrib/depends/packages/unwind.mk
@@ -3,11 +3,16 @@ $(package)_version=1.2
 $(package)_download_path=https://download.savannah.nongnu.org/releases/libunwind
 $(package)_file_name=lib$(package)-$($(package)_version).tar.gz
 $(package)_sha256_hash=1de38ffbdc88bd694d10081865871cd2bfbb02ad8ef9e1606aee18d65532b992
+$(package)_patches=fix_obj_order.patch
+
+define $(package)_preprocess_cmds
+  patch -p0 < $($(package)_patch_dir)/fix_obj_order.patch
+endef

 define $(package)_config_cmds
  cp -f $(BASEDIR)/config.guess config/config.guess &&\
  cp -f $(BASEDIR)/config.sub config/config.sub &&\
-  $($(package)_autoconf) --disable-shared --enable-static
+  $($(package)_autoconf) --disable-shared --enable-static AR_FLAGS=$($(package)_arflags)
 endef

 define $(package)_build_cmds
--- a/contrib/depends/packages/zeromq.mk
+++ b/contrib/depends/packages/zeromq.mk
@@ -3,22 +3,24 @@ $(package)_version=4.1.7
 $(package)_download_path=https://github.com/zeromq/zeromq4-1/releases/download/v$($(package)_version)/
 $(package)_file_name=$(package)-$($(package)_version).tar.gz
 $(package)_sha256_hash=31c383cfcd3be1dc8a66e448c403029e793687e70473b89c4cc0bd626e7da299
-$(package)_patches=9114d3957725acd34aa8b8d011585812f3369411.patch 9e6745c12e0b100cd38acecc16ce7db02905e27c.patch
+$(package)_patches=9114d3957725acd34aa8b8d011585812f3369411.patch 9e6745c12e0b100cd38acecc16ce7db02905e27c.patch ffe62d3398d5e0191f554f61049aa7ec9fc892ae.patch

 define $(package)_set_vars
  $(package)_config_opts=--without-documentation --disable-shared --without-libsodium --disable-curve
  $(package)_config_opts_linux=--with-pic
+  $(package)_config_opts_freebsd=--with-pic
  $(package)_cxxflags=-std=c++11
 endef

 define $(package)_preprocess_cmds
  patch -p1 < $($(package)_patch_dir)/9114d3957725acd34aa8b8d011585812f3369411.patch && \
  patch -p1 < $($(package)_patch_dir)/9e6745c12e0b100cd38acecc16ce7db02905e27c.patch && \
+  patch -p1 < $($(package)_patch_dir)/ffe62d3398d5e0191f554f61049aa7ec9fc892ae.patch && \
  ./autogen.sh
 endef

 define $(package)_config_cmds
-  $($(package)_autoconf)
+  $($(package)_autoconf) AR_FLAGS=$($(package)_arflags)
 endef

 define $(package)_build_cmds
--- a/contrib/depends/patches/boost/fix_aroptions.patch
+++ b/contrib/depends/patches/boost/fix_aroptions.patch
@@ -0,0 +1,28 @@
+--- boost_1_64_0/tools/build/src/tools/gcc.jam.O	2017-04-17 03:22:26.000000000 +0100
+++ boost_1_64_0/tools/build/src/tools/gcc.jam	2019-11-15 15:46:16.957937137 +0000
+@@ -243,6 +243,8 @@
+     {
+         ECHO notice: using gcc archiver :: $(condition) :: $(archiver[1]) ;
+     }
+    local arflags = [ feature.get-values <arflags> : $(options) ] ;
+    toolset.flags gcc.archive .ARFLAGS $(condition) : $(arflags) ;
+ 
+     # - Ranlib.
+     local ranlib = [ common.get-invocation-command gcc
+@@ -970,6 +972,7 @@
+ # logic in intel-linux, but that is hardly worth the trouble as on Linux, 'ar'
+ # is always available.
+ .AR = ar ;
+.ARFLAGS = rc ;
+ .RANLIB = ranlib ;
+ 
+ toolset.flags gcc.archive AROPTIONS <archiveflags> ;
+@@ -1011,7 +1014,7 @@
+ #
+ actions piecemeal archive
+ {
+-    "$(.AR)" $(AROPTIONS) rc "$(<)" "$(>)"
+    "$(.AR)" $(AROPTIONS) $(.ARFLAGS) "$(<)" "$(>)"
+     "$(.RANLIB)" "$(<)"
+ }
+ 
--- a/contrib/depends/patches/native_cctools/skip_otool.patch
+++ b/contrib/depends/patches/native_cctools/skip_otool.patch
@@ -0,0 +1,12 @@
+--- cctools/Makefile.am.O	2016-06-09 15:06:16.000000000 +0100
+++ cctools/Makefile.am	2019-11-18 08:59:20.078663220 +0000
+@@ -1,7 +1,7 @@
+ if ISDARWIN
+-SUBDIRS=libstuff ar as misc otool ld64 $(LD_CLASSIC)
+SUBDIRS=libstuff ar as misc ld64 $(LD_CLASSIC)
+ else
+-SUBDIRS=libstuff ar as misc libobjc2 otool ld64 $(LD_CLASSIC)
+SUBDIRS=libstuff ar as misc ld64 $(LD_CLASSIC)
+ endif
+ 
+ ACLOCAL_AMFLAGS = -I m4
--- a/contrib/depends/patches/openssl/fix_arflags.patch
+++ b/contrib/depends/patches/openssl/fix_arflags.patch
@@ -0,0 +1,24 @@
+--- Makefile.org.O	2019-02-26 14:20:20.000000000 +0000
+++ Makefile.org	2019-11-15 13:05:54.370086856 +0000
+@@ -63,8 +63,8 @@
+ PEX_LIBS= 
+ EX_LIBS= 
+ EXE_EXT= 
+-ARFLAGS=
+-AR=ar $(ARFLAGS) r
+ARFLAGS= r
+AR=ar $(ARFLAGS)
+ RANLIB= ranlib
+ RC= windres
+ NM= nm
+--- Configure.O	2019-02-26 14:20:20.000000000 +0000
+++ Configure	2019-11-16 07:43:14.933990774 +0000
+@@ -1251,7 +1251,7 @@
+ my $shared_extension = $fields[$idx_shared_extension];
+ my $ranlib = $ENV{'RANLIB'} || $fields[$idx_ranlib];
+ my $ar = $ENV{'AR'} || "ar";
+-my $arflags = $fields[$idx_arflags];
+my $arflags = $ENV{'ARFLAGS'} || $fields[$idx_arflags];
+ my $windres = $ENV{'RC'} || $ENV{'WINDRES'} || "windres";
+ my $multilib = $fields[$idx_multilib];
+ 
--- a/contrib/depends/patches/unwind/fix_obj_order.patch
+++ b/contrib/depends/patches/unwind/fix_obj_order.patch
@@ -0,0 +1,11 @@
+--- config/ltmain.sh.O	2017-01-13 16:00:54.000000000 +0000
+++ config/ltmain.sh	2019-11-17 06:46:51.994402494 +0000
+@@ -7957,6 +7957,8 @@
+ 	    esac
+ 	  done
+ 	fi
+	oldobjs=`for obj in $oldobjs; do echo $obj; done | sort`
+	oldobjs=" `echo $oldobjs`"
+ 	eval cmds=\"$old_archive_cmds\"
+ 
+ 	func_len " $cmds"
--- a/contrib/depends/patches/zeromq/ffe62d3398d5e0191f554f61049aa7ec9fc892ae.patch
+++ b/contrib/depends/patches/zeromq/ffe62d3398d5e0191f554f61049aa7ec9fc892ae.patch
@@ -0,0 +1,38 @@
+From ffe62d3398d5e0191f554f61049aa7ec9fc892ae Mon Sep 17 00:00:00 2001
+From: Gregory Lemercier <greglemercier@free.fr>
+Date: Sun, 7 Oct 2018 18:06:54 +0200
+Subject: [PATCH] Fix build on arm64 architectures with some strict compilers
+
+This patch fixes an issue that occurs on 64-bit architetures under
+strict compiler rules. The code initially checked that the received
+size stored in 'uint64_t' was not bigger than the max value of a
+'size_t' variable, which is legitimate on 32-bit architectures where
+'size_t' variables are stored on 32 bits. On 64-bit architectures,
+this test no longer makes sense since 'uint64_t' and 'size_t' types
+have the same size. The issue is fixed by ignoring this portion
+of code when built for arm64.
+---
+ src/v1_decoder.cpp | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/v1_decoder.cpp b/src/v1_decoder.cpp
+index b002dc9d..2c8c97a7 100644
+--- a/src/v1_decoder.cpp
+++ b/src/v1_decoder.cpp
+@@ -114,11 +114,13 @@ int zmq::v1_decoder_t::eight_byte_size_ready ()
+         return -1;
+     }
+ 
+#ifndef __aarch64__
+     //  Message size must fit within range of size_t data type.
+     if (payload_length - 1 > std::numeric_limits <size_t>::max ()) {
+         errno = EMSGSIZE;
+         return -1;
+     }
+#endif
+ 
+     const size_t msg_size = static_cast <size_t> (payload_length - 1);
+ 
+-- 
+2.20.1
+
--- a/contrib/depends/toolchain.cmake.in
+++ b/contrib/depends/toolchain.cmake.in
@@ -1,4 +1,4 @@
-# Set the system name, either Darwin, Linux, or Windows
+# Set the system name to one of Android, Darwin, FreeBSD, Linux, or Windows
 SET(CMAKE_SYSTEM_NAME @depends@)
 SET(CMAKE_BUILD_TYPE @release_type@)

@@ -18,17 +18,19 @@ SET(CMAKE_FIND_ROOT_PATH @prefix@ /usr)

 SET(ENV{PKG_CONFIG_PATH} @prefix@/lib/pkgconfig)

-SET(LRELEASE_PATH @prefix@/native/bin CACHE FILEPATH "path to lrelease" FORCE)
-
 SET(Readline_ROOT_DIR @prefix@)
 SET(Readline_INCLUDE_DIR @prefix@/include)
 SET(Readline_LIBRARY @prefix@/lib/libreadline.a)
 SET(Terminfo_LIBRARY @prefix@/lib/libtinfo.a)

+SET(LRELEASE_PATH @prefix@/native/bin CACHE FILEPATH "path to lrelease" FORCE)
+
+if(NOT CMAKE_SYSTEM_NAME STREQUAL "Android")
 SET(LIBUNWIND_INCLUDE_DIR @prefix@/include)
 SET(LIBUNWIND_LIBRARIES @prefix@/lib/libunwind.a)
 SET(LIBUNWIND_LIBRARY_DIRS @prefix@/lib)

+if(NOT CMAKE_SYSTEM_NAME STREQUAL "FreeBSD")
 SET(LIBUSB-1.0_LIBRARY @prefix@/lib/libusb-1.0.a)
 SET(LIBUDEV_LIBRARY @prefix@/lib/libudev.a)

@@ -37,6 +39,9 @@ SET(Protobuf_PROTOC_EXECUTABLE @prefix@/native/bin/protoc CACHE FILEPATH "Path t
 SET(Protobuf_INCLUDE_DIR @prefix@/include CACHE PATH "Protobuf include dir")
 SET(Protobuf_INCLUDE_DIRS @prefix@/include CACHE PATH "Protobuf include dir")
 SET(Protobuf_LIBRARY @prefix@/lib/libprotobuf.a CACHE FILEPATH "Protobuf library")
+endif()
+
+endif()

 SET(ZMQ_INCLUDE_PATH @prefix@/include)
 SET(ZMQ_LIB @prefix@/lib/libzmq.a)
@@ -78,6 +83,22 @@ if(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
  SET(CMAKE_OSX_ARCHITECTURES "x86_64")
  SET(LLVM_ENABLE_PIC OFF)
  SET(LLVM_ENABLE_PIE OFF)
+elseif(CMAKE_SYSTEM_NAME STREQUAL "Android")
+  SET(ANDROID TRUE)
+  if(ARCHITECTURE STREQUAL "arm")
+    SET(CMAKE_ANDROID_ARCH_ABI "armeabi-v7a")
+    SET(CMAKE_SYSTEM_PROCESSOR "armv7-a")
+    SET(CMAKE_ANDROID_ARM_MODE ON)
+    SET(CMAKE_C_COMPILER_TARGET arm-linux-androideabi)
+    SET(CMAKE_CXX_COMPILER_TARGET arm-linux-androideabi)
+    SET(_CMAKE_TOOLCHAIN_PREFIX arm-linux-androideabi-)
+  elseif(ARCHITECTURE STREQUAL "aarch64")
+    SET(CMAKE_ANDROID_ARCH_ABI "arm64-v8a")
+    SET(CMAKE_SYSTEM_PROCESSOR "aarch64")
+  endif()
+  SET(CMAKE_ANDROID_STANDALONE_TOOLCHAIN @prefix@/native)
+  SET(CMAKE_C_COMPILER "${_CMAKE_TOOLCHAIN_PREFIX}clang")
+  SET(CMAKE_CXX_COMPILER "${_CMAKE_TOOLCHAIN_PREFIX}clang++")
 else()
  SET(CMAKE_C_COMPILER @CC@)
  SET(CMAKE_CXX_COMPILER @CXX@)
@@ -89,13 +110,21 @@ if(ARCHITECTURE STREQUAL "arm")
  set(ARM_ID "armv7-a")
  set(BUILD_64 OFF)
  set(CMAKE_BUILD_TYPE release)
-  set(BUILD_TAG "linux-armv7")
+  if(ANDROID)
+    set(BUILD_TAG "android-armv7")
+  else()
+    set(BUILD_TAG "linux-armv7")
+  endif()
  set(ARM7)
 elseif(ARCHITECTURE STREQUAL "aarch64")
  set(ARCH "armv8-a")
  set(ARM ON)
  set(ARM_ID "armv8-a")
-  set(BUILD_TAG "linux-armv8")
+  if(ANDROID)
+    set(BUILD_TAG "android-armv8")
+  else()
+    set(BUILD_TAG "linux-armv8")
+  endif()
  set(BUILD_64 ON)
 endif()

--- a/contrib/epee/include/math_helper.h
+++ b/contrib/epee/include/math_helper.h
@@ -32,6 +32,7 @@

 #include <list>
 #include <numeric>
+#include <random>
 #include <boost/timer/timer.hpp>
 #include <boost/uuid/uuid.hpp>
 #include <boost/uuid/random_generator.hpp>
@@ -230,7 +231,7 @@ namespace math_helper
 		}

 	}
-	template<uint64_t scale, int default_interval, bool start_immediate = true>
+	template<typename get_interval, bool start_immediate = true>
 	class once_a_time
 	{
    uint64_t get_time() const
@@ -251,12 +252,18 @@ namespace math_helper
 #endif
    }

+    void set_next_interval()
+    {
+      m_interval = get_interval()();
+    }
+
 	public:
-		once_a_time():m_interval(default_interval * scale)
+		once_a_time()
 		{
 			m_last_worked_time = 0;
      if(!start_immediate)
        m_last_worked_time = get_time();
+      set_next_interval();
 		}

    void trigger()
@@ -273,6 +280,7 @@ namespace math_helper
 			{
 				bool res = functr();
 				m_last_worked_time = get_time();
+        set_next_interval();
 				return res;
 			}
 			return true;
@@ -283,9 +291,13 @@ namespace math_helper
 		uint64_t m_interval;
 	};

+  template<uint64_t N> struct get_constant_interval { public: uint64_t operator()() const { return N; } };
+
  template<int default_interval, bool start_immediate = true>
-  class once_a_time_seconds: public once_a_time<1000000, default_interval, start_immediate> {};
+  class once_a_time_seconds: public once_a_time<get_constant_interval<default_interval * (uint64_t)1000000>, start_immediate> {};
  template<int default_interval, bool start_immediate = true>
-  class once_a_time_milliseconds: public once_a_time<1000, default_interval, start_immediate> {};
+  class once_a_time_milliseconds: public once_a_time<get_constant_interval<default_interval * (uint64_t)1000>, start_immediate> {};
+  template<typename get_interval, bool start_immediate = true>
+  class once_a_time_seconds_range: public once_a_time<get_interval, start_immediate> {};
 }
 }
--- a/contrib/epee/include/net/abstract_tcp_server2.inl
+++ b/contrib/epee/include/net/abstract_tcp_server2.inl
@@ -410,7 +410,12 @@ PRAGMA_WARNING_DISABLE_VS(4355)
      else
      {
        _dbg3("[sock " << socket().native_handle() << "] peer closed connection");
-        if (m_ready_to_close)
+        bool do_shutdown = false;
+        CRITICAL_REGION_BEGIN(m_send_que_lock);
+        if(!m_send_que.size())
+          do_shutdown = true;
+        CRITICAL_REGION_END();
+        if (m_ready_to_close || do_shutdown)
          shutdown();
      }
      m_ready_to_close = true;
@@ -470,6 +475,7 @@ PRAGMA_WARNING_DISABLE_VS(4355)
      {
        MERROR("SSL handshake failed");
        boost::interprocess::ipcdetail::atomic_write32(&m_want_close_connection, 1);
+        m_ready_to_close = true;
        bool do_shutdown = false;
        CRITICAL_REGION_BEGIN(m_send_que_lock);
        if(!m_send_que.size())
--- a/contrib/gitian/README.md
+++ b/contrib/gitian/README.md
@@ -126,7 +126,7 @@ Setup for LXC:

 ```bash
 GH_USER=fluffypony
-VERSION=v0.15.0.0
+VERSION=v0.15.0.1

 ./gitian-build.py --setup $GH_USER $VERSION
 ```
@@ -167,7 +167,7 @@ If all went well, this produces a number of (uncommitted) `.assert` files in the
 Checking your work
 ------------------

-Take a look in the assert files and note the SHA256 checksums listed there. eg for `v0.15.0.0` you should get this checksum:
+Take a look in the assert files and note the SHA256 checksums listed there. eg for `v0.15.0.1` you should get this checksum:

 ```
 2b95118f53d98d542a85f8732b84ba13b3cd20517ccb40332b0edd0ddf4f8c62  monero-x86_64-linux-gnu.tar.gz
@@ -183,7 +183,7 @@ If you chose to do detached signing using `--detach-sign` above (recommended), y

 ```bash
 GH_USER=fluffypony
-VERSION=v0.15.0.0
+VERSION=v0.15.0.1

 gpg --detach-sign ${VERSION}-linux/${GH_USER}/monero-linux-*-build.assert
 gpg --detach-sign ${VERSION}-win/${GH_USER}/monero-win-*-build.assert
@@ -226,3 +226,19 @@ To get all build options run:
 ./gitian-build.py --help
 ```

+Doing Successive Builds
+-----------------------
+
+If you need to do multiple iterations (while developing/testing) you can use the
+`--rebuild` option instead of `--build` on subsequent iterations. This skips the
+initial check for the freshness of the depends tools. In particular, doing this
+check all the time prevents rebuilding when you have no network access.
+
+
+Local-Only Builds
+-----------------
+
+If you need to run builds while disconnected from the internet, make sure you have
+local up-to-date repos in advance. Then specify your local repo using the `--url`
+option when building. This will avoid attempts to git pull across a network.
+
--- a/contrib/gitian/gitian-android.yml
+++ b/contrib/gitian/gitian-android.yml
@@ -0,0 +1,136 @@
+---
+name: "monero-android-0.15"
+enable_cache: true
+suites:
+- "bionic"
+architectures:
+- "amd64"
+packages:
+- "curl"
+- "gperf"
+- "gcc-7"
+- "g++-7"
+- "gcc"
+- "g++"
+- "binutils-gold"
+- "git"
+- "pkg-config"
+- "build-essential"
+- "autoconf"
+- "libtool"
+- "automake"
+- "faketime"
+- "bsdmainutils"
+- "ca-certificates"
+- "python"
+- "cmake"
+- "ccache"
+- "protobuf-compiler"
+- "libdbus-1-dev"
+- "libharfbuzz-dev"
+- "libprotobuf-dev"
+- "python3-zmq"
+- "unzip"
+remotes:
+- "url": "https://github.com/monero-project/monero.git"
+  "dir": "monero"
+files: []
+script: |
+
+  WRAP_DIR=$HOME/wrapped
+  HOSTS="arm-linux-android aarch64-linux-android"
+  FAKETIME_HOST_PROGS="clang clang++ ar nm"
+  FAKETIME_PROGS="date"
+  HOST_CFLAGS="-O2 -g"
+  HOST_CXXFLAGS="-O2 -g"
+  HOST_LDFLAGS=-static-libstdc++
+
+  export GZIP="-9n"
+  export TZ="UTC"
+  export BUILD_DIR=`pwd`
+  mkdir -p ${WRAP_DIR}
+  if test -n "$GBUILD_CACHE_ENABLED"; then
+    export SOURCES_PATH=${GBUILD_COMMON_CACHE}
+    export BASE_CACHE=${GBUILD_PACKAGE_CACHE}
+    mkdir -p ${BASE_CACHE} ${SOURCES_PATH}
+  fi
+
+  export ZERO_AR_DATE=1
+
+  function create_global_faketime_wrappers {
+  for prog in ${FAKETIME_PROGS}; do
+    echo '#!/usr/bin/env bash' > ${WRAP_DIR}/${prog}
+    echo "REAL=\`which -a ${prog} | grep -v ${WRAP_DIR}/${prog} | head -1\`" >> ${WRAP_DIR}/${prog}
+    echo 'export LD_PRELOAD=/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1' >> ${WRAP_DIR}/${prog}
+    echo "export FAKETIME=\"$1\"" >> ${WRAP_DIR}/${prog}
+    echo "\$REAL \$@" >> $WRAP_DIR/${prog}
+    chmod +x ${WRAP_DIR}/${prog}
+  done
+  }
+
+  function create_per-host_faketime_wrappers {
+  for i in $HOSTS; do
+    ABI=$i
+    if expr $i : arm- > /dev/null
+    then
+      ABI=$i"eabi"
+    fi
+    NDKDIR="${BUILD_DIR}/monero/contrib/depends/$i/native/bin"
+    for prog in ${FAKETIME_HOST_PROGS}; do
+        WRAPPER=${WRAP_DIR}/${ABI}-${prog}
+        echo '#!/usr/bin/env bash' > ${WRAPPER}
+        echo 'export LD_PRELOAD=/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1' >> ${WRAPPER}
+        echo "export FAKETIME=\"$1\"" >> ${WRAPPER}
+        echo "$NDKDIR/${ABI}-$prog \$@" >> ${WRAPPER}
+        chmod +x ${WRAPPER}
+    done
+  done
+  }
+
+  # Faketime for depends so intermediate results are comparable
+  export PATH_orig=${PATH}
+  create_global_faketime_wrappers "2000-01-01 12:00:00"
+  create_per-host_faketime_wrappers "2000-01-01 12:00:00"
+  export PATH=${WRAP_DIR}:${PATH}
+
+  # gcc 7+ honors SOURCE_DATE_EPOCH, no faketime needed
+  export SOURCE_DATE_EPOCH=`date -d 2000-01-01T12:00:00 +%s`
+
+  git config --global core.abbrev 9
+  cd monero
+  # Set the version string that gets added to the tar archive name
+  version="`git describe`"
+  if [[ $version == *"-"*"-"* ]]; then
+    version="`git rev-parse --short=9 HEAD`"
+    version="`echo $version | head -c 9`"
+  fi
+
+  BASEPREFIX=`pwd`/contrib/depends
+  # Build dependencies for each host
+  export TAR_OPTIONS=--mtime=2000-01-01T12:00:00
+  for i in $HOSTS; do
+    make ${MAKEOPTS} -C ${BASEPREFIX} HOST="${i}"
+  done
+
+  # Faketime for binaries
+  export PATH=${PATH_orig}
+  create_global_faketime_wrappers "${REFERENCE_DATETIME}"
+  create_per-host_faketime_wrappers "${REFERENCE_DATETIME}"
+
+  # Build in a new dir for each host
+  export TAR_OPTIONS=--mtime=${REFERENCE_DATE}T${REFERENCE_TIME}
+  for i in ${HOSTS}; do
+    export PATH=${WRAP_DIR}:${BASEPREFIX}/${i}/native/bin:${PATH_orig}
+    mkdir build && cd build
+    cmake .. -DCMAKE_TOOLCHAIN_FILE=${BASEPREFIX}/${i}/share/toolchain.cmake -DCMAKE_BUILD_TYPE=Release
+    make ${MAKEOPTS}
+    chmod 755 bin/*
+    cp ../LICENSE bin
+    chmod 644 bin/LICENSE
+    DISTNAME=monero-${i}-${version}
+    mv bin ${DISTNAME}
+    find ${DISTNAME}/ | sort | tar --no-recursion --owner=0 --group=0 -c -T - | bzip2 -9 > ${OUTDIR}/${DISTNAME}.tar.bz2
+    cd ..
+    rm -rf build
+  done
+
--- a/contrib/gitian/gitian-build.py
+++ b/contrib/gitian/gitian-build.py
@@ -8,6 +8,12 @@ import sys
 gsigs = 'https://github.com/monero-project/gitian.sigs.git'
 gbrepo = 'https://github.com/devrandom/gitian-builder.git'

+platforms = {'l': ['Linux', 'linux', 'tar.bz2'],
+        'a': ['Android', 'android', 'tar.bz2'],
+        'f': ['FreeBSD', 'freebsd', 'tar.bz2'],
+        'w': ['Windows', 'win', 'zip'],
+        'm': ['MacOS', 'osx', 'tar.bz2'] }
+
 def setup():
    global args, workdir
    programs = ['apt-cacher-ng', 'ruby', 'git', 'make', 'wget']
@@ -22,11 +28,7 @@ def setup():
    if not os.path.isdir('builder'):
        subprocess.check_call(['git', 'clone', gbrepo, 'builder'])
    os.chdir('builder')
-    subprocess.check_call(['git', 'config', 'user.email', 'gitianuser@localhost'])
-    subprocess.check_call(['git', 'config', 'user.name', 'gitianuser'])
-    subprocess.check_call(['git', 'checkout', '963322de8420c50502c4cc33d4d7c0d84437b576'])
-    subprocess.check_call(['git', 'fetch', 'origin', '72c51f0bd2adec4eedab4dbd06c9229b9c4eb0e3'])
-    subprocess.check_call(['git', 'cherry-pick', '72c51f0bd2adec4eedab4dbd06c9229b9c4eb0e3'])
+    subprocess.check_call(['git', 'checkout', 'c0f77ca018cb5332bfd595e0aff0468f77542c23'])
    os.makedirs('inputs', exist_ok=True)
    os.chdir('inputs')
    if not os.path.isdir('monero'):
@@ -46,11 +48,46 @@ def setup():
        print('Reboot is required')
        sys.exit(0)

+def rebuild():
+    global args, workdir
+
+    print('\nBuilding Dependencies\n')
+    os.makedirs('../out/' + args.version, exist_ok=True)
+
+
+    for i in args.os:
+        if i is 'm' and args.nomac:
+            continue
+
+        os_name = platforms[i][0]
+        tag_name = platforms[i][1]
+        suffix = platforms[i][2]
+
+        print('\nCompiling ' + args.version + ' ' + os_name)
+        infile = 'inputs/monero/contrib/gitian/gitian-' + tag_name + '.yml'
+        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'monero='+args.commit, '--url', 'monero='+args.url, infile])
+        subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-linux', '--destination', '../sigs/', infile])
+        subprocess.check_call('mv build/out/monero-*.' + suffix + ' ../out/'+args.version, shell=True)
+        print('Moving var/install.log to var/install-' + tag_name + '.log')
+        subprocess.check_call('mv var/install.log var/install-' + tag_name + '.log', shell=True)
+        print('Moving var/build.log to var/build-' + tag_name + '.log')
+        subprocess.check_call('mv var/build.log var/build-' + tag_name + '.log', shell=True)
+
+    os.chdir(workdir)
+
+    if args.commit_files:
+        print('\nCommitting '+args.version+' Unsigned Sigs\n')
+        os.chdir('sigs')
+        for i, v in platforms:
+            subprocess.check_call(['git', 'add', args.version+'-'+v[1]+'/'+args.signer])
+        subprocess.check_call(['git', 'commit', '-m', 'Add '+args.version+' unsigned sigs for '+args.signer])
+        os.chdir(workdir)
+
+
 def build():
    global args, workdir

-    os.makedirs('out/' + args.version, exist_ok=True)
-    print('\nBuilding Dependencies\n')
+    print('\nChecking Depends Freshness\n')
    os.chdir('builder')
    os.makedirs('inputs', exist_ok=True)

@@ -60,45 +97,16 @@ def build():
    subprocess.check_output(["echo 'f9a8cdb38b9c309326764ebc937cba1523a3a751a7ab05df3ecc99d18ae466c9 inputs/osslsigncode-1.7.1.tar.gz' | sha256sum -c"], shell=True)
    subprocess.check_call(['make', '-C', 'inputs/monero/contrib/depends', 'download', 'SOURCES_PATH=' + os.getcwd() + '/cache/common'])

-    if args.linux:
-        print('\nCompiling ' + args.version + ' Linux')
-        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'monero='+args.commit, '--url', 'monero='+args.url, 'inputs/monero/contrib/gitian/gitian-linux.yml'])
-        subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-linux', '--destination', '../sigs/', 'inputs/monero/contrib/gitian/gitian-linux.yml'])
-        subprocess.check_call('mv build/out/monero-*.tar.bz2 ../out/'+args.version, shell=True)
+    rebuild()

-    if args.windows:
-        print('\nCompiling ' + args.version + ' Windows')
-        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'monero='+args.commit, '--url', 'monero='+args.url, 'inputs/monero/contrib/gitian/gitian-win.yml'])
-        subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-win', '--destination', '../sigs/', 'inputs/monero/contrib/gitian/gitian-win.yml'])
-        subprocess.check_call('mv build/out/monero*.zip ../out/'+args.version, shell=True)
-
-    if args.macos:
-        print('\nCompiling ' + args.version + ' MacOS')
-        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'monero='+args.commit, '--url', 'monero'+args.url, 'inputs/monero/contrib/gitian/gitian-osx.yml'])
-        subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-osx', '--destination', '../sigs/', 'inputs/monero/contrib/gitian/gitian-osx.yml'])
-        subprocess.check_call('mv build/out/monero*.tar.bz2 ../out/'+args.version, shell=True)
-
-    os.chdir(workdir)
-
-    if args.commit_files:
-        print('\nCommitting '+args.version+' Unsigned Sigs\n')
-        os.chdir('sigs')
-        subprocess.check_call(['git', 'add', args.version+'-linux/'+args.signer])
-        subprocess.check_call(['git', 'add', args.version+'-win/'+args.signer])
-        subprocess.check_call(['git', 'add', args.version+'-osx/'+args.signer])
-        subprocess.check_call(['git', 'commit', '-m', 'Add '+args.version+' unsigned sigs for '+args.signer])
-        os.chdir(workdir)

 def verify():
    global args, workdir
    os.chdir('builder')

-    print('\nVerifying v'+args.version+' Linux\n')
-    subprocess.check_call(['bin/gverify', '-v', '-d', '../sigs/', '-r', args.version+'-linux', 'inputs/monero/contrib/gitian/gitian-linux.yml'])
-    print('\nVerifying v'+args.version+' Windows\n')
-    subprocess.check_call(['bin/gverify', '-v', '-d', '../sigs/', '-r', args.version+'-win', 'inputs/monero/contrib/gitian/gitian-win.yml'])
-    print('\nVerifying v'+args.version+' MacOS\n')
-    subprocess.check_call(['bin/gverify', '-v', '-d', '../sigs/', '-r', args.version+'-osx', 'inputs/monero/contrib/gitian/gitian-osx.yml'])
+    for i, v in platforms:
+        print('\nVerifying v'+args.version+' '+v[0]+'\n')
+        subprocess.check_call(['bin/gverify', '-v', '-d', '../sigs/', '-r', args.version+'-'+v[1], 'inputs/monero/contrib/gitian/gitian-'+v[1]+'.yml'])
    os.chdir(workdir)

 def main():
@@ -111,7 +119,9 @@ def main():
    parser.add_argument('-v', '--verify', action='store_true', dest='verify', help='Verify the Gitian build')
    parser.add_argument('-b', '--build', action='store_true', dest='build', help='Do a Gitian build')
    parser.add_argument('-B', '--buildsign', action='store_true', dest='buildsign', help='Build both signed and unsigned binaries')
-    parser.add_argument('-o', '--os', dest='os', default='lwm', help='Specify which Operating Systems the build is for. Default is %(default)s. l for Linux, w for Windows, m for MacOS')
+    parser.add_argument('-o', '--os', dest='os', default='lafwm', help='Specify which Operating Systems the build is for. Default is %(default)s. l for Linux, a for Android, f for FreeBSD, w for Windows, m for MacOS')
+    parser.add_argument('-r', '--rebuild', action='store_true', dest='rebuild', help='Redo a Gitian build')
+    parser.add_argument('-R', '--rebuildsign', action='store_true', dest='rebuildsign', help='Redo and sign a Gitian build')
    parser.add_argument('-j', '--jobs', dest='jobs', default='2', help='Number of processes to use. Default %(default)s')
    parser.add_argument('-m', '--memory', dest='memory', default='2000', help='Memory to allocate in MiB. Default %(default)s')
    parser.add_argument('-k', '--kvm', action='store_true', dest='kvm', help='Use KVM instead of LXC')
@@ -126,16 +136,16 @@ def main():
    args = parser.parse_args()
    workdir = os.getcwd()

-    args.linux = 'l' in args.os
-    args.windows = 'w' in args.os
-    args.macos = 'm' in args.os
-
    args.is_bionic = b'bionic' in subprocess.check_output(['lsb_release', '-cs'])

    if args.buildsign:
        args.build = True
        args.sign = True

+    if args.rebuildsign:
+        args.rebuild = True
+        args.sign = True
+
    if args.kvm and args.docker:
        raise Exception('Error: cannot have both kvm and docker')

@@ -152,9 +162,11 @@ def main():
            os.environ['LXC_GUEST_IP'] = '10.0.3.5'

    # Disable MacOS build if no SDK found
-    if args.build and args.macos and not os.path.isfile('builder/inputs/MacOSX10.11.sdk.tar.gz'):
-        print('Cannot build for MacOS, SDK does not exist. Will build for other OSes')
-        args.macos = False
+    args.nomac = False
+    if 'm' in args.os and not os.path.isfile('builder/inputs/MacOSX10.11.sdk.tar.gz'):
+        if args.build:
+            print('Cannot build for MacOS, SDK does not exist. Will build for other OSes')
+            args.nomac = True

    script_name = os.path.basename(sys.argv[0])
    # Signer and version shouldn't be empty
@@ -189,6 +201,10 @@ def main():
    if args.build:
        build()

+    if args.rebuild:
+        os.chdir('builder')
+        rebuild()
+
    if args.verify:
        verify()

--- a/contrib/gitian/gitian-freebsd.yml
+++ b/contrib/gitian/gitian-freebsd.yml
@@ -0,0 +1,133 @@
+---
+name: "monero-freebsd-0.15"
+enable_cache: true
+suites:
+- "bionic"
+architectures:
+- "amd64"
+packages:
+- "curl"
+- "clang-8"
+- "gperf"
+- "gcc-7"
+- "g++-7"
+- "gcc"
+- "g++"
+- "binutils-gold"
+- "git"
+- "pkg-config"
+- "build-essential"
+- "autoconf"
+- "libtool"
+- "automake"
+- "faketime"
+- "bsdmainutils"
+- "ca-certificates"
+- "python"
+- "cmake"
+- "ccache"
+- "protobuf-compiler"
+- "libdbus-1-dev"
+- "libharfbuzz-dev"
+- "libprotobuf-dev"
+- "python3-zmq"
+remotes:
+- "url": "https://github.com/monero-project/monero.git"
+  "dir": "monero"
+files: []
+script: |
+
+  WRAP_DIR=$HOME/wrapped
+  HOSTS="x86_64-unknown-freebsd"
+  FAKETIME_HOST_PROGS=""
+  FAKETIME_PROGS="clang-8 clang++-8 date"
+  HOST_CFLAGS="-O2 -g"
+  HOST_CXXFLAGS="-O2 -g"
+  HOST_LDFLAGS=-static-libstdc++
+
+  export GZIP="-9n"
+  export TZ="UTC"
+  export BUILD_DIR=`pwd`
+  mkdir -p ${WRAP_DIR}
+  if test -n "$GBUILD_CACHE_ENABLED"; then
+    export SOURCES_PATH=${GBUILD_COMMON_CACHE}
+    export BASE_CACHE=${GBUILD_PACKAGE_CACHE}
+    mkdir -p ${BASE_CACHE} ${SOURCES_PATH}
+  fi
+
+  export ZERO_AR_DATE=1
+
+  function create_global_faketime_wrappers {
+  for prog in ${FAKETIME_PROGS}; do
+    echo '#!/usr/bin/env bash' > ${WRAP_DIR}/${prog}
+    echo "REAL=\`which -a ${prog} | grep -v ${WRAP_DIR}/${prog} | head -1\`" >> ${WRAP_DIR}/${prog}
+    echo 'export LD_PRELOAD=/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1' >> ${WRAP_DIR}/${prog}
+    echo "export FAKETIME=\"$1\"" >> ${WRAP_DIR}/${prog}
+    echo "\$REAL \$@" >> $WRAP_DIR/${prog}
+    chmod +x ${WRAP_DIR}/${prog}
+  done
+  }
+
+  function create_per-host_faketime_wrappers {
+  for i in $HOSTS; do
+    for prog in ${FAKETIME_HOST_PROGS}; do
+        WRAPPER=${WRAP_DIR}/${i}-${prog}
+        echo '#!/usr/bin/env bash' > ${WRAPPER}
+        echo "REAL=\`which -a ${i}-${prog} | grep -v ${WRAP_DIR}/${i}-${prog} | head -1\`" >> ${WRAPPER}
+        echo 'export LD_PRELOAD=/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1' >> ${WRAPPER}
+        echo "export FAKETIME=\"$1\"" >> ${WRAPPER}
+        echo "$NDKDIR/${ABI}-$prog \$@" >> ${WRAPPER}
+        chmod +x ${WRAPPER}
+    done
+  done
+  }
+
+  # Faketime for depends so intermediate results are comparable
+  export PATH_orig=${PATH}
+  create_global_faketime_wrappers "2000-01-01 12:00:00"
+  create_per-host_faketime_wrappers "2000-01-01 12:00:00"
+  export PATH=${WRAP_DIR}:${PATH}
+
+  # gcc 7+ honors SOURCE_DATE_EPOCH, no faketime needed
+  export SOURCE_DATE_EPOCH=`date -d 2000-01-01T12:00:00 +%s`
+
+  git config --global core.abbrev 9
+  cd monero
+  # Set the version string that gets added to the tar archive name
+  version="`git describe`"
+  if [[ $version == *"-"*"-"* ]]; then
+    version="`git rev-parse --short=9 HEAD`"
+    version="`echo $version | head -c 9`"
+  fi
+
+  BASEPREFIX=`pwd`/contrib/depends
+  # Build dependencies for each host
+  export TAR_OPTIONS=--mtime=2000-01-01T12:00:00
+  for i in $HOSTS; do
+    make ${MAKEOPTS} -C ${BASEPREFIX} HOST="${i}"
+  done
+
+  # Faketime for binaries
+  export PATH=${PATH_orig}
+  create_global_faketime_wrappers "${REFERENCE_DATETIME}"
+  create_per-host_faketime_wrappers "${REFERENCE_DATETIME}"
+
+  ORIGPATH="$PATH"
+  # Build in a new dir for each host
+  export SOURCE_DATE_EPOCH=`date -d ${REFERENCE_DATE}T${REFERENCE_TIME} +%s`
+  export TAR_OPTIONS=--mtime=${REFERENCE_DATE}T${REFERENCE_TIME}
+  for i in ${HOSTS}; do
+    export PATH=${WRAP_DIR}:${BASEPREFIX}/${i}/native/bin:${ORIGPATH}
+    mkdir build && cd build
+    cmake .. -DCMAKE_TOOLCHAIN_FILE=${BASEPREFIX}/${i}/share/toolchain.cmake -DCMAKE_BUILD_TYPE=Release
+    make ${MAKEOPTS}
+    chmod 755 bin/*
+    cp ../LICENSE bin
+    chmod 644 bin/LICENSE
+    DISTNAME=monero-${i}-${version}
+    mv bin ${DISTNAME}
+    find ${DISTNAME}/ | sort | tar --no-recursion --owner=0 --group=0 -c -T - | bzip2 -9 > ${OUTDIR}/${DISTNAME}.tar.bz2
+    cd ..
+    rm -rf build
+  done
+
--- a/contrib/gitian/gitian-linux.yml
+++ b/contrib/gitian/gitian-linux.yml
@@ -50,14 +50,13 @@ script: |

  WRAP_DIR=$HOME/wrapped
  HOSTS="x86_64-linux-gnu arm-linux-gnueabihf aarch64-linux-gnu i686-linux-gnu"
-  FAKETIME_HOST_PROGS="gcc g++"
-  FAKETIME_PROGS="date ar ranlib nm"
+  FAKETIME_HOST_PROGS=""
+  FAKETIME_PROGS="date"
  HOST_CFLAGS="-O2 -g"
  HOST_CXXFLAGS="-O2 -g"
  HOST_LDFLAGS=-static-libstdc++

  export GZIP="-9n"
-  export TAR_OPTIONS="--mtime="$REFERENCE_DATE\\\ $REFERENCE_TIME""
  export TZ="UTC"
  export BUILD_DIR=`pwd`
  mkdir -p ${WRAP_DIR}
@@ -105,29 +104,15 @@ script: |

  # x86 needs /usr/include/i386-linux-gnu/asm pointed to /usr/include/x86_64-linux-gnu/asm,
  # but we can't write there. Instead, create a link here and force it to be included in the
-  # search paths by wrapping gcc/g++.
+  # search paths.
+  # This problem goes away if linux-libc-dev:i386 pkg exists, but it's not in bionic.

-  mkdir -p $EXTRA_INCLUDES_BASE/i686-pc-linux-gnu
-  rm -f $WRAP_DIR/extra_includes/i686-pc-linux-gnu/asm
-  ln -s /usr/include/x86_64-linux-gnu/asm $EXTRA_INCLUDES_BASE/i686-pc-linux-gnu/asm
+  mkdir -p $EXTRA_INCLUDES_BASE/i686-linux-gnu
+  rm -f $WRAP_DIR/extra_includes/i686-linux-gnu/asm
+  ln -s /usr/include/x86_64-linux-gnu/asm $EXTRA_INCLUDES_BASE/i686-linux-gnu/asm

-  for prog in gcc g++; do
-  rm -f ${WRAP_DIR}/${prog}
-  cat << EOF > ${WRAP_DIR}/${prog}
-  #!/usr/bin/env bash
-  REAL="`which -a ${prog}-7 | grep -v ${WRAP_DIR}/${prog} | head -1`"
-  for var in "\$@"
-  do
-    if [ "\$var" = "-m32" ]; then
-      export C_INCLUDE_PATH="$EXTRA_INCLUDES_BASE/i686-pc-linux-gnu"
-      export CPLUS_INCLUDE_PATH="$EXTRA_INCLUDES_BASE/i686-pc-linux-gnu"
-      break
-    fi
-  done
-  \$REAL \$@
-  EOF
-  chmod +x ${WRAP_DIR}/${prog}
-  done
+  # gcc 7+ honors SOURCE_DATE_EPOCH, no faketime needed
+  export SOURCE_DATE_EPOCH=`date -d 2000-01-01T12:00:00 +%s`

  git config --global core.abbrev 9
  cd monero
@@ -140,13 +125,17 @@ script: |

  BASEPREFIX=`pwd`/contrib/depends
  # Build dependencies for each host
+  export TAR_OPTIONS=--mtime=2000-01-01T12:00:00
  for i in $HOSTS; do
    EXTRA_INCLUDES="$EXTRA_INCLUDES_BASE/$i"
    if [ -d "$EXTRA_INCLUDES" ]; then
-      export HOST_ID_SALT="$EXTRA_INCLUDES"
+      export C_INCLUDE_PATH="$EXTRA_INCLUDES"
+      export CPLUS_INCLUDE_PATH="$EXTRA_INCLUDES"
+    else
+      unset C_INCLUDE_PATH
+      unset CPLUS_INCLUDE_PATH
    fi
    make ${MAKEOPTS} -C ${BASEPREFIX} HOST="${i}" V=1
-    unset HOST_ID_SALT
  done

  # Faketime for binaries
@@ -157,14 +146,27 @@ script: |

  ORIGPATH="$PATH"
  # Build in a new dir for each host
+  export SOURCE_DATE_EPOCH=`date -d ${REFERENCE_DATE}T${REFERENCE_TIME} +%s`
+  export TAR_OPTIONS=--mtime=${REFERENCE_DATE}T${REFERENCE_TIME}
  for i in ${HOSTS}; do
    export PATH=${BASEPREFIX}/${i}/native/bin:${ORIGPATH}
    mkdir build && cd build
+    EXTRA_INCLUDES="$EXTRA_INCLUDES_BASE/$i"
+    if [ -d "$EXTRA_INCLUDES" ]; then
+      export C_INCLUDE_PATH="$EXTRA_INCLUDES"
+      export CPLUS_INCLUDE_PATH="$EXTRA_INCLUDES"
+    else
+      unset C_INCLUDE_PATH
+      unset CPLUS_INCLUDE_PATH
+    fi
    cmake .. -DCMAKE_TOOLCHAIN_FILE=${BASEPREFIX}/${i}/share/toolchain.cmake -DBACKCOMPAT=ON
    make ${MAKEOPTS}
+    chmod 755 bin/*
+    cp ../LICENSE bin
+    chmod 644 bin/LICENSE
    DISTNAME=monero-${i}-${version}
    mv bin ${DISTNAME}
-    find ${DISTNAME}/ | sort | tar --no-recursion --mode='u+rw,go+r-w,a+X' --owner=0 --group=0 -c -T - | bzip2 -9 > ${OUTDIR}/${DISTNAME}.tar.bz2
+    find ${DISTNAME}/ | sort | tar --no-recursion --owner=0 --group=0 -c -T - | bzip2 -9 > ${OUTDIR}/${DISTNAME}.tar.bz2
    cd ..
    rm -rf build
  done
--- a/contrib/gitian/gitian-osx.yml
+++ b/contrib/gitian/gitian-osx.yml
@@ -32,10 +32,9 @@ script: |
  WRAP_DIR=$HOME/wrapped
  HOSTS="x86_64-apple-darwin11"
  FAKETIME_HOST_PROGS=""
-  FAKETIME_PROGS="ar ranlib date dmg genisoimage"
+  FAKETIME_PROGS="ar ranlib date dmg genisoimage python"

  export GZIP="-9n"
-  export TAR_OPTIONS="--mtime="$REFERENCE_DATE\\\ $REFERENCE_TIME""
  export TZ="UTC"
  export BUILD_DIR=`pwd`
  mkdir -p ${WRAP_DIR}
@@ -92,6 +91,7 @@ script: |
  tar -C ${BASEPREFIX}/SDKs -xf ${BUILD_DIR}/MacOSX10.11.sdk.tar.gz

  # Build dependencies for each host
+  export TAR_OPTIONS=--mtime=2000-01-01T12:00:00
  for i in $HOSTS; do
    make ${MAKEOPTS} -C ${BASEPREFIX} HOST="${i}"
  done
@@ -104,14 +104,18 @@ script: |

  ORIGPATH="$PATH"
  # Build in a new dir for each host
+  export TAR_OPTIONS=--mtime=${REFERENCE_DATE}T${REFERENCE_TIME}
  for i in ${HOSTS}; do
    export PATH=${BASEPREFIX}/${i}/native/bin:${ORIGPATH}
    mkdir build && cd build
    cmake .. -DCMAKE_TOOLCHAIN_FILE=${BASEPREFIX}/${i}/share/toolchain.cmake
    make ${MAKEOPTS}
+    chmod 755 bin/*
+    cp ../LICENSE bin
+    chmod 644 bin/LICENSE
    DISTNAME=monero-${i}-${version}
    mv bin ${DISTNAME}
-    find ${DISTNAME}/ | sort | tar --no-recursion --mode='u+rw,go+r-w,a+X' --owner=0 --group=0 -c -T - | bzip2 -9 > ${OUTDIR}/${DISTNAME}.tar.bz2
+    find ${DISTNAME}/ | sort | tar --no-recursion --owner=0 --group=0 -c -T - | bzip2 -9 > ${OUTDIR}/${DISTNAME}.tar.bz2
    cd ..
    rm -rf build
  done
--- a/contrib/gitian/gitian-win.yml
+++ b/contrib/gitian/gitian-win.yml
@@ -22,6 +22,19 @@ packages:
 - "python"
 - "rename"
 - "cmake"
+alternatives:
+-
+  package: "i686-w64-mingw32-g++"
+  path: "/usr/bin/i686-w64-mingw32-g++-posix"
+-
+  package: "i686-w64-mingw32-gcc"
+  path: "/usr/bin/i686-w64-mingw32-gcc-posix"
+-
+  package: "x86_64-w64-mingw32-g++"
+  path: "/usr/bin/x86_64-w64-mingw32-g++-posix"
+-
+  package: "x86_64-w64-mingw32-gcc"
+  path: "/usr/bin/x86_64-w64-mingw32-gcc-posix"
 remotes:
 - "url": "https://github.com/monero-project/monero.git"
  "dir": "monero"
@@ -29,13 +42,12 @@ files: []
 script: |
  WRAP_DIR=$HOME/wrapped
  HOSTS="i686-w64-mingw32 x86_64-w64-mingw32"
-  FAKETIME_HOST_PROGS="ar ranlib nm windres strip objcopy"
+  FAKETIME_HOST_PROGS="windres objcopy"
  FAKETIME_PROGS="date zip"
  HOST_CFLAGS="-O2 -g"
  HOST_CXXFLAGS="-O2 -g"

  export GZIP="-9n"
-  export TAR_OPTIONS="--mtime="$REFERENCE_DATE\\\ $REFERENCE_TIME""
  export TZ="UTC"
  export BUILD_DIR=`pwd`
  mkdir -p ${WRAP_DIR}
@@ -69,37 +81,15 @@ script: |
  done
  }

-  function create_per-host_linker_wrapper {
-  # This is only needed for trusty, as the mingw linker leaks a few bytes of
-  # heap, causing non-determinism. See discussion in https://github.com/bitcoin/bitcoin/pull/6900
-  for i in $HOSTS; do
-    mkdir -p ${WRAP_DIR}/${i}
-    for prog in collect2; do
-        echo '#!/usr/bin/env bash' > ${WRAP_DIR}/${i}/${prog}
-        REAL=$(${i}-gcc -print-prog-name=${prog})
-        echo "export MALLOC_PERTURB_=255" >> ${WRAP_DIR}/${i}/${prog}
-        echo "${REAL} \$@" >> $WRAP_DIR/${i}/${prog}
-        chmod +x ${WRAP_DIR}/${i}/${prog}
-    done
-    for prog in gcc g++; do
-        echo '#!/usr/bin/env bash' > ${WRAP_DIR}/${i}-${prog}
-        echo "REAL=\`which -a ${i}-${prog}-posix | grep -v ${WRAP_DIR}/${i}-${prog} | head -1\`" >> ${WRAP_DIR}/${i}-${prog}
-        echo 'export LD_PRELOAD=/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1' >> ${WRAP_DIR}/${i}-${prog}
-        echo "export FAKETIME=\"$1\"" >> ${WRAP_DIR}/${i}-${prog}
-        echo "export COMPILER_PATH=${WRAP_DIR}/${i}" >> ${WRAP_DIR}/${i}-${prog}
-        echo "\$REAL \$@" >> $WRAP_DIR/${i}-${prog}
-        chmod +x ${WRAP_DIR}/${i}-${prog}
-    done
-  done
-  }
-
  # Faketime for depends so intermediate results are comparable
  export PATH_orig=${PATH}
  create_global_faketime_wrappers "2000-01-01 12:00:00"
  create_per-host_faketime_wrappers "2000-01-01 12:00:00"
-  create_per-host_linker_wrapper "2000-01-01 12:00:00"
  export PATH=${WRAP_DIR}:${PATH}

+  # gcc 7+ honors SOURCE_DATE_EPOCH, no faketime needed
+  export SOURCE_DATE_EPOCH=`date -d 2000-01-01T12:00:00 +%s`
+
  git config --global core.abbrev 9
  cd monero
  # Set the version string that gets added to the tar archive name
@@ -111,6 +101,7 @@ script: |

  BASEPREFIX=`pwd`/contrib/depends
  # Build dependencies for each host
+  export TAR_OPTIONS=--mtime=2000-01-01T12:00:00
  for i in $HOSTS; do
    EXTRA_INCLUDES="$EXTRA_INCLUDES_BASE/$i"
    if [ -d "$EXTRA_INCLUDES" ]; then
@@ -129,11 +120,14 @@ script: |
  ORIGPATH="$PATH"
  # Run cmake and make, for each create a new build/ directory, 
  # compile from there, archive, export and delete the archive again
+  export SOURCE_DATE_EPOCH=`date -d ${REFERENCE_DATE}T${REFERENCE_TIME} +%s`
+  export TAR_OPTIONS=--mtime=${REFERENCE_DATE}T${REFERENCE_TIME}
  for i in ${HOSTS}; do
    export PATH=${BASEPREFIX}/${i}/native/bin:${ORIGPATH}
    mkdir build && cd build
    cmake .. -DCMAKE_TOOLCHAIN_FILE=${BASEPREFIX}/${i}/share/toolchain.cmake
    make ${MAKEOPTS}
+    cp ../LICENSE bin
    DISTNAME=monero-${i}-${version}
    mv bin ${DISTNAME}
    find ${DISTNAME}/ | sort | zip -X@ ${OUTDIR}/${DISTNAME}.zip
--- a/src/blocks/checkpoints.dat
+++ b/src/blocks/checkpoints.dat
--- a/src/cryptonote_core/blockchain.cpp
+++ b/src/cryptonote_core/blockchain.cpp
@@ -5029,7 +5029,7 @@ void Blockchain::cancel()
 }

 #if defined(PER_BLOCK_CHECKPOINT)
-static const char expected_block_hashes_hash[] = "fce1dc7c17f7679f5f447df206b8f5fe2ef6b1a2845e59f650850a0ef00d265f";
+static const char expected_block_hashes_hash[] = "bd0028887df452e58655a68015f74b923f29e9829b0b2c030d64feee67a2f537";
 void Blockchain::load_compiled_in_block_hashes(const GetCheckpointsCallback& get_checkpoints)
 {
  if (get_checkpoints == nullptr || !m_fast_sync)
--- a/src/daemonizer/posix_fork.cpp
+++ b/src/daemonizer/posix_fork.cpp
@@ -127,13 +127,18 @@ void fork(const std::string & pidfile)
  {
    quit("Unable to open output file: " + output);
  }
+#else
+  if (open("/dev/null", O_WRONLY) < 0)
+  {
+    quit("Unable to open /dev/null");
+  }
+#endif

  // Also send standard error to the same log file.
  if (dup(1) < 0)
  {
    quit("Unable to dup output descriptor");
  }
-#endif
 }

 } // namespace posix
--- a/src/ringct/rctTypes.cpp
+++ b/src/ringct/rctTypes.cpp
@@ -31,6 +31,7 @@
 #include "misc_log_ex.h"
 #include "cryptonote_config.h"
 #include "rctTypes.h"
+#include "int-util.h"
 using namespace crypto;
 using namespace std;

@@ -118,40 +119,22 @@ namespace rct {
    //uint long long to 32 byte key
    void d2h(key & amounth, const xmr_amount in) {
        sc_0(amounth.bytes);
-        xmr_amount val = in;
-        int i = 0;
-        while (val != 0) {
-            amounth[i] = (unsigned char)(val & 0xFF);
-            i++;
-            val /= (xmr_amount)256;
-        }
+        memcpy_swap64le(amounth.bytes, &in, 1);
    }
    
    //uint long long to 32 byte key
    key d2h(const xmr_amount in) {
        key amounth;
-        sc_0(amounth.bytes);
-        xmr_amount val = in;
-        int i = 0;
-        while (val != 0) {
-            amounth[i] = (unsigned char)(val & 0xFF);
-            i++;
-            val /= (xmr_amount)256;
-        }
+        d2h(amounth, in);
        return amounth;
    }

    //uint long long to int[64]
    void d2b(bits  amountb, xmr_amount val) {
        int i = 0;
-        while (val != 0) {
-            amountb[i] = val & 1;
-            i++;
-            val >>= 1;
-        }
        while (i < 64) {
-            amountb[i] = 0;
-            i++;
+            amountb[i++] = val & 1;
+            val >>= 1;
        }
    }
    
@@ -172,16 +155,11 @@ namespace rct {
        int val = 0, i = 0, j = 0;
        for (j = 0; j < 8; j++) {
            val = (unsigned char)test.bytes[j];
-            i = 8 * j;
-            while (val != 0) {
-                amountb2[i] = val & 1;
-                i++;
+            i = 0;
+            while (i < 8) {
+                amountb2[j*8+i++] = val & 1;
                val >>= 1;
            }
-            while (i < 8 * (j + 1)) {
-                amountb2[i] = 0;
-                i++;
-            }
        }
    }
    
--- a/src/simplewallet/simplewallet.cpp
+++ b/src/simplewallet/simplewallet.cpp
@@ -8356,7 +8356,11 @@ bool simple_wallet::get_transfers(std::vector<std::string>& local_args, std::vec
      m_in_manual_refresh.store(true, std::memory_order_relaxed);
      epee::misc_utils::auto_scope_leave_caller scope_exit_handler = epee::misc_utils::create_scope_leave_handler([&](){m_in_manual_refresh.store(false, std::memory_order_relaxed);});

-      m_wallet->update_pool_state();
+      std::vector<std::pair<cryptonote::transaction, bool>> process_txs;
+      m_wallet->update_pool_state(process_txs);
+      if (!process_txs.empty())
+        m_wallet->process_pool_state(process_txs);
+
      std::list<std::pair<crypto::hash, tools::wallet2::pool_payment_details>> payments;
      m_wallet->get_unconfirmed_payments(payments, m_current_subaddress_account, subaddr_indices);
      for (std::list<std::pair<crypto::hash, tools::wallet2::pool_payment_details>>::const_iterator i = payments.begin(); i != payments.end(); ++i) {
@@ -8803,22 +8807,41 @@ void simple_wallet::check_for_messages()
 //----------------------------------------------------------------------------------------------------
 void simple_wallet::wallet_idle_thread()
 {
+  const boost::posix_time::ptime start_time = boost::posix_time::microsec_clock::universal_time();
  while (true)
  {
    boost::unique_lock<boost::mutex> lock(m_idle_mutex);
    if (!m_idle_run.load(std::memory_order_relaxed))
      break;

-#ifndef _WIN32
-    m_inactivity_checker.do_call(boost::bind(&simple_wallet::check_inactivity, this));
+    // if another thread was busy (ie, a foreground refresh thread), we'll end up here at
+    // some random time that's not what we slept for, so we should not call refresh now
+    // or we'll be leaking that fact through timing
+    const boost::posix_time::ptime now0 = boost::posix_time::microsec_clock::universal_time();
+    const uint64_t dt_actual = (now0 - start_time).total_microseconds() % 1000000;
+#ifdef _WIN32
+    static const uint64_t threshold = 10000;
+#else
+    static const uint64_t threshold = 2000;
 #endif
-    m_refresh_checker.do_call(boost::bind(&simple_wallet::check_refresh, this));
-    m_mms_checker.do_call(boost::bind(&simple_wallet::check_mms, this));
-    m_rpc_payment_checker.do_call(boost::bind(&simple_wallet::check_rpc_payment, this));
+    if (dt_actual < threshold) // if less than a threshold... would a very slow machine always miss it ?
+    {
+#ifndef _WIN32
+      m_inactivity_checker.do_call(boost::bind(&simple_wallet::check_inactivity, this));
+#endif
+      m_refresh_checker.do_call(boost::bind(&simple_wallet::check_refresh, this));
+      m_mms_checker.do_call(boost::bind(&simple_wallet::check_mms, this));
+      m_rpc_payment_checker.do_call(boost::bind(&simple_wallet::check_rpc_payment, this));

-    if (!m_idle_run.load(std::memory_order_relaxed))
-      break;
-    m_idle_cond.wait_for(lock, boost::chrono::seconds(1));
+      if (!m_idle_run.load(std::memory_order_relaxed))
+        break;
+    }
+
+    // aim for the next multiple of 1 second
+    const boost::posix_time::ptime now = boost::posix_time::microsec_clock::universal_time();
+    const auto dt = (now - start_time).total_microseconds();
+    const auto wait = 1000000 - dt % 1000000;
+    m_idle_cond.wait_for(lock, boost::chrono::microseconds(wait));
  }
 }
 //----------------------------------------------------------------------------------------------------
@@ -10002,7 +10025,11 @@ bool simple_wallet::show_transfer(const std::vector<std::string> &args)

  try
  {
-    m_wallet->update_pool_state();
+    std::vector<std::pair<cryptonote::transaction, bool>> process_txs;
+    m_wallet->update_pool_state(process_txs);
+    if (!process_txs.empty())
+      m_wallet->process_pool_state(process_txs);
+
    std::list<std::pair<crypto::hash, tools::wallet2::pool_payment_details>> pool_payments;
    m_wallet->get_unconfirmed_payments(pool_payments, m_current_subaddress_account);
    for (std::list<std::pair<crypto::hash, tools::wallet2::pool_payment_details>>::const_iterator i = pool_payments.begin(); i != pool_payments.end(); ++i) {
--- a/src/simplewallet/simplewallet.h
+++ b/src/simplewallet/simplewallet.h
@@ -448,10 +448,12 @@ namespace cryptonote
    std::atomic<bool> m_locked;
    std::atomic<bool> m_in_command;

+    template<uint64_t mini, uint64_t maxi> struct get_random_interval { public: uint64_t operator()() const { return crypto::rand_range(mini, maxi); } };
+
    epee::math_helper::once_a_time_seconds<1> m_inactivity_checker;
-    epee::math_helper::once_a_time_seconds<90> m_refresh_checker;
-    epee::math_helper::once_a_time_seconds<90> m_mms_checker;
-    epee::math_helper::once_a_time_seconds<90> m_rpc_payment_checker;
+    epee::math_helper::once_a_time_seconds_range<get_random_interval<80 * 1000000, 100 * 1000000>> m_refresh_checker;
+    epee::math_helper::once_a_time_seconds_range<get_random_interval<90 * 1000000, 110 * 1000000>> m_mms_checker;
+    epee::math_helper::once_a_time_seconds_range<get_random_interval<90 * 1000000, 115 * 1000000>> m_rpc_payment_checker;
    
    std::atomic<bool> m_need_payment;
    boost::posix_time::ptime m_last_rpc_payment_mining_time;
--- a/src/version.cpp.in
+++ b/src/version.cpp.in
@@ -1,5 +1,5 @@
 #define DEF_MONERO_VERSION_TAG "@VERSIONTAG@"
-#define DEF_MONERO_VERSION "0.15.0.0"
+#define DEF_MONERO_VERSION "0.15.0.1"
 #define DEF_MONERO_RELEASE_NAME "Carbon Chamaeleon"
 #define DEF_MONERO_VERSION_FULL DEF_MONERO_VERSION "-" DEF_MONERO_VERSION_TAG
 #define DEF_MONERO_VERSION_IS_RELEASE @VERSION_IS_RELEASE@
--- a/src/wallet/node_rpc_proxy.cpp
+++ b/src/wallet/node_rpc_proxy.cpp
@@ -36,7 +36,7 @@
  do { \
    CHECK_AND_ASSERT_MES(error.code == 0, error.message, error.message); \
    handle_payment_changes(res, std::integral_constant<bool, HasCredits<decltype(res)>::Has>()); \
-    CHECK_AND_ASSERT_MES(r, std::string(), "Failed to connect to daemon"); \
+    CHECK_AND_ASSERT_MES(r, std::string("Failed to connect to daemon"), "Failed to connect to daemon"); \
    /* empty string -> not connection */ \
    CHECK_AND_ASSERT_MES(!res.status.empty(), res.status, "No connection to daemon"); \
    CHECK_AND_ASSERT_MES(res.status != CORE_RPC_STATUS_BUSY, res.status, "Daemon busy"); \
@@ -77,6 +77,7 @@ void NodeRPCProxy::invalidate()
  m_rpc_payment_seed_height = 0;
  m_rpc_payment_seed_hash = crypto::null_hash;
  m_rpc_payment_next_seed_hash = crypto::null_hash;
+  m_height_time = 0;
 }

 boost::optional<std::string> NodeRPCProxy::get_rpc_version(uint32_t &rpc_version)
@@ -101,6 +102,7 @@ boost::optional<std::string> NodeRPCProxy::get_rpc_version(uint32_t &rpc_version
 void NodeRPCProxy::set_height(uint64_t h)
 {
  m_height = h;
+  m_height_time = time(NULL);
 }

 boost::optional<std::string> NodeRPCProxy::get_info()
@@ -126,12 +128,20 @@ boost::optional<std::string> NodeRPCProxy::get_info()
    m_target_height = resp_t.target_height;
    m_block_weight_limit = resp_t.block_weight_limit ? resp_t.block_weight_limit : resp_t.block_size_limit;
    m_get_info_time = now;
+    m_height_time = now;
  }
  return boost::optional<std::string>();
 }

 boost::optional<std::string> NodeRPCProxy::get_height(uint64_t &height)
 {
+  const time_t now = time(NULL);
+  if (now < m_height_time + 30) // re-cache every 30 seconds
+  {
+    height = m_height;
+    return boost::optional<std::string>();
+  }
+
  auto res = get_info();
  if (res)
    return res;
--- a/src/wallet/node_rpc_proxy.h
+++ b/src/wallet/node_rpc_proxy.h
@@ -97,6 +97,7 @@ private:
  crypto::hash m_rpc_payment_seed_hash;
  crypto::hash m_rpc_payment_next_seed_hash;
  uint32_t m_rpc_payment_cookie;
+  time_t m_height_time;
 };

 }
--- a/src/wallet/wallet2.cpp
+++ b/src/wallet/wallet2.cpp
@@ -2519,12 +2519,14 @@ void wallet2::parse_block_round(const cryptonote::blobdata &blob, cryptonote::bl
  error = !cryptonote::parse_and_validate_block_from_blob(blob, bl, bl_id);
 }
 //----------------------------------------------------------------------------------------------------
-void wallet2::pull_blocks(uint64_t start_height, uint64_t &blocks_start_height, const std::list<crypto::hash> &short_chain_history, std::vector<cryptonote::block_complete_entry> &blocks, std::vector<cryptonote::COMMAND_RPC_GET_BLOCKS_FAST::block_output_indices> &o_indices)
+void wallet2::pull_blocks(uint64_t start_height, uint64_t &blocks_start_height, const std::list<crypto::hash> &short_chain_history, std::vector<cryptonote::block_complete_entry> &blocks, std::vector<cryptonote::COMMAND_RPC_GET_BLOCKS_FAST::block_output_indices> &o_indices, uint64_t &current_height)
 {
  cryptonote::COMMAND_RPC_GET_BLOCKS_FAST::request req = AUTO_VAL_INIT(req);
  cryptonote::COMMAND_RPC_GET_BLOCKS_FAST::response res = AUTO_VAL_INIT(res);
  req.block_ids = short_chain_history;

+  MDEBUG("Pulling blocks: start_height " << start_height);
+
  req.prune = true;
  req.start_height = start_height;
  req.no_miner_tx = m_refresh_type == RefreshNoCoinbase;
@@ -2544,6 +2546,10 @@ void wallet2::pull_blocks(uint64_t start_height, uint64_t &blocks_start_height,
  blocks_start_height = res.start_height;
  blocks = std::move(res.blocks);
  o_indices = std::move(res.output_indices);
+  current_height = res.current_height;
+
+  MDEBUG("Pulled blocks: blocks_start_height " << blocks_start_height << ", count " << blocks.size()
+      << ", height " << blocks_start_height + blocks.size() << ", node height " << res.current_height);
 }
 //----------------------------------------------------------------------------------------------------
 void wallet2::pull_hashes(uint64_t start_height, uint64_t &blocks_start_height, const std::list<crypto::hash> &short_chain_history, std::vector<crypto::hash> &hashes)
@@ -2726,9 +2732,10 @@ void wallet2::refresh(bool trusted_daemon, uint64_t start_height, uint64_t & blo
  refresh(trusted_daemon, start_height, blocks_fetched, received_money);
 }
 //----------------------------------------------------------------------------------------------------
-void wallet2::pull_and_parse_next_blocks(uint64_t start_height, uint64_t &blocks_start_height, std::list<crypto::hash> &short_chain_history, const std::vector<cryptonote::block_complete_entry> &prev_blocks, const std::vector<parsed_block> &prev_parsed_blocks, std::vector<cryptonote::block_complete_entry> &blocks, std::vector<parsed_block> &parsed_blocks, bool &error, std::exception_ptr &exception)
+void wallet2::pull_and_parse_next_blocks(uint64_t start_height, uint64_t &blocks_start_height, std::list<crypto::hash> &short_chain_history, const std::vector<cryptonote::block_complete_entry> &prev_blocks, const std::vector<parsed_block> &prev_parsed_blocks, std::vector<cryptonote::block_complete_entry> &blocks, std::vector<parsed_block> &parsed_blocks, bool &last, bool &error, std::exception_ptr &exception)
 {
  error = false;
+  last = false;
  exception = NULL;

  try
@@ -2746,7 +2753,8 @@ void wallet2::pull_and_parse_next_blocks(uint64_t start_height, uint64_t &blocks

    // pull the new blocks
    std::vector<cryptonote::COMMAND_RPC_GET_BLOCKS_FAST::block_output_indices> o_indices;
-    pull_blocks(start_height, blocks_start_height, short_chain_history, blocks, o_indices);
+    uint64_t current_height;
+    pull_blocks(start_height, blocks_start_height, short_chain_history, blocks, o_indices, current_height);
    THROW_WALLET_EXCEPTION_IF(blocks.size() != o_indices.size(), error::wallet_internal_error, "Mismatched sizes of blocks and o_indices");

    tools::threadpool& tpool = tools::threadpool::getInstance();
@@ -2784,6 +2792,7 @@ void wallet2::pull_and_parse_next_blocks(uint64_t start_height, uint64_t &blocks
      }
    }
    waiter.wait(&tpool);
+    last = !blocks.empty() && cryptonote::get_block_height(parsed_blocks.back().block) + 1 == current_height;
  }
  catch(...)
  {
@@ -2820,7 +2829,7 @@ void wallet2::remove_obsolete_pool_txs(const std::vector<crypto::hash> &tx_hashe
 }

 //----------------------------------------------------------------------------------------------------
-void wallet2::update_pool_state(bool refreshed)
+void wallet2::update_pool_state(std::vector<std::pair<cryptonote::transaction, bool>> &process_txs, bool refreshed)
 {
  MTRACE("update_pool_state start");

@@ -2968,11 +2977,6 @@ void wallet2::update_pool_state(bool refreshed)
        LOG_PRINT_L1("We sent that one");
      }
    }
-    else
-    {
-      LOG_PRINT_L1("Already saw that one, it's for us");
-      txids.push_back({txid, true});
-    }
  }

  // get those txes
@@ -3015,13 +3019,7 @@ void wallet2::update_pool_state(bool refreshed)
                    [tx_hash](const std::pair<crypto::hash, bool> &e) { return e.first == tx_hash; });
                if (i != txids.end())
                {
-                  process_new_transaction(tx_hash, tx, std::vector<uint64_t>(), 0, 0, time(NULL), false, true, tx_entry.double_spend_seen, {});
-                  m_scanned_pool_txs[0].insert(tx_hash);
-                  if (m_scanned_pool_txs[0].size() > 5000)
-                  {
-                    std::swap(m_scanned_pool_txs[0], m_scanned_pool_txs[1]);
-                    m_scanned_pool_txs[0].clear();
-                  }
+                  process_txs.push_back(std::make_pair(tx, tx_entry.double_spend_seen));
                }
                else
                {
@@ -3052,6 +3050,24 @@ void wallet2::update_pool_state(bool refreshed)
  MTRACE("update_pool_state end");
 }
 //----------------------------------------------------------------------------------------------------
+void wallet2::process_pool_state(const std::vector<std::pair<cryptonote::transaction, bool>> &txs)
+{
+  const time_t now = time(NULL);
+  for (const auto &e: txs)
+  {
+    const cryptonote::transaction &tx = e.first;
+    const bool double_spend_seen = e.second;
+    const crypto::hash tx_hash = get_transaction_hash(tx);
+    process_new_transaction(tx_hash, tx, std::vector<uint64_t>(), 0, 0, now, false, true, double_spend_seen, {});
+    m_scanned_pool_txs[0].insert(tx_hash);
+    if (m_scanned_pool_txs[0].size() > 5000)
+    {
+      std::swap(m_scanned_pool_txs[0], m_scanned_pool_txs[1]);
+      m_scanned_pool_txs[0].clear();
+    }
+  }
+}
+//----------------------------------------------------------------------------------------------------
 void wallet2::fast_refresh(uint64_t stop_height, uint64_t &blocks_start_height, std::list<crypto::hash> &short_chain_history, bool force)
 {
  std::vector<crypto::hash> hashes;
@@ -3255,7 +3271,15 @@ void wallet2::refresh(bool trusted_daemon, uint64_t start_height, uint64_t & blo
  });

  auto scope_exit_handler_hwdev = epee::misc_utils::create_scope_leave_handler([&](){hwdev.computing_key_images(false);});
-  bool first = true;
+
+  // get updated pool state first, but do not process those txes just yet,
+  // since that might cause a password prompt, which would introduce a data
+  // leak allowing a passive adversary with traffic analysis capability to
+  // infer when we get an incoming output
+  std::vector<std::pair<cryptonote::transaction, bool>> process_pool_txs;
+  update_pool_state(process_pool_txs, true);
+
+  bool first = true, last = false;
  while(m_run.load(std::memory_order_relaxed))
  {
    uint64_t next_blocks_start_height;
@@ -3277,7 +3301,8 @@ void wallet2::refresh(bool trusted_daemon, uint64_t start_height, uint64_t & blo
        refreshed = true;
        break;
      }
-      tpool.submit(&waiter, [&]{pull_and_parse_next_blocks(start_height, next_blocks_start_height, short_chain_history, blocks, parsed_blocks, next_blocks, next_parsed_blocks, error, exception);});
+      if (!last)
+        tpool.submit(&waiter, [&]{pull_and_parse_next_blocks(start_height, next_blocks_start_height, short_chain_history, blocks, parsed_blocks, next_blocks, next_parsed_blocks, last, error, exception);});

      if (!first)
      {
@@ -3384,8 +3409,8 @@ void wallet2::refresh(bool trusted_daemon, uint64_t start_height, uint64_t & blo
  try
  {
    // If stop() is called we don't need to check pending transactions
-    if (check_pool && m_run.load(std::memory_order_relaxed))
-      update_pool_state(refreshed);
+    if (check_pool && m_run.load(std::memory_order_relaxed) && !process_pool_txs.empty())
+      process_pool_state(process_pool_txs);
  }
  catch (...)
  {
@@ -13187,7 +13212,7 @@ uint64_t wallet2::get_blockchain_height_by_date(uint16_t year, uint8_t month, ui
 bool wallet2::is_synced()
 {
  uint64_t height;
-  boost::optional<std::string> result = m_node_rpc_proxy.get_target_height(height);
+  boost::optional<std::string> result = m_node_rpc_proxy.get_height(height);
  if (result && *result != CORE_RPC_STATUS_OK)
    return false;
  return get_blockchain_current_height() >= height;
--- a/src/wallet/wallet2.h
+++ b/src/wallet/wallet2.h
@@ -1219,7 +1219,8 @@ private:
    bool import_key_images(signed_tx_set & signed_tx, size_t offset=0, bool only_selected_transfers=false);
    crypto::public_key get_tx_pub_key_from_received_outs(const tools::wallet2::transfer_details &td) const;

-    void update_pool_state(bool refreshed = false);
+    void update_pool_state(std::vector<std::pair<cryptonote::transaction, bool>> &process_txs, bool refreshed = false);
+    void process_pool_state(const std::vector<std::pair<cryptonote::transaction, bool>> &txs);
    void remove_obsolete_pool_txs(const std::vector<crypto::hash> &tx_hashes);

    std::string encrypt(const char *plaintext, size_t len, const crypto::secret_key &skey, bool authenticated = true) const;
@@ -1403,10 +1404,10 @@ private:
    void get_short_chain_history(std::list<crypto::hash>& ids, uint64_t granularity = 1) const;
    bool clear();
    void clear_soft(bool keep_key_images=false);
-    void pull_blocks(uint64_t start_height, uint64_t& blocks_start_height, const std::list<crypto::hash> &short_chain_history, std::vector<cryptonote::block_complete_entry> &blocks, std::vector<cryptonote::COMMAND_RPC_GET_BLOCKS_FAST::block_output_indices> &o_indices);
+    void pull_blocks(uint64_t start_height, uint64_t& blocks_start_height, const std::list<crypto::hash> &short_chain_history, std::vector<cryptonote::block_complete_entry> &blocks, std::vector<cryptonote::COMMAND_RPC_GET_BLOCKS_FAST::block_output_indices> &o_indices, uint64_t &current_height);
    void pull_hashes(uint64_t start_height, uint64_t& blocks_start_height, const std::list<crypto::hash> &short_chain_history, std::vector<crypto::hash> &hashes);
    void fast_refresh(uint64_t stop_height, uint64_t &blocks_start_height, std::list<crypto::hash> &short_chain_history, bool force = false);
-    void pull_and_parse_next_blocks(uint64_t start_height, uint64_t &blocks_start_height, std::list<crypto::hash> &short_chain_history, const std::vector<cryptonote::block_complete_entry> &prev_blocks, const std::vector<parsed_block> &prev_parsed_blocks, std::vector<cryptonote::block_complete_entry> &blocks, std::vector<parsed_block> &parsed_blocks, bool &error, std::exception_ptr &exception);
+    void pull_and_parse_next_blocks(uint64_t start_height, uint64_t &blocks_start_height, std::list<crypto::hash> &short_chain_history, const std::vector<cryptonote::block_complete_entry> &prev_blocks, const std::vector<parsed_block> &prev_parsed_blocks, std::vector<cryptonote::block_complete_entry> &blocks, std::vector<parsed_block> &parsed_blocks, bool &last, bool &error, std::exception_ptr &exception);
    void process_parsed_blocks(uint64_t start_height, const std::vector<cryptonote::block_complete_entry> &blocks, const std::vector<parsed_block> &parsed_blocks, uint64_t& blocks_added, std::map<std::pair<uint64_t, uint64_t>, size_t> *output_tracker_cache = NULL);
    uint64_t select_transfers(uint64_t needed_money, std::vector<size_t> unused_transfers_indices, std::vector<size_t>& selected_transfers) const;
    bool prepare_file_names(const std::string& file_path);
--- a/src/wallet/wallet_rpc_server.cpp
+++ b/src/wallet/wallet_rpc_server.cpp
@@ -2438,7 +2438,10 @@ namespace tools

    if (req.pool)
    {
-      m_wallet->update_pool_state();
+      std::vector<std::pair<cryptonote::transaction, bool>> process_txs;
+      m_wallet->update_pool_state(process_txs);
+      if (!process_txs.empty())
+        m_wallet->process_pool_state(process_txs);

      std::list<std::pair<crypto::hash, tools::wallet2::pool_payment_details>> payments;
      m_wallet->get_unconfirmed_payments(payments, account_index, subaddr_indices);
@@ -2518,7 +2521,10 @@ namespace tools
      }
    }

-    m_wallet->update_pool_state();
+    std::vector<std::pair<cryptonote::transaction, bool>> process_txs;
+    m_wallet->update_pool_state(process_txs);
+    if (!process_txs.empty())
+      m_wallet->process_pool_state(process_txs);

    std::list<std::pair<crypto::hash, tools::wallet2::pool_payment_details>> pool_payments;
    m_wallet->get_unconfirmed_payments(pool_payments, req.account_index);
Author	SHA1	Message	Date
luigi1111	6def88ad40	Merge pull request #6156 `443b1e9` make d2h et al. constant-time (jtgrassie)	2019-11-19 10:01:03 -06:00
Jethro Grassie	443b1e9fee	make d2h et al. constant-time	2019-11-19 04:20:04 -05:00
luigi1111	cb3aad4b46	Merge pull request #6152 `74b0ca4` v0.15.0.1 version bump (moneromooo-monero)	2019-11-18 14:59:10 -06:00
luigi1111	c3a413bd42	Merge pull request #6149 `4dc4e1f` Fix #6147 DB corruption from child process overwrite (hyc)	2019-11-18 13:25:58 -06:00
luigi1111	5ca0fcf6aa	Merge pull request #6150 gitian: add FreeBSD support (`bf00d98`, `85f87db`, `b2e5f4e`, `1245b75`, `7feb29f`, `4991b8c`, `1ce8d00`, `6bb94b1`, `7c6c223`, `7444cec`) (hyc)	2019-11-18 13:23:52 -06:00
moneromooo-monero	74b0ca4bed	v0.15.0.1 version bump	2019-11-18 19:23:30 +00:00
Howard Chu	7444cec04c	"Fix" non-determinism in native_cctools build By omitting the otool binary which is built non-deterministically. We don't use it anyway.	2019-11-18 10:30:58 +00:00
Howard Chu	4dc4e1f150	Fix #6147 DB corruption from child process overwrite Don't leave stdout/stderr dangling on a fork.	2019-11-17 14:05:16 +00:00
Howard Chu	7c6c22362e	Fixup compiled python in OSX	2019-11-17 13:45:56 +00:00
Howard Chu	6bb94b1c30	Fix unwind library ordering Sort objects being archived	2019-11-17 13:45:47 +00:00
Howard Chu	1ce8d00f64	Fixup sodium darwin get rid of sodium-darwin.mk special case, unify back with sodium.mk	2019-11-17 13:45:38 +00:00
Howard Chu	4991b8c322	Use standard time for depends caches streamline, remove obsolete wrappers	2019-11-17 13:45:29 +00:00
Howard Chu	7feb29f5c9	Add ARFLAGS Needed to invoke deterministic mode on some archivers	2019-11-17 13:45:20 +00:00
Howard Chu	1245b75ed7	gitian: add FreeBSD	2019-11-17 13:42:38 +00:00
Howard Chu	b2e5f4ecac	depends: Add FreeBSD support	2019-11-17 13:42:25 +00:00
Howard Chu	85f87db477	gitian: Parametrize target platforms	2019-11-17 13:42:10 +00:00
Howard Chu	bf00d984c8	gitian: Update to latest gitian-builder	2019-11-17 13:42:01 +00:00
luigi1111	f07c326f13	Merge pull request #6138 `2a8953c` wallet: set non-empty error string on connection failure (xiphon)	2019-11-16 11:03:05 -06:00
luigi1111	12e261e875	Merge pull request #6121 `cd0ec5a` epee: close connection when the peer has done so (moneromooo-monero)	2019-11-16 11:02:10 -06:00
xiphon	2a8953c019	wallet: set non-empty error string on connection failure	2019-11-15 13:09:02 +00:00
luigi1111	2b88b7cc74	Merge pull request #6098 `cbec8eb` wallet2: fix pool txes not being flushed when mined (moneromooo-monero)	2019-11-11 15:47:10 -06:00
moneromooo-monero	cd0ec5a6c1	epee: close connection when the peer has done so This fixes rapid reconnections failing as the peer hasn't yet worked out the other side is gone, and will reject "duplicate" connections until a timeout.	2019-11-11 20:05:36 +00:00
moneromooo-monero	cbec8eb10b	wallet2: fix pool txes not being flushed when mined	2019-11-04 19:33:22 +00:00
Riccardo Spagni	69c488a479	Merge pull request #6089 `ac925ba17` [v0.15] gitian: fix out dir location (iDunk5400)	2019-11-04 06:13:39 -08:00
Riccardo Spagni	4a65cc5c46	Merge pull request #6092 `c84b1ab27` Copy LICENSE to all archives (Howard Chu)	2019-11-04 06:13:31 -08:00
iDunk5400	ac925ba17a	[v0.15] gitian: fix out dir location	2019-11-04 10:28:14 +01:00
Howard Chu	c84b1ab275	Copy LICENSE to all archives	2019-11-04 05:09:13 +00:00
Riccardo Spagni	e8da77b4f1	Merge pull request #6086 `5a996bd75` depends: fix typo in packages (selsta)	2019-11-03 15:14:31 -08:00
selsta	5a996bd75e	depends: fix typo in packages	2019-11-04 00:10:27 +01:00
Riccardo Spagni	e046c02ec3	Merge pull request #6075 `912ff6abe` simplewallet: plug a timing leak (moneromooo-monero) `cc2fc0bc3` epee: allow a random component in once_a_time timeouts (moneromooo-monero) `c0f504787` wallet: reuse cached height when set after refresh (moneromooo-monero) `f98d9673e` wallet2: fix is_synced checking target height, not height (moneromooo-monero) `98cdc8492` wallet: fix another facet of "did I get some monero" information leak (moneromooo-monero) `69b8aa5a2` wallet2: do not send an unnecessary last getblocks.bin call on refresh (moneromooo-monero) `2ca057402` wallet2: do not repeatedly ask for pool txes sent to us (moneromooo-monero)	2019-11-03 14:51:11 -08:00
Riccardo Spagni	8152ea9562	Merge pull request #6085 `32d514668` gitian: add --rebuild option (Howard Chu) `d904ffbac` Add Android support (Howard Chu)	2019-11-03 14:50:48 -08:00
Riccardo Spagni	e225465fe1	Merge pull request #6084 `436e4c336` Fix readline build (Howard Chu)	2019-11-04 02:49:52 +04:00
Howard Chu	32d5146689	gitian: add --rebuild option Avoids delays when sourceforge is slow to respond; allows rebuilding when disconnected from networks.	2019-11-03 21:17:04 +00:00
Howard Chu	d904ffbaca	Add Android support	2019-11-03 21:16:56 +00:00
moneromooo-monero	912ff6abeb	simplewallet: plug a timing leak As reported by Tramèr et al, timing of refresh requests can be used to see whether a password was requested (and thus at least one output received) since this will induce a delay in subsequent calls. To avoid this, we schedule calls at a given time instead of sleeping for a set time (which would make delays additive). To further avoid a scheduled call being during the time in which a password is prompted, the actual scheduled time is now randomized.	2019-11-02 11:41:30 +00:00
moneromooo-monero	cc2fc0bc3e	epee: allow a random component in once_a_time timeouts	2019-11-01 20:57:59 +00:00
moneromooo-monero	c0f5047878	wallet: reuse cached height when set after refresh Refreshing sets cached height, which is otherwise got by calling get_info. Since get_info is called upon needing to display a prompt after a command has finished, it can be used to determine how much time a given command took to run if the cache timeout lapses while the command runs. Refreshing caches the height as a side effect, so get_info will never be called as a result of displaying a prompt after refreshing (and potentially leaking how much time it took to process a set of transactions, therefore leaking whether we got some monero in them).	2019-11-01 19:00:20 +00:00
moneromooo-monero	f98d9673eb	wallet2: fix is_synced checking target height, not height Target height would be appropriate for the daemon, which syncs off other daemons, but the wallet syncs off the daemon it's connected to, and its target is the daemon's current height.	2019-11-01 19:00:19 +00:00
moneromooo-monero	98cdc84920	wallet: fix another facet of "did I get some monero" information leak We get new pool txes before processing any tx, pool or not. This ensures that if we're asked for a password, this does not cause a measurable delay in the txpool query after the last block query.	2019-11-01 19:00:19 +00:00
moneromooo-monero	69b8aa5a26	wallet2: do not send an unnecessary last getblocks.bin call on refresh The "everything refreshed" state was detected when a refresh call did not return any new blocks. This can be detected without that extra "empty" call by comparing the claimed node height to the height of the last block retrieved. Doing this avoids that last call, saves some bandwidth, and makes the common refresh case use only one call rather than two. As a side effect, it prevents an information leak reported by Tramèr et al: if the wallet retrieves a set of blocks which includes an output sent to the refreshing wallet, the wallet will prompt the user for the password to decode the amount and calculate the key image for the new output, and this will delay subsequent calls to getblocks.bin, allowing a passive adversary to note the delay and deduce when the wallet receives at least one output. This can still happen if the wallet downloads more than 1000 blocks, since this will be split in several calls, but then the most the adversary can tell is which 1000 block section the user received some monero (the adversary can estimate the heights of the blocks by calculating how many "large" transfers are done, which will be sections of blocks, the last of which will usually be below 1000, but the size of the data should allow the actual number of blocks sent to be determined fairly accurately). This timing trick still be used via the subsequent scan for incoming txes in the txpool, which will be fixed later.	2019-11-01 19:00:18 +00:00
moneromooo-monero	2ca057402d	wallet2: do not repeatedly ask for pool txes sent to us This lets a passive attacker with access to the network link between node and wallet perform traffic analysis to deduce when an idle wallet receives a transaction. Reported by Tramèr et al.	2019-11-01 10:47:05 +00:00