ci: Check windows manifests for all executables
What the developer wrote
Authored by Max Edwards
ci: Check windows manifests for all executables
The other executables have manifests and these should be checked in
addition to bitcoind. Skipping fuzz.exe, bench_bitcoin.exe and
test_bitcoin-qt.exe as they do not have manifests.
What changed, and why it matters
This change only updates Bitcoin Core's automated Windows CI testing scripts to check that more Windows executable files have valid 'manifests' (metadata files embedded in Windows programs). It does not change any actual Bitcoin Core software code, network behavior, or wallet logic. There is no security vulnerability here.
No action required; this is a benign CI improvement. Treat as routine build-system maintenance.
Security signals we found
No product code changed
Only CI workflow modified
Adds validation of Windows embedded manifests in build artifacts
No bug fix, privilege change, or cryptographic change
Evidence from the diff
The commit modifies .github/workflows/ci.yml to expand the existing Windows manifest validation step from only bitcoind.exe to all built .exe files (excluding fuzz.exe, bench_bitcoin.exe, and test_bitcoin-qt.exe because they intentionally lack manifests). It converts the shell step to PowerShell and loops over bin\Release*.exe or bin*.exe calling mt.exe -validate_manifest. This is a CI hardening/quality improvement, not a product security fix.
Changed components
.github/workflows/ci.ymlInspect captured patch +32 / −8
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 89e8bf98..e10d1d69 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -268,14 +268,26 @@ jobs:
run: |
cmake --build . -j $NUMBER_OF_PROCESSORS --config Release
- - name: Get bitcoind manifest
+ - name: Check executable manifests
if: matrix.job-type == 'standard'
working-directory: build
+ shell: pwsh -Command "$PSVersionTable; $PSNativeCommandUseErrorActionPreference = $true; $ErrorActionPreference = 'Stop'; & '{0}'"
run: |
- mt.exe -nologo -inputresource:bin/Release/bitcoind.exe -out:bitcoind.manifest
- cat bitcoind.manifest
- echo
- mt.exe -nologo -inputresource:bin/Release/bitcoind.exe -validate_manifest
+ mt.exe -nologo -inputresource:bin\Release\bitcoind.exe -out:bitcoind.manifest
+ Get-Content bitcoind.manifest
+
+ Get-ChildItem -Filter "bin\Release\*.exe" | ForEach-Object {
+ $exeName = $_.Name
+
+ # Skip as they currently do not have manifests
+ if ($exeName -eq "fuzz.exe" -or $exeName -eq "bench_bitcoin.exe" -or $exeName -eq "test_bitcoin-qt.exe") {
+ Write-Host "Skipping $exeName (no manifest present)"
+ return
+ }
+
+ Write-Host "Checking $exeName"
+ & mt.exe -nologo -inputresource:$_.FullName -validate_manifest
+ }
- name: Run test suite
if: matrix.job-type == 'standard'
@@ -377,12 +389,24 @@ jobs:
- *SET_UP_VS
- - name: Get bitcoind manifest
- shell: pwsh
+ - name: Check executable manifests
+ shell: pwsh -Command "$PSVersionTable; $PSNativeCommandUseErrorActionPreference = $true; $ErrorActionPreference = 'Stop'; & '{0}'"
run: |
mt.exe -nologo -inputresource:bin\bitcoind.exe -out:bitcoind.manifest
Get-Content bitcoind.manifest
- mt.exe -nologo -inputresource:bin\bitcoind.exe -validate_manifest
+
+ Get-ChildItem -Filter "bin\*.exe" | ForEach-Object {
+ $exeName = $_.Name
+
+ # Skip as they currently do not have manifests
+ if ($exeName -eq "fuzz.exe" -or $exeName -eq "bench_bitcoin.exe") {
+ Write-Host "Skipping $exeName (no manifest present)"
+ return
+ }
+
+ Write-Host "Checking $exeName"
+ & mt.exe -nologo -inputresource:$_.FullName -validate_manifest
+ }
- name: Run unit tests
# Can't use ctest here like other jobs as we don't have a CMake build tree.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.