build: depends makes libmultiprocess by default
What changed, and why it matters
This commit changes Bitcoin Core's build system so that multiprocess/IPC support is built by default in the depends system, rather than requiring an explicit option. It renames the option from MULTIPROCESS=1 to NO_IPC=1 (to opt out), adds IPC binaries to maintenance targets, and disables IPC only on Windows. There is no direct security fix or vulnerability being patched in the code itself; it is a build configuration change that increases the default attack surface by including more binaries and dependencies in releases.
Treat as a build-hardening/configuration review item rather than a vulnerability. Review the security posture of the newly default-included IPC binaries (bitcoin-node, bitcoin-gui), the Cap'n Proto dependency, and the multiprocess interface surface. Ensure release signing, sandboxing, and fuzzing coverage account for these binaries. No immediate patch or incident response is indicated by this commit alone.
Security signals we found
Build system change increases default compiled attack surface (IPC binaries and Cap'n Proto dependency included by default)
New IPC binaries (bitcoin-node, bitcoin-gui) added to maintenance/installed release targets
Windows explicitly excluded from default IPC builds
No direct code-level vulnerability, bug fix, or security patch present in diff
Evidence from the diff
The patch flips the default for libmultiprocess/Cap’n Proto builds in depends from opt-in (MULTIPROCESS=1) to opt-out (NO_IPC=1, default 1 only on Windows). It updates package variables, toolchain CMake generation, CI environment variables, and documentation accordingly. It also adds bitcoin-node and bitcoin-gui to the maintenance target executable list. No code-level vulnerability is fixed or introduced in the diff; the change is purely build-system and release-packaging scope.
Changed components
depends build system (Makefile, packages.mk, toolchain.cmake.in)CMake maintenance targets (cmake/module/Maintenance.cmake)CI configuration (ci/test/00_setup_env_i686_multiprocess.sh)Release packaging (bitcoin-node, bitcoin-gui inclusion by default)Documentation (depends/README.md, doc/multiprocess.md)Inspect captured patch +17 / −15
diff --git a/ci/test/00_setup_env_i686_multiprocess.sh b/ci/test/00_setup_env_i686_multiprocess.sh
index e19a45d1..c3caefc5 100755
--- a/ci/test/00_setup_env_i686_multiprocess.sh
+++ b/ci/test/00_setup_env_i686_multiprocess.sh
@@ -11,7 +11,7 @@ export CONTAINER_NAME=ci_i686_multiprocess
export CI_IMAGE_NAME_TAG="mirror.gcr.io/ubuntu:24.04"
export CI_IMAGE_PLATFORM="linux/amd64"
export PACKAGES="llvm clang g++-multilib"
-export DEP_OPTS="DEBUG=1 MULTIPROCESS=1"
+export DEP_OPTS="DEBUG=1"
export GOAL="install"
export TEST_RUNNER_EXTRA="--v2transport --usecli"
export BITCOIN_CONFIG="\
diff --git a/cmake/module/Maintenance.cmake b/cmake/module/Maintenance.cmake
index 52fc7fab..5f4b1d8a 100644
--- a/cmake/module/Maintenance.cmake
+++ b/cmake/module/Maintenance.cmake
@@ -23,7 +23,7 @@ function(add_maintenance_targets)
return()
endif()
- foreach(target IN ITEMS bitcoin bitcoind bitcoin-qt bitcoin-cli bitcoin-tx bitcoin-util bitcoin-wallet test_bitcoin bench_bitcoin)
+ foreach(target IN ITEMS bitcoin bitcoind bitcoin-node bitcoin-qt bitcoin-gui bitcoin-cli bitcoin-tx bitcoin-util bitcoin-wallet test_bitcoin bench_bitcoin)
if(TARGET ${target})
list(APPEND executables $<TARGET_FILE:${target}>)
endif()
diff --git a/depends/Makefile b/depends/Makefile
index 9767b8eb..ed54eac4 100644
--- a/depends/Makefile
+++ b/depends/Makefile
@@ -39,7 +39,8 @@ NO_QR ?=
NO_WALLET ?=
NO_ZMQ ?=
NO_USDT ?=
-MULTIPROCESS ?=
+# Default NO_IPC value is 1 on Windows
+NO_IPC ?= $(if $(findstring mingw32,$(HOST)),1,)
LTO ?=
FALLBACK_DOWNLOAD_PATH ?= https://bitcoincore.org/depends-sources
@@ -161,7 +162,7 @@ qt_native_packages_$(NO_QT) = $(qt_native_packages)
wallet_packages_$(NO_WALLET) = $(sqlite_packages)
zmq_packages_$(NO_ZMQ) = $(zmq_packages)
-multiprocess_packages_$(MULTIPROCESS) = $(multiprocess_packages)
+ipc_packages_$(NO_IPC) = $(ipc_packages)
usdt_packages_$(NO_USDT) = $(usdt_$(host_os)_packages)
packages += $($(host_arch)_$(host_os)_packages) $($(host_os)_packages) $(boost_packages_) $(libevent_packages_) $(qt_packages_) $(wallet_packages_) $(usdt_packages_)
@@ -171,8 +172,8 @@ ifneq ($(zmq_packages_),)
packages += $(zmq_packages)
endif
-ifeq ($(multiprocess_packages_),)
-packages += $(multiprocess_packages)
+ifneq ($(ipc_packages_),)
+packages += $(ipc_packages)
native_packages += $(multiprocess_native_packages)
endif
@@ -231,7 +232,7 @@ $(host_prefix)/toolchain.cmake : toolchain.cmake.in $(host_prefix)/.stamp_$(fina
-e 's|@zmq_packages@|$(zmq_packages_)|' \
-e 's|@wallet_packages@|$(wallet_packages_)|' \
-e 's|@usdt_packages@|$(usdt_packages_)|' \
- -e 's|@multiprocess@|$(MULTIPROCESS)|' \
+ -e 's|@ipc_packages@|$(ipc_packages_)|' \
$< > $@
touch $@
diff --git a/depends/README.md b/depends/README.md
index db309892..94579109 100644
--- a/depends/README.md
+++ b/depends/README.md
@@ -96,7 +96,7 @@ The following can be set when running make: `make FOO=bar`
- `NO_ZMQ`: Don't download/build/cache packages needed for enabling ZeroMQ
- `NO_WALLET`: Don't download/build/cache libs needed to enable the wallet (SQLite)
- `NO_USDT`: Don't download/build/cache packages needed for enabling USDT tracepoints
-- `MULTIPROCESS`: Build libmultiprocess (experimental)
+- `NO_IPC`: Don't build Cap’n Proto and libmultiprocess packages. Default on Windows.
- `DEBUG`: Disable some optimizations and enable more runtime checking
- `HOST_ID_SALT`: Optional salt to use when generating host package ids
- `BUILD_ID_SALT`: Optional salt to use when generating build package ids
diff --git a/depends/packages/packages.mk b/depends/packages/packages.mk
index b6f100f2..4fee4e18 100644
--- a/depends/packages/packages.mk
+++ b/depends/packages/packages.mk
@@ -20,7 +20,7 @@ sqlite_packages=sqlite
zmq_packages=zeromq
-multiprocess_packages = capnp
+ipc_packages = capnp
multiprocess_native_packages = native_libmultiprocess native_capnp
usdt_linux_packages=systemtap
diff --git a/depends/toolchain.cmake.in b/depends/toolchain.cmake.in
index 34984b85..e31d9eef 100644
--- a/depends/toolchain.cmake.in
+++ b/depends/toolchain.cmake.in
@@ -165,11 +165,12 @@ else()
set(WITH_USDT ON CACHE BOOL "")
endif()
-if("@multiprocess@" STREQUAL "1")
+set(ipc_packages @ipc_packages@)
+if("${ipc_packages}" STREQUAL "")
+ set(ENABLE_IPC OFF CACHE BOOL "")
+else()
set(ENABLE_IPC ON CACHE BOOL "")
set(MPGEN_EXECUTABLE "${CMAKE_CURRENT_LIST_DIR}/native/bin/mpgen" CACHE FILEPATH "")
set(CAPNP_EXECUTABLE "${CMAKE_CURRENT_LIST_DIR}/native/bin/capnp" CACHE FILEPATH "")
set(CAPNPC_CXX_EXECUTABLE "${CMAKE_CURRENT_LIST_DIR}/native/bin/capnpc-c++" CACHE FILEPATH "")
-else()
- set(ENABLE_IPC OFF CACHE BOOL "")
endif()
diff --git a/doc/multiprocess.md b/doc/multiprocess.md
index 5a91b513..853f077f 100644
--- a/doc/multiprocess.md
+++ b/doc/multiprocess.md
@@ -16,11 +16,11 @@ Specifying `-DENABLE_IPC=ON` requires [Cap'n Proto](https://capnproto.org/) to b
### Depends installation
-Alternately the [depends system](../depends) can be used to avoid need to install local dependencies. A simple way to get started is to pass the `MULTIPROCESS=1` [dependency option](../depends#dependency-options) to make:
+Alternatively the [depends system](../depends) can be used to avoid needing to install local dependencies:
```
cd <BITCOIN_SOURCE_DIRECTORY>
-make -C depends NO_QT=1 MULTIPROCESS=1
+make -C depends NO_QT=1
# Set host platform to output of gcc -dumpmachine or clang -dumpmachine or check the depends/ directory for the generated subdirectory name
HOST_PLATFORM="x86_64-pc-linux-gnu"
cmake -B build --toolchain=depends/$HOST_PLATFORM/toolchain.cmake
@@ -29,7 +29,7 @@ build/bin/bitcoin -m node -regtest -printtoconsole -debug=ipc
BITCOIN_CMD="bitcoin -m" build/test/functional/test_runner.py
```
-The `cmake` build will pick up settings and library locations from the depends directory, so there is no need to pass `-DENABLE_IPC=ON` as a separate flag when using the depends system (it's controlled by the `MULTIPROCESS=1` option).
+The `cmake` build will pick up settings and library locations from the depends directory, so there is no need to pass `-DENABLE_IPC=ON` as a separate flag when using the depends system (it's controlled by the `NO_IPC=1` option).
### Cross-compiling
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.