ci: Remove bash -c from cmake invocation using eval
What the developer wrote
Authored by Brandon Odiwuor
ci: Remove bash -c from cmake invocation using eval
What changed, and why it matters
This commit changes how a Bitcoin Core CI script passes build options to the CMake build tool. Previously, all options were concatenated into a single string and run through 'bash -c', which could mishandle special characters in option values. Now the options are parsed into a proper array using 'eval' and passed directly to CMake. This is a code-quality and robustness improvement in internal CI tooling, not a fix for an active exploit in the Bitcoin software itself.
Treat as a routine CI hardening change. No urgent action required for node operators or downstream users. Reviewers may verify that BITCOIN_CONFIG_ALL and BITCOIN_CONFIG values do not contain shell metacharacters that could still be expanded by eval.
Security signals we found
Defensive removal of unnecessary shell string interpretation in CI command construction
Use of eval remains, but only to split pre-existing configuration variables into an array, not to execute arbitrary commands
No changes to Bitcoin Core runtime, consensus, networking, or wallet code
No vendor disclosure of security relevance or CVE in commit message
Evidence from the diff
The patch modifies ci/test/03_test_script.sh to replace ‘bash -c “cmake … $BITCOIN_CONFIG_ALL $BITCOIN_CONFIG”’ with an eval that populates an array, followed by a direct cmake invocation using quoted array expansion: ‘cmake -S “$BASE_ROOT_DIR” -B “$BASE_BUILD_DIR” “${CMAKE_ARGS[@]}”’. This avoids a single-shell-string interpretation layer and reduces the risk of word-splitting or unintended shell expansion of option values. The change is defensive hardening of CI command construction; it does not alter consensus, P2P, wallet, or RPC code.
Changed components
ci/test/03_test_script.shInspect captured patch +2 / −1
diff --git a/ci/test/03_test_script.sh b/ci/test/03_test_script.sh
index 05e4d8fd..cee09cde 100755
--- a/ci/test/03_test_script.sh
+++ b/ci/test/03_test_script.sh
@@ -130,7 +130,8 @@ if [[ "${RUN_TIDY}" == "true" ]]; then
BITCOIN_CONFIG_ALL="$BITCOIN_CONFIG_ALL -DCMAKE_EXPORT_COMPILE_COMMANDS=ON"
fi
-bash -c "cmake -S $BASE_ROOT_DIR -B ${BASE_BUILD_DIR} $BITCOIN_CONFIG_ALL $BITCOIN_CONFIG" || (
+eval "CMAKE_ARGS=($BITCOIN_CONFIG_ALL $BITCOIN_CONFIG)"
+cmake -S "$BASE_ROOT_DIR" -B "$BASE_BUILD_DIR" "${CMAKE_ARGS[@]}" || (
cd "${BASE_BUILD_DIR}"
# shellcheck disable=SC2046
cat $(cmake -P "${BASE_ROOT_DIR}/ci/test/GetCMakeLogFiles.cmake")
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.