ci: Use arch-appropriate binaries in lint install
What the developer wrote
Authored by will
ci: Use arch-appropriate binaries in lint install
Replace the hardcoded x86_64 binary name with $(uname --machine) so the
correct binary is downloaded when building the lint container, where at
all possible.
What changed, and why it matters
This is a small continuous-integration (CI) maintenance change. It makes the lint setup script download the correct tool versions for the computer architecture it is running on (e.g., ARM instead of only x86_64), and switches curl from silent mode to fail-on-error mode. It is not a security fix for Bitcoin Core itself and does not change any wallet, networking, or consensus code.
No security action required. Treat as a normal CI improvement. Reviewers may verify that $(uname --machine) matches the release artifact names published by koalaman/shellcheck and becheran/mlc for all supported CI architectures.
Security signals we found
CI script hardening: curl now uses --fail so HTTP errors do not silently install broken/empty tooling binaries
Architecture-aware downloads reduce risk of installing wrong-architecture binaries on non-x86_64 CI runners
Evidence from the diff
The commit modifies ci/lint/01_install.sh to replace hardcoded x86_64 download URLs for shellcheck and mlc with architecture-templated URLs using $(uname –machine). It also changes curl flags from -sL to –fail -L. This is a CI portability/hardening improvement: it enables the lint container to build on non-x86_64 hosts and makes network download failures surface as errors instead of silently producing empty or partial binaries. There is no change to Bitcoin Core runtime, consensus, P2P, wallet, or cryptographic code.
Changed components
ci/lint/01_install.shInspect captured patch +2 / −3
diff --git a/ci/lint/01_install.sh b/ci/lint/01_install.sh
index 9372df5a..a6963a90 100755
--- a/ci/lint/01_install.sh
+++ b/ci/lint/01_install.sh
@@ -47,13 +47,12 @@ ${CI_RETRY_EXE} pip3 install \
ruff==0.15.5
SHELLCHECK_VERSION=v0.11.0
-curl -sL "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" | \
+curl --fail -L "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.linux.$(uname --machine).tar.xz" | \
tar --xz -xf - --directory /tmp/
mv "/tmp/shellcheck-${SHELLCHECK_VERSION}/shellcheck" /usr/bin/
MLC_VERSION=v1.2.0
-MLC_BIN=mlc-x86_64-linux
-curl -sL "https://github.com/becheran/mlc/releases/download/${MLC_VERSION}/${MLC_BIN}" -o "/usr/bin/mlc"
+curl --fail -L "https://github.com/becheran/mlc/releases/download/${MLC_VERSION}/mlc-$(uname --machine)-linux" -o "/usr/bin/mlc"
chmod +x /usr/bin/mlc
popd || exit
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.