depends: Prefix include path for headers-only `systemtap` package
What the developer wrote
Authored by Hennadii Stepanov
depends: Prefix include path for headers-only `systemtap` package
What changed, and why it matters
This commit changes how a tracing header file (systemtap's sdt.h) is installed during Bitcoin Core's dependency build. Previously the header was placed directly in a shared include folder, which could cause other unrelated dependencies to accidentally pick it up. The patch moves it to a package-specific subfolder and explicitly tells the build system where to find it. This is a defensive hardening change rather than a fix for a known active exploit.
Treat as a low-risk build-hardening improvement. No urgent action is required. Reviewers may want to verify that the new USDT_INCLUDE_DIR is correctly consumed by the main CMake build and that no other build paths still reference the old include/sys location.
Security signals we found
Defensive include-path isolation for a headers-only dependency
Prevention of accidental header inclusion across dependency boundaries
Build-system hardening with no runtime code change in Bitcoin Core itself
Evidence from the diff
The systemtap package in depends/ is headers-only and provides sys/sdt.h for USDT (User-level Statically Defined Tracing). Before this commit, the header was copied into $staging_prefix_dir/include/sys/sdt.h during preprocessing, making it reachable through the global include path used by other depends packages. The commit relocates the install to $staging_prefix_dir/systemtap/include/sys/sdt.h and exposes USDT_INCLUDE_DIR in toolchain.cmake.in so the consuming CMake build can add only that precise path. This prevents other dependencies from inadvertently including sys/sdt.h via their own -I flags, reducing the risk of header confusion or unintended macro expansion (e.g., DTRACE_PROBE macros being defined where they should not be).
Changed components
depends/packages/systemtap.mkdepends/toolchain.cmake.inUSDT/tracepoint build integrationInspect captured patch +8 / −3
diff --git a/depends/packages/systemtap.mk b/depends/packages/systemtap.mk
index 668099b0..a9f5e354 100644
--- a/depends/packages/systemtap.mk
+++ b/depends/packages/systemtap.mk
@@ -6,7 +6,11 @@ $(package)_sha256_hash=966a360fb73a4b65a8d0b51b389577b3c4f92a327e84aae58682103e8
$(package)_patches=remove_SDT_ASM_SECTION_AUTOGROUP_SUPPORT_check.patch
define $(package)_preprocess_cmds
- patch -p1 < $($(package)_patch_dir)/remove_SDT_ASM_SECTION_AUTOGROUP_SUPPORT_check.patch && \
- mkdir -p $($(package)_staging_prefix_dir)/include/sys && \
- cp includes/sys/sdt.h $($(package)_staging_prefix_dir)/include/sys/sdt.h
+ patch -p1 < $($(package)_patch_dir)/remove_SDT_ASM_SECTION_AUTOGROUP_SUPPORT_check.patch
+endef
+
+# Install to a unique path to prevent accidental inclusion via other dependencies' -I flags.
+define $(package)_stage_cmds
+ mkdir -p $($(package)_staging_prefix_dir)/$(package)/include/sys && \
+ cp includes/sys/sdt.h $($(package)_staging_prefix_dir)/$(package)/include/sys/sdt.h
endef
diff --git a/depends/toolchain.cmake.in b/depends/toolchain.cmake.in
index e31d9eef..87189efa 100644
--- a/depends/toolchain.cmake.in
+++ b/depends/toolchain.cmake.in
@@ -163,6 +163,7 @@ if("@usdt_packages@" MATCHES "^[ ]*$")
set(WITH_USDT OFF CACHE BOOL "")
else()
set(WITH_USDT ON CACHE BOOL "")
+ set(USDT_INCLUDE_DIR "${CMAKE_CURRENT_LIST_DIR}/systemtap/include" CACHE PATH "")
endif()
set(ipc_packages @ipc_packages@)
Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.