depends: Use $(package)_file_name when downloading from the fallback
What the developer wrote
Authored by Ava Chow
depends: Use $(package)_file_name when downloading from the fallback
What changed, and why it matters
This is a one-line fix in Bitcoin Core's dependency build system. When downloading a required library from a fallback mirror, the code was accidentally using the original download URL as the filename instead of the intended filename. This could cause the downloaded file to be saved under the wrong name, potentially leading to a failed or mismatched build. The change makes the fallback download use the correct filename.
Review whether this bug could cause incorrect dependency tarballs to be cached or used in builds. If the fallback path was ever triggered, verify cached files in depends/sources. Consider whether a build reproducibility or supply-chain advisory is warranted if the wrong filename could lead to using an unintended source archive.
Security signals we found
Incorrect filename argument passed to download helper in fallback path
Potential for cached dependency tarball to be written under wrong name
Could cause build to use stale or mismatched dependency source if fallback is triggered
Evidence from the diff
In depends/funcs.mk, the fetch_file macro calls fetch_file_inner twice: first for the primary download path, then for FALLBACK_DOWNLOAD_PATH. The original fallback call passed $(3) (the source URL) as the third argument, but fetch_file_inner expects that argument to be the output filename. The patch changes the fallback call to pass $(4), which is $(package)_file_name, matching the primary download call. This corrects a parameter-order bug in the Makefile macro.
Changed components
depends/funcs.mkBitcoin Core dependency build system (fallback download path)Inspect captured patch +1 / −1
diff --git a/depends/funcs.mk b/depends/funcs.mk
index 6c38334e..aeb8688d 100644
--- a/depends/funcs.mk
+++ b/depends/funcs.mk
@@ -37,7 +37,7 @@ endef
define fetch_file
( $(call fetch_file_inner,$(1),$(2),$(3),$(4),$(5)) || \
- $(call fetch_file_inner,$(1),$(FALLBACK_DOWNLOAD_PATH),$(3),$(4),$(5)))
+ $(call fetch_file_inner,$(1),$(FALLBACK_DOWNLOAD_PATH),$(4),$(4),$(5)))
endef
# Shell script to create a source tarball in $(1)_source from local directory
Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.