depends: Use hash instead of file name for package download stamp
What the developer wrote
Authored by Hennadii Stepanov
depends: Use hash instead of file name for package download stamp
The package version is still included for convenience.
What changed, and why it matters
This commit changes how Bitcoin Core's dependency build system names its 'already downloaded' marker files. Previously the marker file included the downloaded file's original name; now it uses the package version plus the file's cryptographic hash. This is a hardening improvement that makes the build less likely to be confused if a downloaded file is renamed or replaced, but the commit itself does not claim to fix any active security vulnerability.
No urgent action required. Treat as a routine build-hardening improvement. Reviewers may consider whether any edge cases remain where the hash is not verified before the stamp is created, but the change itself is defensive and low-risk.
Security signals we found
Build-system hardening: stamp file now keyed on cryptographic hash instead of user-controlled file name
Reduces risk of stale/incorrect download stamps when file names collide or are reused across versions
No vendor claim of security relevance, CVE, or vulnerability disclosure in commit or supplied references
Evidence from the diff
In depends/funcs.mk, the stamp file path used to track whether a dependency source archive has been fetched is changed from .stamp_fetched-$(pkg)-$(file_name).hash to .stamp_fetched-$(pkg)-$(version)-$(sha256_hash).hash. The build system uses these stamp files to avoid re-downloading already-cached sources. By tying the stamp to the content hash rather than the file name, the build becomes more robust against name collisions, renamed tarballs, or stale stamps when upstream changes packaging. It is a defensive build-integrity improvement, not a patch for an exploitable runtime bug.
Changed components
depends/funcs.mkBitcoin Core dependency build system (download stamp tracking)Inspect captured patch +1 / −1
diff --git a/depends/funcs.mk b/depends/funcs.mk
index 33c9c68c..6c38334e 100644
--- a/depends/funcs.mk
+++ b/depends/funcs.mk
@@ -108,7 +108,7 @@ $(1)_prefixbin:=$($($(1)_type)_prefix)/bin/
$(1)_all_sources=$($(1)_file_name) $($(1)_extra_sources)
#stamps
-$(1)_fetched=$(SOURCES_PATH)/download-stamps/.stamp_fetched-$(1)-$($(1)_file_name).hash
+$(1)_fetched=$(SOURCES_PATH)/download-stamps/.stamp_fetched-$(1)-$($(1)_version)-$($(1)_sha256_hash).hash
$(1)_extracted=$$($(1)_extract_dir)/.stamp_extracted
$(1)_preprocessed=$$($(1)_extract_dir)/.stamp_preprocessed
$(1)_cleaned=$$($(1)_extract_dir)/.stamp_cleaned
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.