depends: Fix `$(package)_fetched` target
What the developer wrote
Authored by Hennadii Stepanov
depends: Fix `$(package)_fetched` target
Ensure the download timestamp is created only after a successful
download.
What changed, and why it matters
This commit fixes a build-system bug in Bitcoin Core's dependency downloader. Previously, the build system would create a 'download finished' timestamp file before the download actually completed. If the download was interrupted or failed, that timestamp file could still exist, making the build system think the dependency was already downloaded and skip retrying. The fix moves the timestamp creation to after the download and checksum steps succeed. This is primarily a reliability/build correctness issue; direct security impact is limited and indirect.
Treat as a low-severity build-hygiene fix. Merge promptly. Review whether interrupted downloads can leave partially written source archives in SOURCES_PATH that might satisfy later build steps or require manual cleanup; consider adding atomic download-to-temp-and-rename. No emergency response warranted.
Security signals we found
Premature success marker before verification
Build cache/target staleness risk
Dependency supply-chain integrity indirectly affected
No cryptographic bypass; checksum still enforced before final stamp
Evidence from the diff
In depends/funcs.mk, the $($(1)_fetched) target previously ran touch $$@ before executing $($(1)_fetch_cmds) and SHA256SUM verification. This created the stamp file prematurely. On a failed or partial fetch, Make would consider the target up-to-date and not re-fetch on subsequent builds. The patch removes the pre-fetch touch and keeps only the post-success touch, ensuring the stamp reflects a completed, verified download. The security-relevant consequence is that a truncated or maliciously substituted source archive could be cached and reused if the failure path left partial files in place, though the checksum step still runs before the final stamp and would fail on the next attempt if the file is corrupt. The main risk is build nondeterminism or stale cached artifacts during development/gitian builds.
Changed components
depends/funcs.mkBitcoin Core dependency build system (depends)Source fetch and cache stamp logicInspect captured patch +0 / −1
diff --git a/depends/funcs.mk b/depends/funcs.mk
index 28baf471..31ce5f67 100644
--- a/depends/funcs.mk
+++ b/depends/funcs.mk
@@ -247,7 +247,6 @@ endif
$($(1)_fetched):
mkdir -p $$(@D) $(SOURCES_PATH)
rm -f $$@
- touch $$@
cd $$(@D); $($(1)_fetch_cmds)
cd $($(1)_source_dir); $(foreach source,$($(1)_all_sources),$(build_SHA256SUM) $(source) >> $$(@);)
touch $$@
Why this scored 24/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.