Public commit record
90/100 · Strong
What the developer wrote
Authored by Lőrinc
ci: verify cross-build SDK archives
The macOS and BSD cross-build jobs extract SDK archives fetched at runtime without checking their content.
Keep each expected digest beside the corresponding SDK version and verify every archive before extraction.
Create the OpenBSD library symlinks once after both archives are extracted, when all link targets are present.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
What changed, and why it matters
This change adds checksum verification to the build system's downloads of Apple, FreeBSD, NetBSD, and OpenBSD software development kits (SDKs). Before this patch, those SDK archives were downloaded at build time and extracted without confirming they were the expected files. A network attacker or compromised download mirror could have supplied a tampered SDK, potentially altering the compiled Bitcoin Core binaries. The patch also fixes a small timing issue in OpenBSD setup so library symlinks are created only after both required archives are extracted.
Recommended action
No immediate user action is required. This is a beneficial hardening commit. Operators running custom CI mirrors should ensure the published SDK digests match the values now pinned in these scripts, and review the process for updating digests when SDK versions change.
Security signals we found
01
Adds cryptographic digest verification for downloaded SDK archives
02
Removes unchecked extraction of remote SDK archives in CI
03
Hardens CI supply chain for macOS/BSD cross-builds
04
Fixes OpenBSD symlink creation ordering after archive extraction
Evidence from the diff
The commit hard-codes expected SHA-256/SHA-512 digests for macOS/Xcode, FreeBSD, NetBSD, and OpenBSD SDK archives in CI environment scripts and runs sha256sum/sha512sum -c on each downloaded archive before extraction in ci/test/01_base_install.sh. It also moves the OpenBSD unversioned shared-library symlink creation out of the per-archive loop so it runs once after both base79.tgz and comp79.tgz are extracted, ensuring the link targets exist. This is a supply-chain hardening patch for CI cross-compilation, not a runtime consensus change.
Changed components
ci/test/00_setup_env_freebsd_cross.shci/test/00_setup_env_mac_cross.shci/test/00_setup_env_mac_cross_intel.shci/test/00_setup_env_netbsd_cross.shci/test/00_setup_env_openbsd_cross.shci/test/01_base_install.shInspect captured patch +25 / −12
diff --git a/ci/test/00_setup_env_freebsd_cross.sh b/ci/test/00_setup_env_freebsd_cross.sh
index 29602ae2..9a22cb6f 100755
--- a/ci/test/00_setup_env_freebsd_cross.sh
+++ b/ci/test/00_setup_env_freebsd_cross.sh
@@ -12,6 +12,7 @@ export APT_LLVM_V="22"
export HOST=x86_64-unknown-freebsd
export FREEBSD_VERSION=15.1
export FREEBSD_SDK_BASENAME="freebsd-${HOST}-${FREEBSD_VERSION}"
+export FREEBSD_SDK_SHA256=3768988b151c20f965679062b065c63a977d6bbb9f47fd83695ec2c40790c18f
export PACKAGES="clang-${APT_LLVM_V} llvm-${APT_LLVM_V} lld-${APT_LLVM_V}"
export SYSROOT="--sysroot=${DEPENDS_DIR}/SDKs/${FREEBSD_SDK_BASENAME}"
export DEP_OPTS="build_CC=clang build_CXX=clang++ \
diff --git a/ci/test/00_setup_env_mac_cross.sh b/ci/test/00_setup_env_mac_cross.sh
index 63d89fb9..80c6f878 100755
--- a/ci/test/00_setup_env_mac_cross.sh
+++ b/ci/test/00_setup_env_mac_cross.sh
@@ -14,6 +14,7 @@ export HOST=arm64-apple-darwin
export PACKAGES="clang lld llvm zip"
export XCODE_VERSION=26.1.1
export XCODE_BUILD_ID=17B100
+export OSX_SDK_SHA256=9600fa93644df674ee916b5e2c8a6ba8dacf631996a65dc922d003b98b5ea3b1
export RUN_UNIT_TESTS=false
export RUN_FUNCTIONAL_TESTS=false
export GOAL="deploy"
diff --git a/ci/test/00_setup_env_mac_cross_intel.sh b/ci/test/00_setup_env_mac_cross_intel.sh
index 4b07e14b..e679c957 100755
--- a/ci/test/00_setup_env_mac_cross_intel.sh
+++ b/ci/test/00_setup_env_mac_cross_intel.sh
@@ -14,6 +14,7 @@ export HOST=x86_64-apple-darwin
export PACKAGES="clang lld llvm zip"
export XCODE_VERSION=26.1.1
export XCODE_BUILD_ID=17B100
+export OSX_SDK_SHA256=9600fa93644df674ee916b5e2c8a6ba8dacf631996a65dc922d003b98b5ea3b1
export RUN_UNIT_TESTS=false
export RUN_FUNCTIONAL_TESTS=false
export GOAL="deploy"
diff --git a/ci/test/00_setup_env_netbsd_cross.sh b/ci/test/00_setup_env_netbsd_cross.sh
index 4e189552..e817473f 100755
--- a/ci/test/00_setup_env_netbsd_cross.sh
+++ b/ci/test/00_setup_env_netbsd_cross.sh
@@ -12,6 +12,9 @@ export APT_LLVM_V="22"
export HOST=x86_64-unknown-netbsd
export NETBSD_VERSION=11.0
export NETBSD_SDK_BASENAME="netbsd-${HOST}-${NETBSD_VERSION}"
+export NETBSD_SDK_SHA512SUMS="\
+e8871bbedb8c3e0f696cc2596ced0c1e6497939f725fb3495b8d2c168430325907550f5f840f4dd0e3c73e6090394747c5e54762f2737de81177b984403522a8 base.tar.xz\n\
+d8df6c07e9142dd8189292b769ac312f86185a6a278a752c18c840f7cd3a8dd3c535f9b0c8e06b62d556b2c75b97a01d786184e8a18f5e080ccd213591c8628f comp.tar.xz"
export PACKAGES="clang-${APT_LLVM_V} llvm-${APT_LLVM_V} lld-${APT_LLVM_V}"
export SYSROOT="--sysroot=${DEPENDS_DIR}/SDKs/${NETBSD_SDK_BASENAME}"
export DEP_OPTS="build_CC=clang build_CXX=clang++ \
diff --git a/ci/test/00_setup_env_openbsd_cross.sh b/ci/test/00_setup_env_openbsd_cross.sh
index 1732aef3..f9d75e47 100755
--- a/ci/test/00_setup_env_openbsd_cross.sh
+++ b/ci/test/00_setup_env_openbsd_cross.sh
@@ -12,6 +12,9 @@ export APT_LLVM_V="22"
export HOST=x86_64-unknown-openbsd
export OPENBSD_VERSION=7.9
export OPENBSD_SDK_BASENAME="openbsd-${HOST}-${OPENBSD_VERSION}"
+export OPENBSD_SDK_SHA256SUMS="\
+923d2e03f06408d50d4848334398c6d04b5514dcac7917badfc178a0eef248de base79.tgz\n\
+21a67af20aebcabf85b09f4206fc95b4cae0a35d42b154b976f0159f457724f9 comp79.tgz"
export PACKAGES="clang-${APT_LLVM_V} llvm-${APT_LLVM_V} lld-${APT_LLVM_V}"
export SYSROOT="--sysroot=${DEPENDS_DIR}/SDKs/${OPENBSD_SDK_BASENAME}"
export DEP_OPTS="NO_QT=1 build_CC=clang build_CXX=clang++ \
diff --git a/ci/test/01_base_install.sh b/ci/test/01_base_install.sh
index f619a088..a2775902 100755
--- a/ci/test/01_base_install.sh
+++ b/ci/test/01_base_install.sh
@@ -115,18 +115,20 @@ if [ -n "$XCODE_VERSION" ] && [ ! -d "${DEPENDS_DIR}/SDKs/${OSX_SDK_BASENAME}" ]
if [ ! -f "$OSX_SDK_PATH" ]; then
${CI_RETRY_EXE} curl --location --fail "${SDK_URL}/${OSX_SDK_FILENAME}" -o "$OSX_SDK_PATH"
fi
+ sha256sum -c <<<"${OSX_SDK_SHA256} ${OSX_SDK_PATH}"
tar -C "${DEPENDS_DIR}/SDKs" -xf "$OSX_SDK_PATH"
fi
if [ -n "$NETBSD_VERSION" ] && [ ! -d "${DEPENDS_DIR}/SDKs/${NETBSD_SDK_BASENAME}" ]; then
mkdir -p "${DEPENDS_DIR}/SDKs/${NETBSD_SDK_BASENAME}"
- for NETBSD_SDK_FILENAME in base.tar.xz comp.tar.xz; do
+ while read -r NETBSD_SDK_SHA512 NETBSD_SDK_FILENAME; do
NETBSD_SDK_PATH="${DEPENDS_DIR}/sdk-sources/${NETBSD_SDK_FILENAME}"
if [ ! -f "$NETBSD_SDK_PATH" ]; then
${CI_RETRY_EXE} curl --location --fail "https://cdn.netbsd.org/pub/NetBSD/NetBSD-${NETBSD_VERSION}/amd64/binary/sets/${NETBSD_SDK_FILENAME}" -o "$NETBSD_SDK_PATH"
fi
+ sha512sum -c <<<"${NETBSD_SDK_SHA512} ${NETBSD_SDK_PATH}"
tar -C "${DEPENDS_DIR}/SDKs/${NETBSD_SDK_BASENAME}" -xf "$NETBSD_SDK_PATH"
- done
+ done < <(printf '%b\n' "${NETBSD_SDK_SHA512SUMS}")
fi
if [ -n "$FREEBSD_VERSION" ] && [ ! -d "${DEPENDS_DIR}/SDKs/${FREEBSD_SDK_BASENAME}" ]; then
@@ -135,27 +137,29 @@ if [ -n "$FREEBSD_VERSION" ] && [ ! -d "${DEPENDS_DIR}/SDKs/${FREEBSD_SDK_BASENA
if [ ! -f "$FREEBSD_SDK_PATH" ]; then
${CI_RETRY_EXE} curl --location --fail "https://download.freebsd.org/releases/amd64/${FREEBSD_VERSION}-RELEASE/base.txz" -o "$FREEBSD_SDK_PATH"
fi
+ sha256sum -c <<<"${FREEBSD_SDK_SHA256} ${FREEBSD_SDK_PATH}"
mkdir -p "${DEPENDS_DIR}/SDKs/${FREEBSD_SDK_BASENAME}"
tar -C "${DEPENDS_DIR}/SDKs/${FREEBSD_SDK_BASENAME}" -xf "$FREEBSD_SDK_PATH"
fi
if [ -n "$OPENBSD_VERSION" ] && [ ! -d "${DEPENDS_DIR}/SDKs/${OPENBSD_SDK_BASENAME}" ]; then
mkdir -p "${DEPENDS_DIR}/SDKs/${OPENBSD_SDK_BASENAME}"
- for OPENBSD_SDK_FILENAME in base79.tgz comp79.tgz; do
+ while read -r OPENBSD_SDK_SHA256 OPENBSD_SDK_FILENAME; do
OPENBSD_SDK_PATH="${DEPENDS_DIR}/sdk-sources/${OPENBSD_SDK_FILENAME}"
if [ ! -f "$OPENBSD_SDK_PATH" ]; then
${CI_RETRY_EXE} curl --location --fail "https://cdn.openbsd.org/pub/OpenBSD/${OPENBSD_VERSION}/amd64/${OPENBSD_SDK_FILENAME}" -o "$OPENBSD_SDK_PATH"
fi
+ sha256sum -c <<<"${OPENBSD_SDK_SHA256} ${OPENBSD_SDK_PATH}"
tar -C "${DEPENDS_DIR}/SDKs/${OPENBSD_SDK_BASENAME}" -xf "$OPENBSD_SDK_PATH"
- (
- # The SDK has versioned shared libs, but no unversioned libfoo.so symlink,
- # which breaks linking the kernel with lld. Create the symlinks.
- cd "${DEPENDS_DIR}/SDKs/${OPENBSD_SDK_BASENAME}/usr/lib"
- ln -sf libc++abi.so.*.* libc++abi.so
- ln -sf libc++.so.*.* libc++.so
- ln -sf libpthread.so.*.* libpthread.so
- )
- done
+ done < <(printf '%b\n' "${OPENBSD_SDK_SHA256SUMS}")
+ (
+ # The SDK has versioned shared libs, but no unversioned libfoo.so symlink,
+ # which breaks linking the kernel with lld. Create the symlinks.
+ cd "${DEPENDS_DIR}/SDKs/${OPENBSD_SDK_BASENAME}/usr/lib"
+ ln -sf libc++abi.so.*.* libc++abi.so
+ ln -sf libc++.so.*.* libc++.so
+ ln -sf libpthread.so.*.* libpthread.so
+ )
fi
echo -n "done" > "${CFG_DONE}"
Risk score
Our methodology →Why this scored 47/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.