depends: Unset `SOURCE_DATE_EPOCH` in `gen_id` script
What the developer wrote
Authored by Hennadii Stepanov
depends: Unset `SOURCE_DATE_EPOCH` in `gen_id` script
What changed, and why it matters
This commit tweaks the Bitcoin Core dependency build system so that an environment variable used for reproducible builds (SOURCE_DATE_EPOCH) is cleared before generating package IDs. The goal is to avoid unnecessary rebuilds of dependencies when only that timestamp changes, improving build-cache reuse. There is no direct security vulnerability in the diff itself; it is a build-system hygiene change.
No urgent action required. Treat as a normal build-system improvement. Reviewers may verify that unsetting SOURCE_DATE_EPOCH does not weaken reproducibility guarantees elsewhere in the build pipeline.
Security signals we found
Build reproducibility / deterministic-build concern
Environment variable isolation in build scripts
No memory safety, cryptographic, or network security change
Evidence from the diff
The depends/gen_id script computes a hash-based ID for each dependency package. The ID determines whether a prebuilt package can be reused from cache. SOURCE_DATE_EPOCH is normally set during reproducible builds and can influence tool output. If it leaks into the generated ID, identical dependency sources would get different IDs whenever the timestamp changes, causing cache misses and redundant rebuilds. The patch unsets the variable inside the script so the ID is stable. This is a deterministic-build/cache-efficiency fix, not a code-execution or cryptographic bug.
Changed components
depends/gen_id build scriptInspect captured patch +4 / −0
diff --git a/depends/gen_id b/depends/gen_id
index 5504deeb..b9104c43 100755
--- a/depends/gen_id
+++ b/depends/gen_id
@@ -28,6 +28,10 @@
# Redirect stderr to stdout
exec 2>&1
+ # Unset SOURCE_DATE_EPOCH to prevent it from leaking into tool
+ # outputs and to maximize reuse of the built package cache.
+ unset SOURCE_DATE_EPOCH
+
echo "BEGIN ALL"
# Include any ID salts supplied via command line
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.