contrib: more selectively pick files for macOS SDK
What the developer wrote
Authored by fanquake
contrib: more selectively pick files for macOS SDK
Only include what we really need. Skip 100s of mb of manpages,
swiftmodules, modulemaps.
Note that System/Library is only needed for the Qt build.
What changed, and why it matters
This change trims the macOS software development kit (SDK) archive used to build Bitcoin Core for Mac. Instead of bundling the entire SDK, the script now only includes specific directories needed for compilation. This reduces download size and shrinks the attack surface by leaving out unnecessary files such as Swift modules, module maps, and manpages. It is a hardening and maintainability improvement rather than a fix for a known vulnerability.
No urgent action is required. Reviewers should verify that the three retained SDK paths remain sufficient for all supported macOS build configurations, including Qt, and that the new sha256sum matches reproducible builds. Consider documenting the rationale for excluding System/Library paths outside Frameworks if any future build needs them.
Security signals we found
Reduction of included SDK surface area
Exclusion of Swift toolchain metadata files (.swiftmodule, .modulemap)
Explicit allow-listing of SDK paths instead of recursive full-directory inclusion
Updated deterministic build checksum to reflect reduced tarball contents
Evidence from the diff
The commit modifies contrib/macdeploy/gen-sdk, the script that produces the macOS SDK tarball for deterministic Bitcoin Core builds. Previously the script recursively added the whole extracted SDK directory. Now it explicitly adds only ./usr/include, ./usr/lib, and ./System/Library/Frameworks, and the filter drops .swiftmodule and .modulemap files. The README’s expected sha256sum for the generated tarball is updated accordingly. The change is build-hardening: it reduces the set of files that participate in the macOS build and removes toolchain artifacts that are not required by Bitcoin Core.
Changed components
contrib/macdeploy/gen-sdkcontrib/macdeploy/README.mdmacOS deterministic build SDK packagingInspect captured patch +6 / −2
diff --git a/contrib/macdeploy/README.md b/contrib/macdeploy/README.md
index d47ee677..3cbf5b50 100644
--- a/contrib/macdeploy/README.md
+++ b/contrib/macdeploy/README.md
@@ -52,7 +52,7 @@ path to `Xcode.app` (extracted in the previous stage) as the first argument.
```
The generated archive should be: `Xcode-15.0-15A240d-extracted-SDK-with-libcxx-headers.tar.gz`.
-The `sha256sum` should be `c0c2e7bb92c1fee0c4e9f3a485e4530786732d6c6dd9e9f418c282aa6892f55d`.
+The `sha256sum` should be `5aa41897b7f00abdaf1ece242dde3eb96a395746c09638b3a59720694712387d`.
## Deterministic macOS App Notes
diff --git a/contrib/macdeploy/gen-sdk b/contrib/macdeploy/gen-sdk
index f0bbabf8..f2693691 100755
--- a/contrib/macdeploy/gen-sdk
+++ b/contrib/macdeploy/gen-sdk
@@ -68,6 +68,8 @@ def run():
"""
def change_tarinfo_base(tarinfo):
+ if tarinfo.name and tarinfo.name.endswith((".swiftmodule", ".modulemap")):
+ return None
if tarinfo.name and tarinfo.name.startswith("./"):
tarinfo.name = str(pathlib.Path(alt_base_dir, tarinfo.name))
if tarinfo.linkname and tarinfo.linkname.startswith("./"):
@@ -81,7 +83,9 @@ def run():
return tarinfo
with cd(dir_to_add):
# recursion already adds entries in sorted order
- tarfp.add(".", recursive=True, filter=change_tarinfo_base)
+ tarfp.add("./usr/include", recursive=True, filter=change_tarinfo_base)
+ tarfp.add("./usr/lib", recursive=True, filter=change_tarinfo_base)
+ tarfp.add("./System/Library/Frameworks", recursive=True, filter=change_tarinfo_base)
print("Creating output .tar.gz file...")
with out_sdktgz_path.open("wb") as fp:
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.