Revert "depends: Use hash instead of file name for package download stamp"
What the developer wrote
Authored by Ava Chow
Revert "depends: Use hash instead of file name for package download stamp"
This reverts commit 6de80512632afe612a3427463c94ac51f90f5203.
What changed, and why it matters
This commit undoes a recent change in the Bitcoin Core dependency build system. The original change made build stamps use a cryptographic hash to track downloaded packages; this reversion goes back to using the package file name. On its own, this is a build-system correctness/reliability change, not a clearly exploitable security vulnerability. It could, in unusual cases, make the build slightly more prone to re-downloading or cache-confusion issues if a package file name stays the same while its contents change, but no direct attack is demonstrated in the commit.
Treat as a low-severity build-system regression. Monitor whether the reverted change was reintroduced with additional fixes. If building depends from source, verify downloaded package hashes independently and clean download-stamps when package definitions change. No emergency response is warranted based solely on this commit.
Security signals we found
Reversion from content-addressed (hash-based) stamp to name-based stamp
Potential build cache invalidation weakness in depends system
No explicit security claim or CVE in commit message
Evidence from the diff
The patch reverts depends/funcs.mk so that the download stamp file for depends packages is named after $(1)_file_name rather than a combination of version and sha256_hash. The previous hash-based stamp ensured that any change to the package’s content or version produced a distinct stamp, preventing stale cache state. Reverting to file-name-based stamps means two different packages with the same file name could share a stamp, potentially causing the build system to skip a needed download or reuse a stale source archive. There is no diff evidence of an actual exploit, only a regression in build-system robustness.
Changed components
depends/funcs.mkBitcoin Core dependency build systemInspect captured patch +1 / −1
diff --git a/depends/funcs.mk b/depends/funcs.mk
index 6c38334e..33c9c68c 100644
--- a/depends/funcs.mk
+++ b/depends/funcs.mk
@@ -108,7 +108,7 @@ $(1)_prefixbin:=$($($(1)_type)_prefix)/bin/
$(1)_all_sources=$($(1)_file_name) $($(1)_extra_sources)
#stamps
-$(1)_fetched=$(SOURCES_PATH)/download-stamps/.stamp_fetched-$(1)-$($(1)_version)-$($(1)_sha256_hash).hash
+$(1)_fetched=$(SOURCES_PATH)/download-stamps/.stamp_fetched-$(1)-$($(1)_file_name).hash
$(1)_extracted=$$($(1)_extract_dir)/.stamp_extracted
$(1)_preprocessed=$$($(1)_extract_dir)/.stamp_preprocessed
$(1)_cleaned=$$($(1)_extract_dir)/.stamp_cleaned
Why this scored 14/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.