depends: Prefix include path for headers-only `boost` package
What the developer wrote
Authored by Hennadii Stepanov
depends: Prefix include path for headers-only `boost` package
What changed, and why it matters
This change adjusts how Bitcoin Core's build system installs the Boost C++ library headers. It places Boost headers in a unique subdirectory so that other software components included in the build don't accidentally pick up Boost headers when they shouldn't. This is a defensive build-hygiene fix, not a direct patch for a known exploit.
Treat as a low-risk build-hardening improvement. No urgent action required. Review whether other header-only or CMake-based dependencies should receive similar prefixing for consistency.
Security signals we found
Build system isolation hardening
Prevention of accidental header inclusion across dependencies
Defensive change with no direct exploit path shown
Evidence from the diff
The commit modifies depends/packages/boost.mk to add -DCMAKE_INSTALL_INCLUDEDIR=$(package)/include, causing Boost headers to be installed under a prefixed path (e.g., boost/include) rather than the generic include/ directory. The stated intent is to prevent accidental inclusion of Boost headers via other dependencies’ -I flags. This reduces the risk of header confusion or unintended compilation against Boost, which can affect build determinism and could theoretically mask or contribute to supply-chain/build-time issues. There is no direct vulnerability fix in the diff itself.
Changed components
depends/packages/boost.mkBitcoin Core dependency build system (Boost)Inspect captured patch +2 / −0
diff --git a/depends/packages/boost.mk b/depends/packages/boost.mk
index 2d027c68..02f59abe 100644
--- a/depends/packages/boost.mk
+++ b/depends/packages/boost.mk
@@ -13,6 +13,8 @@ define $(package)_set_vars
$(package)_config_opts += -DBOOST_INSTALL_LAYOUT=system
$(package)_config_opts += -DBUILD_TESTING=OFF
$(package)_config_opts += -DCMAKE_DISABLE_FIND_PACKAGE_ICU=ON
+ # Install to a unique path to prevent accidental inclusion via other dependencies' -I flags.
+ $(package)_config_opts += -DCMAKE_INSTALL_INCLUDEDIR=$(package)/include
endef
define $(package)_config_cmds
Why this scored 28/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.