AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 15 Bitcoin

macdeploy: disable compression in macOS gen-sdk script

Public commit record

What the developer wrote

Authored by fanquake

81/100 · Strong
macdeploy: disable compression in macOS gen-sdk script

Starting with Python 3.11, Pythons gzip might delegate to zlib.
Depending on the OS, i.e Ubuntu vs Fedora, the underlying zlib
implementation might differ, resulting in different output.

For now, or until a better solution exists, disable compression. This
results in the SDK increasing in size to ~157mb. Which is not
unreasonable, to regain determinism (and would be significantly worse
without the previous commit).

See: https://docs.python.org/3/library/gzip.html#gzip.compress

Co-authored-by: stickies-v <stickies-v@protonmail.com>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit changes the macOS SDK packaging script for Bitcoin Core so that it produces an uncompressed .tar archive instead of a .tar.gz archive. The reason is that different Linux distributions use different underlying compression libraries, which can produce slightly different compressed files even from identical input. That breaks reproducible builds (determinism), where everyone expects the exact same output. The uncompressed archive is larger (~157 MB) but byte-for-byte identical across machines. There is no security vulnerability being fixed here.

Recommended action

No security action required. Treat as a normal build-system reproducibility improvement. Reviewers may verify that the new uncompressed SDK tarball still extracts correctly and that CI caches/URLs are updated to match the .tar filename.

Security signals we found

No strong security signals were identified.

Risk score

Why this scored 15/100

Our methodology →
Potential impact 0/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 0/15
Confidence 10/10
Evidence quality 5/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.