What the developer wrote
Authored by ci
ci: mount .git dir rw
On merges to master we set LINT_CI_SANITY_CHECK_COMMIT_SIG (when
"GITHUB_REPOSITORY == bitcoin/bitcoin") which runs verify-commits.py.
This requires write access to the .git directory.
Make the mounted .git directory writable.
This is currently not run on PR branches or locally which caused a miss
during review.
What changed, and why it matters
This is a tiny CI infrastructure fix. The Bitcoin Core lint CI script runs inside a Docker container and previously mounted the main Git directory read-only. A recently added sanity check (verify-commits.py) needs to write into the Git directory, so the mount is changed to read-write. The change only affects automated lint/merge checks on the master branch and does not change Bitcoin node code, wallet logic, or network behavior. It is not a security vulnerability fix; it is a build-script correction to prevent a CI failure.
No security action required. Treat as a normal CI reliability fix. Reviewers may want to confirm that verify-commits.py's write access to the Git directory is intentional and limited to expected Git metadata, but the patch itself is not a vulnerability.
Security signals we found
CI script change only
Read-only mount removed to satisfy write requirement of verify-commits.py
No change to consensus, networking, wallet, or RPC code
No privilege escalation or sandbox escape introduced by the diff itself
Evidence from the diff
In ci/lint.py, get_worktree_mounts() returns Docker –volume flags used when running the lint CI in a container. The main_gitdir mount was suffixed :ro (read-only). verify-commits.py, invoked when LINT_CI_SANITY_CHECK_COMMIT_SIG is set on merges to master in the bitcoin/bitcoin GitHub repository, apparently modifies the Git directory (e.g., updating refs or commit-signature metadata). The read-only mount caused that step to fail. The patch removes :ro, making the mount read-write. This is a CI-only change with no effect on the Bitcoin Core binaries or runtime.
Changed components
ci/lint.pyGitHub Actions lint CI workflow (master merges only)verify-commits.py sanity checkInspect captured patch +1 / −1
diff --git a/ci/lint.py b/ci/lint.py
index 8e2a1e55..e94a26af 100755
--- a/ci/lint.py
+++ b/ci/lint.py
@@ -31,7 +31,7 @@ def get_worktree_mounts(repo_root):
main_gitdir = gitdir.parent.parent
return [
f"--volume={gitdir}:{gitdir}",
- f"--volume={main_gitdir}:{main_gitdir}:ro",
+ f"--volume={main_gitdir}:{main_gitdir}",
]
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.