What the developer wrote
Authored by MarcoFalke
ci: Untangle CI_EXEC bash function
It contains a large `bash -c` string, which is hard to parse. So pull
out components:
* CI_EXEC is only called with absolute folders as args, so the `cd` is
not needed in CI_EXEC. It is only needed to specify the working dir of
running the tests in 03_test_script.sh, so move it there.
* The PATH modification is only needed after commit
4756114e505cff8848fb6344ef9a48d8822066c1 to check that depends does
work properly, even when the PATH contains a space.
* This allows to also drop the `bash -c` and use the proper and safer
"$@" to forward args without the risk of word splitting.
What changed, and why it matters
This is a routine cleanup of Bitcoin Core's internal continuous integration (CI) shell scripts. It rewrites a helper function so arguments are passed more safely and moves a directory change and a test-only PATH tweak into the script that actually runs tests. There is no change to the Bitcoin node software, wallet handling, network protocol, or any user-facing behavior.
No security action needed. Treat as a normal CI maintainability improvement.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit refactors CI_EXEC in ci/test/02_run_container.sh from $CI_EXEC_CMD_PREFIX bash -c "export PATH=... && cd ... && $*" to $CI_EXEC_CMD_PREFIX "$@", eliminating a bash -c indirection and unsafe $* expansion. The cd "${BASE_ROOT_DIR}" and the synthetic PATH entry /path_with space are relocated to ci/test/03_test_script.sh. The functional effect is identical: CI still runs commands inside the container with the same working directory and the same PATH containing a space, but the code is simpler and avoids word-splitting when forwarding arguments.
Changed components
ci/test/02_run_container.shci/test/03_test_script.shInspect captured patch +4 / −1
diff --git a/ci/test/02_run_container.sh b/ci/test/02_run_container.sh
index 77c70f82..eac8a0e5 100755
--- a/ci/test/02_run_container.sh
+++ b/ci/test/02_run_container.sh
@@ -13,7 +13,7 @@ if [ -z "$DANGER_RUN_CI_ON_HOST" ]; then
fi
CI_EXEC () {
- $CI_EXEC_CMD_PREFIX bash -c "export PATH=\"/path_with space:\$PATH\" && cd \"${BASE_ROOT_DIR}\" && $*"
+ $CI_EXEC_CMD_PREFIX "$@"
}
export -f CI_EXEC
diff --git a/ci/test/03_test_script.sh b/ci/test/03_test_script.sh
index e61dc33e..39e13945 100755
--- a/ci/test/03_test_script.sh
+++ b/ci/test/03_test_script.sh
@@ -8,6 +8,9 @@ export LC_ALL=C.UTF-8
set -ex
+cd "${BASE_ROOT_DIR}"
+
+export PATH="/path_with space:${PATH}"
export ASAN_OPTIONS="detect_leaks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1"
export LSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/lsan"
export TSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/tsan:halt_on_error=1:second_deadlock_stack=1"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.