btcutil: use anet instead of net for android builds
What the developer wrote
Authored by Calvin Kim
btcutil: use anet instead of net for android builds
Golang's net package has been broken for android since android 11
and the node will not be able to call net.InterfaceAddr() without
root.
For android builds, we use anet so that the btcd node can be used
without root.
What changed, and why it matters
This change swaps in a third-party networking helper for Android builds only, so the Bitcoin node can list network interface addresses on Android 11+ without needing root access. It is a platform-compatibility fix, not a direct security patch, but it introduces a new external dependency and a build-specific code path that could affect reliability or trust if that dependency has bugs.
Review the anet dependency for maintenance status, correctness, and supply-chain risk; verify it is only used on Android builds; and monitor golang/go#40569 so the workaround can be removed once the upstream issue is resolved.
Security signals we found
New third-party dependency introduced (github.com/kcalvinalvin/anet)
Platform-specific build tag added for Android
Functionality moved from standard library to external package
No explicit security claims in commit message or diff
Evidence from the diff
The commit adds github.com/kcalvinalvin/anet as a dependency and creates a new Android-only file (btcutil/net_android.go) that delegates btcutil.InterfaceAddrs() to anet.InterfaceAddrs(). The existing net.go is gated with !android so it is excluded on Android builds. The stated reason is that Go’s standard net.InterfaceAddrs is broken on Android 11+ without root (golang/go#40569).
Changed components
btcutil/net.gobtcutil/net_android.gobtcutil/go.modbtcutil/go.sumInspect captured patch +30 / −2
diff --git a/btcutil/go.mod b/btcutil/go.mod
index 723a9c9..3b53da6 100644
--- a/btcutil/go.mod
+++ b/btcutil/go.mod
@@ -9,6 +9,7 @@ require (
github.com/btcsuite/btcd/chaincfg/chainhash v1.1.0
github.com/davecgh/go-spew v1.1.1
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1
+ github.com/kcalvinalvin/anet v0.0.0-20251112173137-d8ddc1f6dbee
github.com/kkdai/bstream v0.0.0-20161212061736-f391b8402d23
github.com/stretchr/testify v1.8.4
golang.org/x/crypto v0.25.0
diff --git a/btcutil/go.sum b/btcutil/go.sum
index fa59c6a..9a81f93 100644
--- a/btcutil/go.sum
+++ b/btcutil/go.sum
@@ -16,6 +16,8 @@ github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1 h1:YLtO71vCjJRCBcrPMtQ9nqBsqpA1
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1/go.mod h1:hyedUtir6IdtD/7lIxGeCxkaw7y45JueMRL4DIyJDKs=
github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/kcalvinalvin/anet v0.0.0-20251112173137-d8ddc1f6dbee h1:FPP9HDkBbPyniu+u7FHZg+kKFX1WW0gxOGteJ0h3AJk=
+github.com/kcalvinalvin/anet v0.0.0-20251112173137-d8ddc1f6dbee/go.mod h1:N6sz6HwJAenJ6d+/xmSl0ikfV05ZrVGmjt1ryy/WOtE=
github.com/kkdai/bstream v0.0.0-20161212061736-f391b8402d23 h1:FOOIBWrEkLgmlgGfMuZT83xIwfPDxEI2OHu6xUmJMFE=
github.com/kkdai/bstream v0.0.0-20161212061736-f391b8402d23/go.mod h1:J+Gs4SYgM6CZQHDETBtE9HaSEkGmuNXF86RwHhHUvq4=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
diff --git a/btcutil/net.go b/btcutil/net.go
index ec56386..491e47b 100644
--- a/btcutil/net.go
+++ b/btcutil/net.go
@@ -2,8 +2,8 @@
// Use of this source code is governed by an ISC
// license that can be found in the LICENSE file.
-//go:build !appengine
-// +build !appengine
+//go:build !android && !appengine
+// +build !android,!appengine
package btcutil
diff --git a/btcutil/net_android.go b/btcutil/net_android.go
new file mode 100644
index 0000000..ab99f50
--- /dev/null
+++ b/btcutil/net_android.go
@@ -0,0 +1,25 @@
+// Copyright (c) 2025 The btcsuite developers
+// Use of this source code is governed by an ISC
+// license that can be found in the LICENSE file.
+
+//go:build android
+// +build android
+
+package btcutil
+
+import (
+ "net"
+
+ "github.com/kcalvinalvin/anet"
+)
+
+// InterfaceAddrs returns a list of the system's network interface addresses.
+// We specifically wrap anet.InterfaceAddrs as the net pakcage has been broken
+// since android 11.
+//
+// The relevant github issue link is:
+// https://github.com/golang/go/issues/40569.
+// When the issue is later resolved, we should remove it.
+func InterfaceAddrs() ([]net.Addr, error) {
+ return anet.InterfaceAddrs()
+}
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.