AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 15 Bitcoin

update-mocks: make handling of mocks in nested files deterministic.

Public commit record

What the developer wrote

Authored by Rusty Russell

88/100 · Strong
update-mocks: make handling of mocks in nested files deterministic.

update-mocks searches for prototypes, looking first in the local
directory, then in */*.h, and takes the first. In the case of
plugins/bkpr/test/run-currencyrate_str.c referring to
jsonrpc_request_start_, this means it could get either the one in
libplugin (correct) or the one in lightningd (wrong!), depending on
directory order randomness.

Hack it a bit harder, to look one up from the local dir before */*.h.
This is redundant in most cases, but not for three-deep-nested dirs
like this.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
The short version

What changed, and why it matters

This commit fixes a build-tool quirk that could pick the wrong function prototype when generating test mock stubs for deeply nested source directories. The wrong prototype would produce a test stub with mismatched function parameters, which could cause test compilation to fail or tests to behave incorrectly. It is a build/test reliability fix, not a directly exploitable security vulnerability in running software.

Recommended action

Treat as a normal reliability/build fix. No urgent security action is required. If backporting, include it to avoid flaky or incorrect test builds in deeply nested plugin tests.

Security signals we found

01

Build/test tooling correctness fix

02

Potential wrong function prototype selection in generated mocks

03

Determinism issue in mock generation due to directory ordering

04

No runtime code path affected; only unit-test stub generation

Risk score

Why this scored 15/100

Our methodology →
Potential impact 2/30
Exploitability 0/25
Stealth signal 1/15
Affected reach 2/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.