makefile: Change hardcoded homebrew paths
What the developer wrote
Authored by Sangbida Chaudhuri
makefile: Change hardcoded homebrew paths
We're removing the hardcoded homebrew paths for openssl and sqlite as those folder paths may not be correct for all macOS users. Instead we are now calling brew --prefix to get the correct path and use that to populate the LDFLAGS and CPPFLAGS
What changed, and why it matters
This commit changes how the build system finds two software libraries (OpenSSL and SQLite) on Apple Silicon Macs. Previously, the Makefile used fixed paths like /opt/homebrew/opt/openssl@3. Now it asks Homebrew where those libraries actually live. This is a build-portability fix, not a security patch for a vulnerability. It does not change any runtime code that handles money, network messages, or cryptography.
No security action required. Treat as a normal build-system improvement. If auditing, verify that `brew --prefix` output is not attacker-controllable during CI/build environments, though this is not a practical exploit path.
Security signals we found
No security-relevant code changed
Build-system portability improvement only
No mention of vulnerability, CVE, or security fix in commit message
Evidence from the diff
The Makefile is updated to dynamically discover Homebrew prefixes for openssl@3/openssl and sqlite using brew --prefix instead of hardcoding /opt/homebrew/opt paths. LDFLAGS, CPPFLAGS, and PKG_CONFIG_PATH are then populated from the discovered prefixes. This affects only Darwin builds and only the build configuration. No cryptographic, consensus, or networking code is modified.
Changed components
Makefile build configuration for macOS/HomebrewInspect captured patch +15 / −3
diff --git a/Makefile b/Makefile
index 32e95d48..e9958673 100644
--- a/Makefile
+++ b/Makefile
@@ -263,14 +263,26 @@ man8dir = $(mandir)/man8
ifeq ("$(OS)-$(ARCH)", "Darwin-arm64")
CPATH := /opt/homebrew/include
LIBRARY_PATH := /opt/homebrew/lib
-LDFLAGS := -L/opt/homebrew/opt/sqlite/lib -L/opt/homebrew/opt/openssl@3/lib
-CPPFLAGS := -I/opt/homebrew/opt/sqlite/include -I/opt/homebrew/opt/openssl@3/include
-PKG_CONFIG_PATH=/opt/homebrew/opt/sqlite/lib/pkgconfig
else
CPATH := /usr/local/include
LIBRARY_PATH := /usr/local/lib
endif
+# Detect OpenSSL and SQLite paths dynamically using brew --prefix
+ifeq ("$(OS)", "Darwin")
+OPENSSL_PREFIX := $(shell brew --prefix openssl@3 2>/dev/null || brew --prefix openssl 2>/dev/null || echo "")
+SQLITE_PREFIX := $(shell brew --prefix sqlite 2>/dev/null || echo "")
+ifneq ("$(OPENSSL_PREFIX)", "")
+LDFLAGS += -L$(OPENSSL_PREFIX)/lib
+CPPFLAGS += -I$(OPENSSL_PREFIX)/include
+endif
+ifneq ("$(SQLITE_PREFIX)", "")
+LDFLAGS += -L$(SQLITE_PREFIX)/lib
+CPPFLAGS += -I$(SQLITE_PREFIX)/include
+PKG_CONFIG_PATH := $(SQLITE_PREFIX)/lib/pkgconfig:$(PKG_CONFIG_PATH)
+endif
+endif
+
CPPFLAGS += -DCLN_NEXT_VERSION="\"$(CLN_NEXT_VERSION)\"" -DPKGLIBEXECDIR="\"$(pkglibexecdir)\"" -DBINDIR="\"$(bindir)\"" -DPLUGINDIR="\"$(plugindir)\"" -DCCAN_TAL_NEVER_RETURN_NULL=1
CFLAGS = $(CPPFLAGS) $(CWARNFLAGS) $(CDEBUGFLAGS) $(COPTFLAGS) -I $(CCANDIR) $(EXTERNAL_INCLUDE_FLAGS) -I . -I$(CPATH) $(SQLITE3_CFLAGS) $(SODIUM_CFLAGS) $(POSTGRES_INCLUDE) $(FEATURES) $(COVFLAGS) $(DEV_CFLAGS) -DSHACHAIN_BITS=48 -DJSMN_PARENT_LINKS $(PIE_CFLAGS) $(COMPAT_CFLAGS) $(CSANFLAGS)
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.