contrib/make_download: sort signers, instead of random fs order
What the developer wrote
Authored by SomberNight
contrib/make_download: sort signers, instead of random fs order
What changed, and why it matters
This is a tiny build-script change that sorts the list of files in the 'dist' directory alphabetically instead of using whatever order the filesystem happens to return. It makes the generated download page deterministic and easier to review, but it does not fix a vulnerability that can be directly exploited by an attacker.
Treat as a minor hygiene/reproducibility improvement. No urgent security action is required. Reviewers may want to confirm that the resulting download page ordering is now stable across builds.
Security signals we found
Deterministic build/release output reduces risk of unnoticed tampering or diff noise
No input validation, cryptographic, or privilege changes present
No memory safety, injection, or authentication changes present
Evidence from the diff
The commit changes one line in contrib/make_download, replacing os.listdir(‘dist’) with sorted(os.listdir(‘dist’)). This script appears to detect extra PGP signature files (.asc) in the release distribution directory and list signers on the download page. Without sorting, filesystem order could vary between builds, producing non-reproducible output. The change improves determinism and auditability of the release page, but there is no direct security bug being patched in the diff itself.
Changed components
contrib/make_downloadInspect captured patch +1 / −1
diff --git a/contrib/make_download b/contrib/make_download
index d3c9937..deb515c 100755
--- a/contrib/make_download
+++ b/contrib/make_download
@@ -57,7 +57,7 @@ files = {
signers = ['ThomasV', 'sombernight_releasekey']
# detect extra signers
-list_dir = os.listdir('dist')
+list_dir = sorted(os.listdir('dist'))
detected_sigs = defaultdict(set)
for f in list_dir:
if f.endswith('.asc'):
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.