build: docker run: make "-it" flags conditional on tty being available
What the developer wrote
Authored by SomberNight
build: docker run: make "-it" flags conditional on tty being available
from https://stackoverflow.com/a/69088164
I am trying to run the build.sh scripts directly on a cirrus CI runner, and "docker run -it" is erroring due to lack of a tty.
What changed, and why it matters
This commit changes Electrum's build scripts so that when running Docker containers, the '-it' flags (which request an interactive terminal) are only added if a terminal is actually available. Previously, the scripts always used 'docker run -it', which fails in non-interactive environments like CI systems because there is no TTY. This is a build-script reliability fix with no security relevance.
No security action needed. Treat as a normal build/CI improvement.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies four build shell scripts (Android, AppImage, sdist, Wine) to test whether /dev/tty is writable before appending ‘-it’ to DOCKER_RUN_FLAGS. The test ‘sh -c “: >/dev/tty”’ succeeds only when a controlling TTY exists. This allows the same build scripts to run both locally in an interactive shell and in automated CI environments where no TTY is allocated. No application code, cryptographic logic, network handling, or privilege model is changed.
Changed components
contrib/android/build.shcontrib/build-linux/appimage/build.shcontrib/build-linux/sdist/build.shcontrib/build-wine/build.shInspect captured patch +26 / −5
diff --git a/contrib/android/build.sh b/contrib/android/build.sh
index 08a9b31..a156838 100755
--- a/contrib/android/build.sh
+++ b/contrib/android/build.sh
@@ -63,11 +63,14 @@ else
fi
DOCKER_RUN_FLAGS=""
-
if [[ "$3" == "release" ]] ; then
info "'release' mode selected. mounting ~/.keystore inside container."
DOCKER_RUN_FLAGS="-v $HOME/.keystore:/home/user/.keystore"
fi
+if sh -c ": >/dev/tty" >/dev/null 2>/dev/null; then
+ info "/dev/tty is available and usable"
+ DOCKER_RUN_FLAGS="$DOCKER_RUN_FLAGS -it"
+fi
info "building binary..."
mkdir --parents "$PROJECT_ROOT_OR_FRESHCLONE_ROOT"/.buildozer/.gradle
@@ -78,7 +81,7 @@ if [ ! -z "$ELECBUILD_COMMIT" ] ; then # fresh clone (reproducible build)
sudo chown -R 1000:1000 "$FRESH_CLONE"
fi
fi
-docker run -it --rm \
+docker run --rm \
--name electrum-android-builder-cont \
-v "$PROJECT_ROOT_OR_FRESHCLONE_ROOT":/home/user/wspace/electrum \
-v "$PROJECT_ROOT_OR_FRESHCLONE_ROOT"/.buildozer/.gradle:/home/user/.gradle \
diff --git a/contrib/build-linux/appimage/build.sh b/contrib/build-linux/appimage/build.sh
index c16b19f..8f66d53 100755
--- a/contrib/build-linux/appimage/build.sh
+++ b/contrib/build-linux/appimage/build.sh
@@ -50,6 +50,12 @@ fi
# defined in the type2-runtime repo (patched with type2-runtime-reproducible-build.patch)
"$CONTRIB_APPIMAGE/make_type2_runtime.sh" || fail "Error building type2-runtime."
+DOCKER_RUN_FLAGS=""
+if sh -c ": >/dev/tty" >/dev/null 2>/dev/null; then
+ info "/dev/tty is available and usable"
+ DOCKER_RUN_FLAGS="-it"
+fi
+
info "building binary..."
# check uid and maybe chown. see #8261
if [ ! -z "$ELECBUILD_COMMIT" ] ; then # fresh clone (reproducible build)
@@ -58,7 +64,7 @@ if [ ! -z "$ELECBUILD_COMMIT" ] ; then # fresh clone (reproducible build)
sudo chown -R 1000:1000 "$FRESH_CLONE"
fi
fi
-docker run -it \
+docker run $DOCKER_RUN_FLAGS \
--name electrum-appimage-builder-cont \
-v "$PROJECT_ROOT_OR_FRESHCLONE_ROOT":/opt/electrum \
--rm \
diff --git a/contrib/build-linux/sdist/build.sh b/contrib/build-linux/sdist/build.sh
index 11a7462..aa68e08 100755
--- a/contrib/build-linux/sdist/build.sh
+++ b/contrib/build-linux/sdist/build.sh
@@ -46,6 +46,12 @@ else
info "not doing fresh clone."
fi
+DOCKER_RUN_FLAGS=""
+if sh -c ": >/dev/tty" >/dev/null 2>/dev/null; then
+ info "/dev/tty is available and usable"
+ DOCKER_RUN_FLAGS="-it"
+fi
+
info "building binary..."
# check uid and maybe chown. see #8261
if [ ! -z "$ELECBUILD_COMMIT" ] ; then # fresh clone (reproducible build)
@@ -54,7 +60,7 @@ if [ ! -z "$ELECBUILD_COMMIT" ] ; then # fresh clone (reproducible build)
sudo chown -R 1000:1000 "$FRESH_CLONE"
fi
fi
-docker run -it \
+docker run $DOCKER_RUN_FLAGS \
--name electrum-sdist-builder-cont \
-v "$PROJECT_ROOT_OR_FRESHCLONE_ROOT":/opt/electrum \
--rm \
diff --git a/contrib/build-wine/build.sh b/contrib/build-wine/build.sh
index f3bc4e6..c10e875 100755
--- a/contrib/build-wine/build.sh
+++ b/contrib/build-wine/build.sh
@@ -48,6 +48,12 @@ else
info "not doing fresh clone."
fi
+DOCKER_RUN_FLAGS=""
+if sh -c ": >/dev/tty" >/dev/null 2>/dev/null; then
+ info "/dev/tty is available and usable"
+ DOCKER_RUN_FLAGS="-it"
+fi
+
info "building binary..."
# check uid and maybe chown. see #8261
if [ ! -z "$ELECBUILD_COMMIT" ] ; then # fresh clone (reproducible build)
@@ -56,7 +62,7 @@ if [ ! -z "$ELECBUILD_COMMIT" ] ; then # fresh clone (reproducible build)
sudo chown -R 1000:1000 "$FRESH_CLONE"
fi
fi
-docker run -it \
+docker run $DOCKER_RUN_FLAGS \
--name electrum-wine-builder-cont \
-v "$PROJECT_ROOT_OR_FRESHCLONE_ROOT":/opt/wine64/drive_c/electrum \
--rm \
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.