What the developer wrote
Authored by SomberNight
contrib: minor clean-up shell usage
What changed, and why it matters
This commit is a minor shell-script cleanup. It removes an unnecessary 'ls' call in a loop and adds missing double quotes around variables. These are best-practice hygiene changes that prevent filename-word-splitting bugs, but they do not introduce or fix any active security vulnerability in the shipped Electrum wallet software itself.
No security action required; treat as routine build-script maintenance.
Security signals we found
defensive shell quoting hardening
removal of unquoted command substitution in loop
no change to cryptographic or wallet logic
Evidence from the diff
The diff changes two release/build helper scripts. In contrib/build-wine/unsign.sh it replaces ‘for mine in $(ls dist/.exe)’ with ‘for mine in dist/.exe’ and quotes ‘$mine’ inside basename. In contrib/release_www.sh it quotes the signing address, version, and wallet variables passed to run_electrum signmessage. These are defensive quoting fixes; there is no evidence of an exploitable bug, no change to wallet/crypto code, and no vendor security disclosure.
Changed components
contrib/build-wine/unsign.shcontrib/release_www.shInspect captured patch +3 / −3
diff --git a/contrib/build-wine/unsign.sh b/contrib/build-wine/unsign.sh
index 3ec2516..f835467 100755
--- a/contrib/build-wine/unsign.sh
+++ b/contrib/build-wine/unsign.sh
@@ -22,9 +22,9 @@ version=$("$CONTRIB"/print_electrum_version.py)
echo "Found $(ls dist/*.exe | wc -w) files to verify."
-for mine in $(ls dist/*.exe); do
+for mine in dist/*.exe; do
echo "---------------"
- f="$(basename $mine)"
+ f="$(basename "$mine")"
if test -f "signed/$f"; then
echo "Found file at signed/$f"
else
diff --git a/contrib/release_www.sh b/contrib/release_www.sh
index 28c3732..404bb21 100755
--- a/contrib/release_www.sh
+++ b/contrib/release_www.sh
@@ -46,7 +46,7 @@ set -x
info "updating www repo"
./contrib/make_download "$WWW_DIR"
info "signing the version announcement file"
-sig=$(./run_electrum -o signmessage $ELECTRUM_SIGNING_ADDRESS $VERSION -w $ELECTRUM_SIGNING_WALLET)
+sig=$(./run_electrum -o signmessage "$ELECTRUM_SIGNING_ADDRESS" "$VERSION" -w "$ELECTRUM_SIGNING_WALLET")
# note: the contents of "extradata" are currently not signed. We could add another field, extradata_sigs,
# containing signature(s) for "extradata". extradata, being json, would have to be canonically
# serialized before signing.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.