contrib: add "set -e" to bash scripts where missing
What the developer wrote
Authored by SomberNight
contrib: add "set -e" to bash scripts where missing
What changed, and why it matters
This commit adds 'set -e' to four helper shell scripts used during Electrum's build and release process. 'set -e' makes a bash script stop immediately if any command fails, rather than continuing with potentially broken or incomplete results. This is a hardening improvement for the build pipeline, not a fix for an active security flaw in the wallet software itself. It reduces the risk that a failed build step goes unnoticed and produces a bad release artifact.
No urgent action required. Treat as routine build-quality hardening. Reviewers may verify that each script still handles expected error cases correctly under 'set -e' and that no intentional non-zero exits are broken by the change.
Security signals we found
Defensive build-hardening change
Adds fail-fast behavior to release scripts
No direct vulnerability or exploit mechanism visible in diff
No changes to wallet, networking, or cryptographic code
Evidence from the diff
The patch inserts ‘set -e’ (errexit) into contrib/build-wine/sign.sh, contrib/build_tools_util.sh, contrib/generate_payreqpb2.sh, and contrib/osx/notarize_app.sh. These scripts handle code-signing, build-tool setup, protobuf generation, and macOS notarization. Without errexit, a failed command could leave the release process in an inconsistent state or create artifacts that appear valid but are incomplete. The change is defensive: it ensures build failures are surfaced early rather than silently ignored.
Changed components
contrib/build-wine/sign.shcontrib/build_tools_util.shcontrib/generate_payreqpb2.shcontrib/osx/notarize_app.shInspect captured patch +7 / −0
diff --git a/contrib/build-wine/sign.sh b/contrib/build-wine/sign.sh
index ceeac8b..51cc244 100755
--- a/contrib/build-wine/sign.sh
+++ b/contrib/build-wine/sign.sh
@@ -1,5 +1,7 @@
#!/bin/bash
+set -e
+
here=$(dirname "$0")
if [ -z "$WIN_SIGNING_PASSWORD" ]; then
echo "password missing"
diff --git a/contrib/build_tools_util.sh b/contrib/build_tools_util.sh
index aab00ef..3bc5004 100755
--- a/contrib/build_tools_util.sh
+++ b/contrib/build_tools_util.sh
@@ -1,5 +1,7 @@
#!/usr/bin/env bash
+set -e
+
# Set a fixed umask as this leaks into docker containers
umask 0022
diff --git a/contrib/generate_payreqpb2.sh b/contrib/generate_payreqpb2.sh
index 87addbb..959b24c 100755
--- a/contrib/generate_payreqpb2.sh
+++ b/contrib/generate_payreqpb2.sh
@@ -1,6 +1,8 @@
#!/bin/bash
# Generates the file paymentrequest_pb2.py
+set -e
+
CONTRIB="$(dirname "$(readlink -e "$0")")"
EL="$CONTRIB"/../electrum
diff --git a/contrib/osx/notarize_app.sh b/contrib/osx/notarize_app.sh
index 7a3f44b..7e18c95 100755
--- a/contrib/osx/notarize_app.sh
+++ b/contrib/osx/notarize_app.sh
@@ -1,6 +1,7 @@
#!/usr/bin/env bash
# from https://github.com/metabrainz/picard/blob/e1354632d2db305b7a7624282701d34d73afa225/scripts/package/macos-notarize-app.sh
+set -e
if [ -z "$1" ]; then
echo "Specify app bundle as first parameter"
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.