CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 41 Bitcoin

contrib: "set -e" behaves weird in subshells followed by OR. don't use.

ELffba6061 View source ↗
Public commit record

What the developer wrote

Authored by SomberNight

93/100 · Strong
contrib: "set -e" behaves weird in subshells followed by OR. don't use.

This exits as expected:
```
$ cat s1.sh
#!/bin/bash
set -e
(
echo "a"
false
echo "b"
)

$ ./s1.sh
a
```
This does NOT exit, seemingly because of the outer context?!
```
$ cat s2.sh
#!/bin/bash
set -e
(
echo "a"
false
echo "b"
) || echo "c"

$ ./s2.sh
a
b
```

ref https://unix.stackexchange.com/questions/65532/why-does-set-e-not-work-inside-subshells-with-parenthesis-followed-by-an-or
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit fixes a subtle shell-script bug in Electrum's build scripts. Because of how Bash handles 'set -e' inside subshells followed by '||', errors inside those build steps were silently ignored instead of stopping the build. That could let a broken or incomplete build continue, potentially producing a bad release binary. The fix removes the '|| fail' wrappers so the scripts now correctly abort on failure.

Recommended action

Review build logs from recent releases to confirm no prior silently-failed build steps produced artifacts. Ensure CI captures non-zero exits from these scripts. Consider adding explicit error checks or 'set -euo pipefail' consistently across build scripts. No runtime user action is required.

Security signals we found

01

Build-pipeline failure-handling defect

02

Silent ignore of build errors could lead to incomplete or tampered release artifacts

03

Supply-chain integrity risk if broken binaries are packaged and distributed

04

No direct code injection or memory corruption vulnerability

Risk score

Why this scored 41/100

Our methodology →
Potential impact 12/30
Exploitability 5/25
Stealth signal 8/15
Affected reach 6/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from Electrum

Related watches

Informational 15 AI analysisMessage 63 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10816 from accumulator/qml_auth_log_improvement

This commit is a minor logging cleanup in the mobile/QML authentication helper. It changes the wording and placement of debug/error log messages so they reveal the function name only after safely retrieving it, and avoids logging a raw tup…

8dddae68by ghost43+4−41 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 51 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10798 from SomberNight/202608_base43

This commit fixes a performance weakness in Electrum's handling of large Bitcoin transactions encoded in 'base43'. The base43 encoding and decoding functions run in quadratic time, meaning the work grows much faster than the input size. An…

Quadratic-time base43 encode/decode can be triggered on attacker-controlled inputDenial-of-service via CPU exhaustion / UI freeze on large transaction stringsInput-length cap added as a defensive guard, not a full algorithmic fix
0e9f1a0dby Felix+25−92 files
No security note in commit
Open full analysis →Source commit ↗
Low 41 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10799 from SomberNight/202608_android_secure_window

This update tightens a privacy feature on Electrum's Android app that prevents the screen from being captured while sensitive Bitcoin private keys or seed phrases are visible. Before, the protection could be accidentally turned off when mu…

Adds visibility-gated secureWindow bindings to protect WIF keys and seed phrasesPrevents secureWindow from being cleared when multiple sensitive dialogs are stackedTargets Android screenshot/recents-thumbnail protection surface
4622390cby accumulator+17−05 files
Vendor flagged security relevance
Open full analysis →Source commit ↗