What the developer wrote
Authored by Tads
fix: build process (#823)
What changed, and why it matters
This commit changes how a build container downloads a third-party compiler toolchain. The old command tried to clone submodules in one step from the original binutils-gdb repository, which appears to be unavailable or moved. The new approach clones the main repository first, then redirects the submodule URL to an archived copy before initializing submodules. This is a build-fix change, not an obvious security patch, but it does alter which source code is pulled into the build environment.
Verify that riscvarchive/riscv-binutils-gdb.git is the legitimate, vendor-blessed replacement for the original submodule. Pin the submodule to a specific commit hash or tag, verify checksums of built toolchain artifacts, and monitor the upstream Kendryte repository for an official fix so the local URL override can be removed.
Security signals we found
Build dependency source URL changed from github.com/bminor/binutils-gdb.git to github.com/riscvarchive/riscv-binutils-gdb.git
GIT_TERMINAL_PROMPT=0 added to prevent git from interactively prompting for credentials
Submodule initialization moved from clone-time to a separate explicit step
No cryptographic verification (hash pinning, signature checking) of the substituted dependency is visible in the diff
Evidence from the diff
The Dockerfile for Krux’s build environment previously cloned kendryte/kendryte-gnu-toolchain with –recurse-submodules –shallow-submodules. The patch removes –recurse-submodules/–shallow-submodules, sets GIT_TERMINAL_PROMPT=0 to prevent interactive prompts, and adds a separate RUN step that rewrites the .gitmodules URL for the binutils-gdb submodule from bminor/binutils-gdb.git to riscvarchive/riscv-binutils-gdb.git, then syncs and initializes submodules. This suggests the original submodule URL no longer resolves or is no longer reachable, breaking reproducible builds.
Changed components
Dockerfile build environmentkendryte-gnu-toolchain dependencybinutils-gdb submoduleInspect captured patch +10 / −1
diff --git a/Dockerfile b/Dockerfile
index 6785b16..b361be1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -59,7 +59,16 @@ RUN apt-get update -y && \
python3-setuptools
RUN mkdir -p /opt && \
- git clone --depth 1 --recurse-submodules --shallow-submodules --branch v8.2.0-20190409 https://github.com/kendryte/kendryte-gnu-toolchain
+ GIT_TERMINAL_PROMPT=0 \
+ git clone --depth 1 --branch v8.2.0-20190409 https://github.com/kendryte/kendryte-gnu-toolchain
+
+RUN cd kendryte-gnu-toolchain && \
+ sed -i 's|https://github.com/bminor/binutils-gdb.git|https://github.com/riscvarchive/riscv-binutils-gdb.git|' .gitmodules && \
+ git submodule sync && \
+ git submodule update \
+ --init \
+ --recursive \
+ --depth 1
RUN cd kendryte-gnu-toolchain && \
export PATH=$PATH:/opt/kendryte-toolchain/bin && \
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.