What changed, and why it matters
This change updates the project's automated testing setup. It adds a second compiler ('clang-snapshot', a preview version of the next Clang release) to the MemorySanitizer (MSan) CI job and installs an extra compiler support package needed by that snapshot compiler. There is no change to the cryptographic library code itself, no bug fix, and no security patch.
No security action needed. Treat as a normal infrastructure/testing improvement.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies CI configuration only. In .github/workflows/ci.yml it turns the single ‘clang’ MSan job into a matrix that runs both ‘clang’ and ‘clang-snapshot’. In ci/linux-debian.Dockerfile it installs libclang-rt-${LLVM_VERSION}-dev alongside the existing clang-${LLVM_VERSION} package so the snapshot toolchain has the required runtime libraries. No source code in the secp256k1 library is touched.
Changed components
.github/workflows/ci.ymlci/linux-debian.DockerfileInspect captured patch +5 / −2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f22ef2a..ad3568d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -417,6 +417,9 @@ jobs:
# when ctime_tests when enabled.
CFLAGS: '-fsanitize=memory -fsanitize-recover=memory -fsanitize-memory-param-retval -g'
CTIMETESTS: 'no'
+ cc:
+ - 'clang'
+ - 'clang-snapshot'
env:
ECDH: 'yes'
@@ -425,7 +428,7 @@ jobs:
SCHNORRSIG: 'yes'
MUSIG: 'yes'
ELLSWIFT: 'yes'
- CC: 'clang'
+ CC: ${{ matrix.cc }}
SECP256K1_TEST_ITERS: 32
ASM: 'no'
WITH_VALGRIND: 'no'
diff --git a/ci/linux-debian.Dockerfile b/ci/linux-debian.Dockerfile
index 22b6d35..a575d9b 100644
--- a/ci/linux-debian.Dockerfile
+++ b/ci/linux-debian.Dockerfile
@@ -71,7 +71,7 @@ RUN \
# Determine the version number of the LLVM development branch
LLVM_VERSION=$(apt-cache search --names-only '^clang-[0-9]+$' | sort -V | tail -1 | cut -f1 -d" " | cut -f2 -d"-" ) && \
# Install
- DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y "clang-${LLVM_VERSION}" && \
+ DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y "clang-${LLVM_VERSION}" "libclang-rt-${LLVM_VERSION}-dev" && \
# Create symlink
ln -s "/usr/bin/clang-${LLVM_VERSION}" /usr/bin/clang-snapshot && \
# Clean up
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.