build: pin external source dependencies (#139)

Co-authored-by: Gilcimar Duarte <ti@gpm.infra>

2 files changed, 54 insertions, 7 deletions

diff --git a/Makefile b/Makefile
index ea720f1..0788b61 100644
--- a/Makefile
+++ b/Makefile
@@ -12,6 +12,11 @@ NPROC   := $(shell nproc 2>/dev/null || echo 2)
 SUDO    := $(shell [ "$$(id -u)" = "0" ] && echo "" || echo "sudo")
 VERSION := 1.2.15
 
+SECP256K1_REPO   := https://github.com/bitcoin-core/secp256k1
+SECP256K1_COMMIT := 7fecac74aed8e1fd9078380d67dd04663705c989
+RANDOMX_REPO     := https://github.com/tevador/RandomX
+RANDOMX_COMMIT   := 1e9d4b2df63fa6edf46b06789486e23c0fcaa55a
+
 # ---- Linux ----------------------------------------------------------------
 
 linux: deps-linux
@@ -47,7 +52,13 @@ deps-secp256k1:
         @if [ ! -f /usr/local/lib/libsecp256k1.a ]; then \
           echo "==> building libsecp256k1"; \
           rm -rf $(ROOT)/secp256k1-build; \
-          git clone --depth 1 https://github.com/bitcoin-core/secp256k1 $(ROOT)/secp256k1-build; \
+          git init -q $(ROOT)/secp256k1-build; \
+          cd $(ROOT)/secp256k1-build && \
+          git remote add origin $(SECP256K1_REPO) && \
+          git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(SECP256K1_COMMIT)" && \
+          echo "==> libsecp256k1 pinned at $(SECP256K1_COMMIT)" && \
           cd $(ROOT)/secp256k1-build && ./autogen.sh && \
           ./configure --enable-module-schnorrsig --enable-module-extrakeys \
             --disable-shared --with-pic --disable-benchmark --disable-tests && \
@@ -61,7 +72,13 @@ deps-randomx:
         @if [ ! -f $(HOME)/RandomX/build/librandomx.a ]; then \
           echo "==> building RandomX"; \
           rm -rf $(HOME)/RandomX; \
-          git clone --depth 1 https://github.com/tevador/RandomX $(HOME)/RandomX; \
+          git init -q $(HOME)/RandomX; \
+          cd $(HOME)/RandomX && \
+          git remote add origin $(RANDOMX_REPO) && \
+          git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
+          echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
           mkdir -p $(HOME)/RandomX/build; \
           cd $(HOME)/RandomX/build && cmake .. -DCMAKE_BUILD_TYPE=Release && \
           make -j$(NPROC) randomx; \
@@ -120,8 +137,14 @@ deps-windows:
           autoconf automake libtool
         @if [ ! -f deps/lib/libsecp256k1.a ]; then \
           rm -rf secp256k1-build; \
-          git clone --depth 1 https://github.com/bitcoin-core/secp256k1 secp256k1-build; \
-          cd secp256k1-build && ./autogen.sh && \
+          git init -q secp256k1-build; \
+          cd secp256k1-build && \
+          git remote add origin $(SECP256K1_REPO) && \
+          git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(SECP256K1_COMMIT)" && \
+          echo "==> secp256k1 pinned at $(SECP256K1_COMMIT)" && \
+          cd $(ROOT)/secp256k1-build && ./autogen.sh && \
           ./configure --prefix=$(ROOT)/deps \
             --enable-module-schnorrsig --enable-module-extrakeys \
             --disable-shared --with-pic --disable-benchmark --disable-tests && \
@@ -132,9 +155,15 @@ deps-windows:
         fi
         @if [ ! -f RandomX/build/librandomx.a ]; then \
           rm -rf RandomX; \
-          git clone --depth 1 https://github.com/tevador/RandomX; \
-          mkdir -p RandomX/build; \
-          cd RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
+          git init -q RandomX; \
+          cd RandomX && \
+          git remote add origin $(RANDOMX_REPO) && \
+          git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
+          echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
+          mkdir -p $(ROOT)/RandomX/build; \
+          cd $(ROOT)/RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
           make randomx; \
           echo "==> RandomX done"; \
         else \
diff --git a/docs/dependencies.md b/docs/dependencies.md
new file mode 100644
index 0000000..9fd45b6
--- /dev/null
+++ b/docs/dependencies.md
@@ -0,0 +1,18 @@
+# Build Dependencies
+
+Bitflash links consensus-adjacent cryptographic and proof-of-work code from
+external repositories. Fresh builds must not follow upstream `master` silently:
+a changed upstream branch can break reproducible builds or change behavior in
+code that every node relies on.
+
+The top-level `Makefile` pins source dependencies by full commit hash:
+
+| dependency | repository | pinned commit |
+|---|---|---|
+| libsecp256k1 | https://github.com/bitcoin-core/secp256k1 | `7fecac74aed8e1fd9078380d67dd04663705c989` |
+| RandomX | https://github.com/tevador/RandomX | `1e9d4b2df63fa6edf46b06789486e23c0fcaa55a` |
+
+When updating either dependency, rebuild from a clean dependency directory and
+run the full selftest suite before opening the PR. The PR should explain why the
+dependency changed and whether the update can affect consensus, addresses,
+signatures, proof-of-work validation, or mining.