Merge branch 'deploy/all-2026-08-24' into 'deploy/soak-2026-08-21'

deploy: land MRs 1-12 and upstream 1.2.20, as shipped in relay component

See merge request !13

1 files changed, 94 insertions, 23 deletions

diff --git a/Makefile b/Makefile
index 9f97b73..342ec07 100644
--- a/Makefile
+++ b/Makefile
@@ -11,10 +11,10 @@
 ROOT    := $(shell pwd)
 NPROC   := $(shell nproc 2>/dev/null || echo 2)
 SUDO    := $(shell [ "$$(id -u)" = "0" ] && echo "" || echo "sudo")
-# Not "1.2.19". This tree is upstream v1.2.19 plus our own hardening commits and
+# Not "1.2.20". This tree is upstream v1.2.20 plus our own hardening commits and
 # a hand-merged payout ledger, so a binary built here must not be mistakable for
 # the upstream release of that number -- it names every release artifact.
-VERSION := 1.2.19+sec
+VERSION := 1.2.20+sec
 
 # ---- Pinned third-party sources -------------------------------------------
 #
@@ -37,6 +37,12 @@ VERSION := 1.2.19+sec
 # resolves the object by its own hash). Bump deliberately, and rebuild and
 # resync before shipping the result.
 #
+# The check has to decide the exit status, so each recipe below joins its
+# commands with && the whole way to the closing echo. Ending that chain with a
+# `;` meant a failed `test` only skipped the build steps: the echo still ran,
+# the target still exited 0, and make announced a pinned dependency that
+# nothing had verified.
+#
 # RandomX pin is the commit this tree has been building and syncing against
 # (post-v2.0.1 master, 2026-05-24) -- identical to upstream's pin.
 #
@@ -59,6 +65,32 @@ APPIMAGETOOL_SHA256 := ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3c
 
 # ---- Linux ----------------------------------------------------------------
 
+# RandomX used to build in $(HOME)/RandomX, and deps-randomx would rm -rf that
+# path whenever the library was missing -- deleting a tree the build did not
+# create and does not own (issue #27; a hand-managed pinned checkout there is
+# what this machine's miners build against). The default is now in-tree, like
+# secp256k1-build. A host that deliberately keeps RandomX elsewhere can set
+# RANDOMX_DIR=... explicitly; the recipe below will still never delete a
+# directory that lacks the marker file this build writes after a successful
+# build. Exported so src/Makefile's own RANDOMX_DIR ?= picks the same tree.
+#
+# Every use of it below is quoted, and the recipe rejects a value that cannot
+# name exactly one directory before it reaches anything destructive. Unquoted,
+# the marker guard could be stepped around: a value holding a glob that matches
+# two directories made `[ -d $(RANDOMX_DIR) ]` a two-argument test, which dies
+# with "unexpected operator" instead of answering, so the && short-circuited,
+# the guard was skipped, and the rm -rf below ran against every match. A value
+# holding a space or a `&&` broke the outer test the same way and reported
+# "already built". Whitespace and glob characters are refused outright rather
+# than merely quoted, because src/Makefile interpolates this same value into
+# -I$(RANDOMX_DIR)/src and -L$(RANDOMX_DIR)/build unquoted, where neither can
+# survive. A relative value is refused rather than silently made absolute: it
+# would mean two different directories to this Makefile and to src/Makefile,
+# whose cwd is src/, and a command-line assignment reaches the sub-make through
+# MAKEFLAGS, where it outranks anything exported from here.
+RANDOMX_DIR ?= $(ROOT)/randomx-build
+export RANDOMX_DIR
+
 linux: deps-linux
         $(MAKE) -C src -f Makefile -j$(NPROC)
         strip src/bitflash
@@ -78,21 +110,35 @@ linux-node: deps-linux
 
 deps-linux: deps-apt deps-secp256k1 deps-randomx
 
+# libboost-dev, not libboost-system-dev: Boost.System has been header-only
+# since 1.69 and Ubuntu 26.04 (resolute) no longer ships the -system package.
+# This tree only includes two boost headers and links no boost library. The
+# apt-get update comes first: a fresh image's package lists are empty, and
+# install then fails on the first name it cannot find.
+#
+# A failed update is deliberately not fatal: one unreachable repository should
+# not block an install the lists already on disk can satisfy. It does say so,
+# though -- "unable to locate package" several seconds later is otherwise hard
+# to connect back to it. The install is the last command in the branch, so its
+# status is the target's, and that one does abort.
 deps-apt:
         @if command -v apt-get >/dev/null 2>&1; then \
+          $(SUDO) apt-get update || \
+            echo "  warning: apt-get update failed, using the package lists on disk"; \
           $(SUDO) apt-get install -y build-essential cmake git pkg-config autoconf \
             libtool libssl-dev libdb5.3++-dev libsodium-dev nlohmann-json3-dev \
-            libboost-system-dev libglfw3-dev libgl-dev python3-pil clang; \
+            libboost-dev libglfw3-dev libgl-dev libsqlite3-dev \
+            python3-pil clang; \
         else \
           echo "Not an apt system — install: g++ cmake git autoconf libtool"; \
-          echo "  libssl libdb++ libsodium nlohmann-json boost glfw3 opengl python3-pil"; \
+          echo "  libssl libdb++ libsodium nlohmann-json boost glfw3 opengl sqlite3 python3-pil"; \
         fi
 
 deps-secp256k1:
         @if [ ! -f /usr/local/lib/libsecp256k1.a ]; then \
           echo "==> building libsecp256k1"; \
-          rm -rf $(ROOT)/secp256k1-build; \
-          git init -q $(ROOT)/secp256k1-build; \
+          rm -rf $(ROOT)/secp256k1-build && \
+          git init -q $(ROOT)/secp256k1-build && \
           cd $(ROOT)/secp256k1-build && \
           git remote add origin $(SECP256K1_REPO) && \
           git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
@@ -102,26 +148,41 @@ deps-secp256k1:
           cd $(ROOT)/secp256k1-build && ./autogen.sh && \
           ./configure --enable-module-schnorrsig --enable-module-extrakeys \
             --disable-shared --with-pic --disable-benchmark --disable-tests && \
-          make -j$(NPROC) && $(SUDO) make install && $(SUDO) ldconfig; \
+          make -j$(NPROC) && $(SUDO) make install && $(SUDO) ldconfig && \
           echo "==> libsecp256k1 done"; \
         else \
           echo "==> libsecp256k1 already installed"; \
         fi
 
 deps-randomx:
-        @if [ ! -f $(HOME)/RandomX/build/librandomx.a ]; then \
+        @ws="$$(printf ' \t')"; \
+        case "$(RANDOMX_DIR)" in \
+          "")        echo "ERROR: RANDOMX_DIR is empty"; exit 1 ;; \
+          /)         echo "ERROR: RANDOMX_DIR is /, refusing"; exit 1 ;; \
+          *[$$ws]*)  echo "ERROR: RANDOMX_DIR contains whitespace: $(RANDOMX_DIR)"; exit 1 ;; \
+          *[*?[]*)   echo "ERROR: RANDOMX_DIR contains a glob character: $(RANDOMX_DIR)"; exit 1 ;; \
+          /*)        ;; \
+          *)         echo "ERROR: RANDOMX_DIR must be an absolute path: $(RANDOMX_DIR)"; exit 1 ;; \
+        esac
+        @if [ ! -f "$(RANDOMX_DIR)/build/librandomx.a" ]; then \
+          if [ -d "$(RANDOMX_DIR)" ] && [ ! -f "$(RANDOMX_DIR)/.bitflash-built" ]; then \
+            echo "ERROR: $(RANDOMX_DIR) exists but was not created by this build"; \
+            echo "       refusing to rm -rf it -- remove it yourself or set RANDOMX_DIR"; \
+            exit 1; \
+          fi; \
           echo "==> building RandomX"; \
-          rm -rf $(HOME)/RandomX; \
-          git init -q $(HOME)/RandomX; \
-          cd $(HOME)/RandomX && \
+          rm -rf "$(RANDOMX_DIR)" && \
+          git init -q "$(RANDOMX_DIR)" && \
+          cd "$(RANDOMX_DIR)" && \
           git remote add origin $(RANDOMX_REPO) && \
           git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
           git checkout -q --detach FETCH_HEAD && \
           test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
           echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
-          mkdir -p $(HOME)/RandomX/build; \
-          cd $(HOME)/RandomX/build && cmake .. -DCMAKE_BUILD_TYPE=Release && \
-          make -j$(NPROC) randomx; \
+          mkdir -p "$(RANDOMX_DIR)/build" && \
+          cd "$(RANDOMX_DIR)/build" && cmake .. -DCMAKE_BUILD_TYPE=Release && \
+          make -j$(NPROC) randomx && \
+          touch "$(RANDOMX_DIR)/.bitflash-built" && \
           echo "==> RandomX done"; \
         else \
           echo "==> RandomX already built"; \
@@ -172,13 +233,22 @@ img = ico.convert('RGBA'); \
 img.save(d + '/bitflash.png'); \
 import shutil; shutil.copy(d + '/bitflash.png', \
 d + '/usr/share/icons/hicolor/256x256/apps/bitflash.png')"
-        @for lib in libsodium.so.23 libdb_cxx-5.3.so libglfw.so.3; do \
+        @for lib in libsodium.so.23 libdb_cxx-5.3.so libsqlite3.so.0 libglfw.so.3; do \
           path=$$(ldconfig -p | grep " $$lib " | awk '{print $$NF}' | head -1); \
           [ -z "$$path" ] && path=$$(find /usr/lib /lib -name "$$lib" 2>/dev/null | head -1); \
           [ -n "$$path" ] && cp -L "$$path" $(APPDIR)/usr/lib/ && echo "  bundled $$lib" || echo "  missing $$lib"; \
         done
+# appimagetool's output used to be piped through grep ... || true, which
+# discarded its exit status: the target succeeded and announced "Built:"
+# even when no AppImage existed. Run the tool bare so its status decides,
+# then require the artefact to exist, be non-empty, and be newer than the
+# binary it was packaged from before saying so.
         @ARCH=x86_64 $(APPIMAGETOOL) --no-appstream $(APPDIR) \
-          $(ROOT)/Bitflash-$(VERSION)-x86_64.AppImage 2>&1 | grep -E "^Built|^Error" || true
+          $(ROOT)/Bitflash-$(VERSION)-x86_64.AppImage
+        @test -s $(ROOT)/Bitflash-$(VERSION)-x86_64.AppImage || \
+          { echo "ERROR: Bitflash-$(VERSION)-x86_64.AppImage missing or empty"; exit 1; }
+        @test $(ROOT)/Bitflash-$(VERSION)-x86_64.AppImage -nt src/bitflash || \
+          { echo "ERROR: Bitflash-$(VERSION)-x86_64.AppImage is not newer than src/bitflash"; exit 1; }
         @echo "Built: Bitflash-$(VERSION)-x86_64.AppImage"
 
 # ---- Windows (MSYS2 UCRT64) -----------------------------------------------
@@ -190,14 +260,15 @@ deps-windows:
           mingw-w64-ucrt-x86_64-glfw \
           mingw-w64-ucrt-x86_64-openssl \
           mingw-w64-ucrt-x86_64-db \
+          mingw-w64-ucrt-x86_64-sqlite3 \
           mingw-w64-ucrt-x86_64-libsodium \
           mingw-w64-ucrt-x86_64-nlohmann-json \
           mingw-w64-ucrt-x86_64-boost \
           mingw-w64-ucrt-x86_64-cmake \
           autoconf automake libtool
         @if [ ! -f deps/lib/libsecp256k1.a ]; then \
-          rm -rf secp256k1-build; \
-          git init -q secp256k1-build; \
+          rm -rf secp256k1-build && \
+          git init -q secp256k1-build && \
           cd secp256k1-build && \
           git remote add origin $(SECP256K1_REPO) && \
           git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
@@ -208,23 +279,23 @@ deps-windows:
           ./configure --prefix=$(ROOT)/deps \
             --enable-module-schnorrsig --enable-module-extrakeys \
             --disable-shared --with-pic --disable-benchmark --disable-tests && \
-          make install; \
+          make install && \
           echo "==> secp256k1 done"; \
         else \
           echo "==> secp256k1 already built"; \
         fi
         @if [ ! -f RandomX/build/librandomx.a ]; then \
-          rm -rf RandomX; \
-          git init -q RandomX; \
+          rm -rf RandomX && \
+          git init -q RandomX && \
           cd RandomX && \
           git remote add origin $(RANDOMX_REPO) && \
           git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
           git checkout -q --detach FETCH_HEAD && \
           test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
           echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
-          mkdir -p $(ROOT)/RandomX/build; \
+          mkdir -p $(ROOT)/RandomX/build && \
           cd $(ROOT)/RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
-          make randomx; \
+          make randomx && \
           echo "==> RandomX done"; \
         else \
           echo "==> RandomX already built"; \