diff options
| author | mtg0001 <106211915+mtg0001@users.noreply.github.com> | 2026-08-04 15:25:34 -0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-08-04 15:25:34 -0300 |
| commit | 5ac1fd55eea9d4b5e9b34be50d3b684693e3a935 (patch) | |
| tree | 8fc77afc1d3a7f237763b4e249fe95d21ae86184 /docs | |
| parent | 7aaaa7a684e33591125963df1eb4da6da2fa6495 (diff) | |
build: pin external source dependencies (#139)
Co-authored-by: Gilcimar Duarte <ti@gpm.infra>
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/dependencies.md | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/docs/dependencies.md b/docs/dependencies.md new file mode 100644 index 0000000..9fd45b6 --- /dev/null +++ b/docs/dependencies.md | |||
| @@ -0,0 +1,18 @@ | |||
| 1 | # Build Dependencies | ||
| 2 | |||
| 3 | Bitflash links consensus-adjacent cryptographic and proof-of-work code from | ||
| 4 | external repositories. Fresh builds must not follow upstream `master` silently: | ||
| 5 | a changed upstream branch can break reproducible builds or change behavior in | ||
| 6 | code that every node relies on. | ||
| 7 | |||
| 8 | The top-level `Makefile` pins source dependencies by full commit hash: | ||
| 9 | |||
| 10 | | dependency | repository | pinned commit | | ||
| 11 | |---|---|---| | ||
| 12 | | libsecp256k1 | https://github.com/bitcoin-core/secp256k1 | `7fecac74aed8e1fd9078380d67dd04663705c989` | | ||
| 13 | | RandomX | https://github.com/tevador/RandomX | `1e9d4b2df63fa6edf46b06789486e23c0fcaa55a` | | ||
| 14 | |||
| 15 | When updating either dependency, rebuild from a clean dependency directory and | ||
| 16 | run the full selftest suite before opening the PR. The PR should explain why the | ||
| 17 | dependency changed and whether the update can affect consensus, addresses, | ||
| 18 | signatures, proof-of-work validation, or mining. | ||