1 files changed, 42 insertions, 13 deletions

diff --git a/Makefile b/Makefile
index abd75c5..0f29081 100644
--- a/Makefile
+++ b/Makefile
@@ -10,7 +10,7 @@
 ROOT    := $(shell pwd)
 NPROC   := $(shell nproc 2>/dev/null || echo 2)
 SUDO    := $(shell [ "$$(id -u)" = "0" ] && echo "" || echo "sudo")
-VERSION := 1.2.15
+VERSION := 1.2.18
 
 # ---- Pinned third-party sources -------------------------------------------
 #
@@ -34,9 +34,16 @@ VERSION := 1.2.15
 # resync before shipping the result.
 #
 # RandomX pin is the commit this tree has been building and syncing against
-# (post-v2.0.1 master, 2026-05-24) -- chosen to change nothing today.
+# (post-v2.0.1 master, 2026-05-24) -- identical to upstream's pin.
+#
+# libsecp256k1 is pinned to upstream v1.2.18's commit rather than the one this
+# fork carried, so signature validation matches the binaries the rest of the
+# network runs. Consensus code must not differ from the network by accident.
+# There must be exactly ONE assignment of each of these variables in this file:
+# upstream defines them near the top too, and GNU Make takes the last `:=`, so
+# a second block silently decides the build.
 SECP256K1_REPO   := https://github.com/bitcoin-core/secp256k1
-SECP256K1_COMMIT := 6e2c8bc4ecdc6e71dbe7a368f360d8d453ce435d
+SECP256K1_COMMIT := 7fecac74aed8e1fd9078380d67dd04663705c989
 RANDOMX_REPO     := https://github.com/tevador/RandomX
 RANDOMX_COMMIT   := 1e9d4b2df63fa6edf46b06789486e23c0fcaa55a
 
@@ -71,7 +78,7 @@ deps-apt:
         @if command -v apt-get >/dev/null 2>&1; then \
           $(SUDO) apt-get install -y build-essential cmake git pkg-config autoconf \
             libtool libssl-dev libdb5.3++-dev libsodium-dev nlohmann-json3-dev \
-            libboost-system-dev libglfw3-dev libgl-dev python3-pil; \
+            libboost-system-dev libglfw3-dev libgl-dev python3-pil clang; \
         else \
           echo "Not an apt system — install: g++ cmake git autoconf libtool"; \
           echo "  libssl libdb++ libsodium nlohmann-json boost glfw3 opengl python3-pil"; \
@@ -85,8 +92,10 @@ deps-secp256k1:
           cd $(ROOT)/secp256k1-build && \
           git remote add origin $(SECP256K1_REPO) && \
           git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
-          git checkout -q $(SECP256K1_COMMIT) && \
-          ./autogen.sh && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(SECP256K1_COMMIT)" && \
+          echo "==> libsecp256k1 pinned at $(SECP256K1_COMMIT)" && \
+          cd $(ROOT)/secp256k1-build && ./autogen.sh && \
           ./configure --enable-module-schnorrsig --enable-module-extrakeys \
             --disable-shared --with-pic --disable-benchmark --disable-tests && \
           make -j$(NPROC) && $(SUDO) make install && $(SUDO) ldconfig; \
@@ -103,7 +112,9 @@ deps-randomx:
           cd $(HOME)/RandomX && \
           git remote add origin $(RANDOMX_REPO) && \
           git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
-          git checkout -q $(RANDOMX_COMMIT); \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
+          echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
           mkdir -p $(HOME)/RandomX/build; \
           cd $(HOME)/RandomX/build && cmake .. -DCMAKE_BUILD_TYPE=Release && \
           make -j$(NPROC) randomx; \
@@ -182,8 +193,14 @@ deps-windows:
           autoconf automake libtool
         @if [ ! -f deps/lib/libsecp256k1.a ]; then \
           rm -rf secp256k1-build; \
-          git clone --depth 1 https://github.com/bitcoin-core/secp256k1 secp256k1-build; \
-          cd secp256k1-build && ./autogen.sh && \
+          git init -q secp256k1-build; \
+          cd secp256k1-build && \
+          git remote add origin $(SECP256K1_REPO) && \
+          git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(SECP256K1_COMMIT)" && \
+          echo "==> secp256k1 pinned at $(SECP256K1_COMMIT)" && \
+          cd $(ROOT)/secp256k1-build && ./autogen.sh && \
           ./configure --prefix=$(ROOT)/deps \
             --enable-module-schnorrsig --enable-module-extrakeys \
             --disable-shared --with-pic --disable-benchmark --disable-tests && \
@@ -194,9 +211,15 @@ deps-windows:
         fi
         @if [ ! -f RandomX/build/librandomx.a ]; then \
           rm -rf RandomX; \
-          git clone --depth 1 https://github.com/tevador/RandomX; \
-          mkdir -p RandomX/build; \
-          cd RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
+          git init -q RandomX; \
+          cd RandomX && \
+          git remote add origin $(RANDOMX_REPO) && \
+          git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
+          echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
+          mkdir -p $(ROOT)/RandomX/build; \
+          cd $(ROOT)/RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
           make randomx; \
           echo "==> RandomX done"; \
         else \
@@ -224,6 +247,12 @@ clean:
 tests:
         $(MAKE) -C src -f Makefile tests
 
+fuzz-net-message-smoke: deps-linux
+        $(MAKE) -C src -f Makefile fuzz-net-message-smoke
+
+fuzz-script-smoke: deps-linux
+        $(MAKE) -C src -f Makefile fuzz-script-smoke
+
 checksums:
         ./scripts/make-release-checksums.sh
 
@@ -234,5 +263,5 @@ verify-release:
         ./scripts/verify-release.sh $(if $(TAG),$(TAG),latest)
 
 .PHONY: linux windows clean appimage \
-        tests checksums sign-checksums verify-release \
+        tests fuzz-net-message-smoke fuzz-script-smoke checksums sign-checksums verify-release \
         deps-linux deps-windows deps-apt deps-secp256k1 deps-randomx