From 5ac1fd55eea9d4b5e9b34be50d3b684693e3a935 Mon Sep 17 00:00:00 2001
From: mtg0001 <106211915+mtg0001@users.noreply.github.com>
Date: Tue, 4 Aug 2026 15:25:34 -0300
Subject: build: pin external source dependencies (#139)

Co-authored-by: Gilcimar Duarte <ti@gpm.infra>
---
 Makefile             | 43 ++++++++++++++++++++++++++++++++++++-------
 docs/dependencies.md | 18 ++++++++++++++++++
 2 files changed, 54 insertions(+), 7 deletions(-)
 create mode 100644 docs/dependencies.md

diff --git a/Makefile b/Makefile
index ea720f1..0788b61 100644
--- a/Makefile
+++ b/Makefile
@@ -12,6 +12,11 @@ NPROC   := $(shell nproc 2>/dev/null || echo 2)
 SUDO    := $(shell [ "$$(id -u)" = "0" ] && echo "" || echo "sudo")
 VERSION := 1.2.15
 
+SECP256K1_REPO   := https://github.com/bitcoin-core/secp256k1
+SECP256K1_COMMIT := 7fecac74aed8e1fd9078380d67dd04663705c989
+RANDOMX_REPO     := https://github.com/tevador/RandomX
+RANDOMX_COMMIT   := 1e9d4b2df63fa6edf46b06789486e23c0fcaa55a
+
 # ---- Linux ----------------------------------------------------------------
 
 linux: deps-linux
@@ -47,7 +52,13 @@ deps-secp256k1:
 	@if [ ! -f /usr/local/lib/libsecp256k1.a ]; then \
 	  echo "==> building libsecp256k1"; \
 	  rm -rf $(ROOT)/secp256k1-build; \
-	  git clone --depth 1 https://github.com/bitcoin-core/secp256k1 $(ROOT)/secp256k1-build; \
+	  git init -q $(ROOT)/secp256k1-build; \
+	  cd $(ROOT)/secp256k1-build && \
+	  git remote add origin $(SECP256K1_REPO) && \
+	  git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
+	  git checkout -q --detach FETCH_HEAD && \
+	  test "$$(git rev-parse HEAD)" = "$(SECP256K1_COMMIT)" && \
+	  echo "==> libsecp256k1 pinned at $(SECP256K1_COMMIT)" && \
 	  cd $(ROOT)/secp256k1-build && ./autogen.sh && \
 	  ./configure --enable-module-schnorrsig --enable-module-extrakeys \
 	    --disable-shared --with-pic --disable-benchmark --disable-tests && \
@@ -61,7 +72,13 @@ deps-randomx:
 	@if [ ! -f $(HOME)/RandomX/build/librandomx.a ]; then \
 	  echo "==> building RandomX"; \
 	  rm -rf $(HOME)/RandomX; \
-	  git clone --depth 1 https://github.com/tevador/RandomX $(HOME)/RandomX; \
+	  git init -q $(HOME)/RandomX; \
+	  cd $(HOME)/RandomX && \
+	  git remote add origin $(RANDOMX_REPO) && \
+	  git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
+	  git checkout -q --detach FETCH_HEAD && \
+	  test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
+	  echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
 	  mkdir -p $(HOME)/RandomX/build; \
 	  cd $(HOME)/RandomX/build && cmake .. -DCMAKE_BUILD_TYPE=Release && \
 	  make -j$(NPROC) randomx; \
@@ -120,8 +137,14 @@ deps-windows:
 	  autoconf automake libtool
 	@if [ ! -f deps/lib/libsecp256k1.a ]; then \
 	  rm -rf secp256k1-build; \
-	  git clone --depth 1 https://github.com/bitcoin-core/secp256k1 secp256k1-build; \
-	  cd secp256k1-build && ./autogen.sh && \
+	  git init -q secp256k1-build; \
+	  cd secp256k1-build && \
+	  git remote add origin $(SECP256K1_REPO) && \
+	  git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
+	  git checkout -q --detach FETCH_HEAD && \
+	  test "$$(git rev-parse HEAD)" = "$(SECP256K1_COMMIT)" && \
+	  echo "==> secp256k1 pinned at $(SECP256K1_COMMIT)" && \
+	  cd $(ROOT)/secp256k1-build && ./autogen.sh && \
 	  ./configure --prefix=$(ROOT)/deps \
 	    --enable-module-schnorrsig --enable-module-extrakeys \
 	    --disable-shared --with-pic --disable-benchmark --disable-tests && \
@@ -132,9 +155,15 @@ deps-windows:
 	fi
 	@if [ ! -f RandomX/build/librandomx.a ]; then \
 	  rm -rf RandomX; \
-	  git clone --depth 1 https://github.com/tevador/RandomX; \
-	  mkdir -p RandomX/build; \
-	  cd RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
+	  git init -q RandomX; \
+	  cd RandomX && \
+	  git remote add origin $(RANDOMX_REPO) && \
+	  git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
+	  git checkout -q --detach FETCH_HEAD && \
+	  test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
+	  echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
+	  mkdir -p $(ROOT)/RandomX/build; \
+	  cd $(ROOT)/RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
 	  make randomx; \
 	  echo "==> RandomX done"; \
 	else \
diff --git a/docs/dependencies.md b/docs/dependencies.md
new file mode 100644
index 0000000..9fd45b6
--- /dev/null
+++ b/docs/dependencies.md
@@ -0,0 +1,18 @@
+# Build Dependencies
+
+Bitflash links consensus-adjacent cryptographic and proof-of-work code from
+external repositories. Fresh builds must not follow upstream `master` silently:
+a changed upstream branch can break reproducible builds or change behavior in
+code that every node relies on.
+
+The top-level `Makefile` pins source dependencies by full commit hash:
+
+| dependency | repository | pinned commit |
+|---|---|---|
+| libsecp256k1 | https://github.com/bitcoin-core/secp256k1 | `7fecac74aed8e1fd9078380d67dd04663705c989` |
+| RandomX | https://github.com/tevador/RandomX | `1e9d4b2df63fa6edf46b06789486e23c0fcaa55a` |
+
+When updating either dependency, rebuild from a clean dependency directory and
+run the full selftest suite before opening the PR. The PR should explain why the
+dependency changed and whether the update can affect consensus, addresses,
+signatures, proof-of-work validation, or mining.
-- 
cgit v1.2.3