From 9886a4680cd669f376eec1bf18da7ad10057dd38 Mon Sep 17 00:00:00 2001 From: bitflash-maintainer Date: Wed, 2 Sep 2026 16:58:44 +0000 Subject: build: let a failed pin check decide the exit status everywhere fd627b1's message said the rewrite hardened a pin check that used `;` where it needed `&&`. It hardened one of four. Three recipes still ended their chain with `echo "==> ... done"; ` after a semicolon, so a mismatched pin failed the `test`, skipped every build step, and then ran the echo anyway -- exit 0, and make announced a pinned dependency that nothing had verified. deps-windows also had the same break after mkdir and after `make randomx`. The one the earlier message did not mention is deps-secp256k1, on the Linux path: libsecp256k1 is signature verification, so that was the worst of the three to leave reporting success on an unverified checkout. Joined each chain with && the whole way to the closing echo, in deps-secp256k1, and in both halves of deps-windows. Verified by extracting each recipe as make expands it, splitting it into logical recipe lines and running each in its own shell the way make does, with git reporting a sha that does not match the pin: all three previously exited 0 and now exit 1, and each deps-windows half fails independently rather than relying on the other. With a matching sha the recipes still exit 0, still print "done", and still write the marker. The Windows path was not executed -- there is no MSYS2 here -- so pacman was shimmed and only the shell logic below it was measured. --- Makefile | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/Makefile b/Makefile index c891001..c5cf31c 100644 --- a/Makefile +++ b/Makefile @@ -37,6 +37,12 @@ VERSION := 1.2.19+sec # resolves the object by its own hash). Bump deliberately, and rebuild and # resync before shipping the result. # +# The check has to decide the exit status, so each recipe below joins its +# commands with && the whole way to the closing echo. Ending that chain with a +# `;` meant a failed `test` only skipped the build steps: the echo still ran, +# the target still exited 0, and make announced a pinned dependency that +# nothing had verified. +# # RandomX pin is the commit this tree has been building and syncing against # (post-v2.0.1 master, 2026-05-24) -- identical to upstream's pin. # @@ -123,8 +129,8 @@ deps-apt: deps-secp256k1: @if [ ! -f /usr/local/lib/libsecp256k1.a ]; then \ echo "==> building libsecp256k1"; \ - rm -rf $(ROOT)/secp256k1-build; \ - git init -q $(ROOT)/secp256k1-build; \ + rm -rf $(ROOT)/secp256k1-build && \ + git init -q $(ROOT)/secp256k1-build && \ cd $(ROOT)/secp256k1-build && \ git remote add origin $(SECP256K1_REPO) && \ git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \ @@ -134,7 +140,7 @@ deps-secp256k1: cd $(ROOT)/secp256k1-build && ./autogen.sh && \ ./configure --enable-module-schnorrsig --enable-module-extrakeys \ --disable-shared --with-pic --disable-benchmark --disable-tests && \ - make -j$(NPROC) && $(SUDO) make install && $(SUDO) ldconfig; \ + make -j$(NPROC) && $(SUDO) make install && $(SUDO) ldconfig && \ echo "==> libsecp256k1 done"; \ else \ echo "==> libsecp256k1 already installed"; \ @@ -252,8 +258,8 @@ deps-windows: mingw-w64-ucrt-x86_64-cmake \ autoconf automake libtool @if [ ! -f deps/lib/libsecp256k1.a ]; then \ - rm -rf secp256k1-build; \ - git init -q secp256k1-build; \ + rm -rf secp256k1-build && \ + git init -q secp256k1-build && \ cd secp256k1-build && \ git remote add origin $(SECP256K1_REPO) && \ git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \ @@ -264,23 +270,23 @@ deps-windows: ./configure --prefix=$(ROOT)/deps \ --enable-module-schnorrsig --enable-module-extrakeys \ --disable-shared --with-pic --disable-benchmark --disable-tests && \ - make install; \ + make install && \ echo "==> secp256k1 done"; \ else \ echo "==> secp256k1 already built"; \ fi @if [ ! -f RandomX/build/librandomx.a ]; then \ - rm -rf RandomX; \ - git init -q RandomX; \ + rm -rf RandomX && \ + git init -q RandomX && \ cd RandomX && \ git remote add origin $(RANDOMX_REPO) && \ git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \ git checkout -q --detach FETCH_HEAD && \ test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \ echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \ - mkdir -p $(ROOT)/RandomX/build; \ + mkdir -p $(ROOT)/RandomX/build && \ cd $(ROOT)/RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \ - make randomx; \ + make randomx && \ echo "==> RandomX done"; \ else \ echo "==> RandomX already built"; \ -- cgit v1.2.3