Audit report AR-41
Reported privately in an independent security review, 2026-09-20.
- Report date
- 2026-09-20
- Kind
- Docs
- Status on master
- Present
- Proposed issue state
- Open
Summary
doc/multiprocess.md tells readers to set HOST_PLATFORM from gcc -dumpmachine or clang -dumpmachine, but depends names its output directory from depends/config.guess, and the two differ on common Linux hosts. Following the suggestion points CMake at a toolchain file that does not exist. The report is correct. Doc fix, mergeable.
The report
The multiprocess build guide's depends quickstart says:
# Set host platform to output of gcc -dumpmachine or clang -dumpmachine or check the depends/ directory for the generated subdirectory name
HOST_PLATFORM="x86_64-pc-linux-gnu"
cmake -B build --toolchain=depends/$HOST_PLATFORM/toolchain.cmake
The depends build names its host directory from depends/config.guess, not from the compiler's machine tuple. On the Linux host the report measured, config.guess gives x86_64-pc-linux-gnu while gcc -dumpmachine gives x86_64-linux-gnu, so following the compiler suggestion makes configuration fail on a missing toolchain file, even though the example value on the next line is correct.
The report limits the impact to local build guidance: a developer following the instructions has to inspect the generated directory or find the right tuple another way. No binaries, IPC behaviour or node behaviour change.
Proposed change
Point readers at depends/config.guess and keep the fallback of checking the generated directory:
-# Set host platform to output of gcc -dumpmachine or clang -dumpmachine or check the depends/ directory for the generated subdirectory name
+# Set host platform to the output of depends/config.guess or check the depends/ directory for the generated subdirectory name
Assessment
Present on Bitcoin Core master (line 24). The fix is correct. Documentation only; outside the survey's stability scope.
Status
Present on master. Next step: a one-line Bitcoin Core doc PR. No public PR yet.
Reported privately in an independent security review on 2026-09-20.