Fix elfkickers CI race by disabling parallel make#207
Conversation
There was a problem hiding this comment.
Pull request overview
This PR fixes an intermittent build failure in CI for the elfkickers tool by disabling parallel make. The issue stems from race conditions in the upstream ELFkickers Makefile that cause builds to fail non-deterministically when multiple jobs run simultaneously.
Changes:
- Modified the elfkickers install script to use single-threaded make (
-j1) instead of parallel make (-j $(nproc))
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -2,6 +2,6 @@ | |||
|
|
|||
| git clone --depth 1 https://github.com/BR903/ELFkickers | |||
| cd ELFkickers | |||
There was a problem hiding this comment.
Consider adding a comment explaining why -j1 is necessary here. Since this deviates from the repository's convention of using make -j $(nproc) for parallel builds (seen in gdb, qemu, valgrind, etc.), a brief comment would help future maintainers understand this is a workaround for upstream Makefile race conditions. For example: # Use -j1 to avoid race conditions in upstream ELFkickers Makefile
| cd ELFkickers | |
| cd ELFkickers | |
| # Use -j1 to avoid race conditions in upstream ELFkickers Makefile |
| git clone --depth 1 https://github.com/BR903/ELFkickers | ||
| cd ELFkickers | ||
| make -j $(nproc) | ||
| make -j1 |
There was a problem hiding this comment.
This installer clones a third-party repository from https://github.com/BR903/ELFkickers without pinning it to an immutable commit and then immediately runs make, effectively granting that external code execution in your CI environment. If the GitHub account or repository is compromised, an attacker can inject malicious build steps to exfiltrate CI secrets or tamper with the generated binaries. To mitigate this supply-chain risk, pin the clone to a specific trusted commit or release and add integrity verification before building.
Example of the risky pattern:
git clone --depth 1 https://github.com/BR903/ELFkickers
cd ELFkickers
make -j1
Summary
toolcheck (elfkickers)) caused by a parallel make raceelfkickers/installby changingmake -j $(nproc)tomake -j1Why
rebindlinks against../elfrw/libelfrw.a, but ELFkickers upstream Makefile does not fully express dependency ordering under parallel builds. In CI this can cause:/usr/bin/ld: ../elfrw/libelfrw.a: error adding symbols: file format not recognizedRunning make single-threaded in this installer removes the race deterministically.
Validation
bash -n elfkickers/installBR903/ELFkickersand ranmake -j1successfullyelfrw/libelfrw.aandbin/rebindare produced