---
id: "bug-1612"
status: "fixed"
status_updated: "2026-09-24"
status_note: ""
component: "apiserver"
severity: "unknown"
timestamp: "2026-08-21T00:00:00Z"
last_seen: "2026-09-19T09:00:00Z"
occurrences: 1
files: ["src/frontend/Makefile"]
tags: ["makefile", "shell-exit-status", "posix-sh", "dirty-content-fingerprint", "task-4.3", "code-review-rejection", "fp_ok"]
related: []
legacy: true
---

# bug-1612: Adversarial review REJECTED dirty-content-fingerprint task 4.3 (src/frontend/Makefile…

## Description
Adversarial review REJECTED dirty-content-fingerprint task 4.3 (src/frontend/Makefile DIRTY_FINGERPRINT): when `git diff HEAD` failed but the following `git ls-files | sort | xargs cat` pipe still succeeded, the computation silently proceeded and emitted a fabricated non-empty fingerprint instead of degrading to empty.

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
The `$(shell ...)` block wrote both steps into the scratch file via `if { git diff HEAD 2>/dev/null; git ls-files -z ... | sort -z | xargs -0 -r cat -- 2>/dev/null; } >"$fp_tmp" 2>/dev/null; then`. POSIX shell only propagates the exit status of the LAST command in a `{ cmd1; cmd2; }` sequential group (and `sh` here has no `pipefail`), so a `git diff HEAD` failure was silently discarded whenever the trailing ls-files/sort/xargs pipe still exited 0 -- unlike xce-build.sh's task 2.1 reference implementation, which tracks per-step success explicitly via an `fp_ok` flag.

## Fix
Restructured the DIRTY_FINGERPRINT $(shell ...) block to gate each step individually, mirroring xce-build.sh's fp_ok discipline: `git diff HEAD >"$fp_tmp"` is now its own `if ! ...; then fp_ok=0; fi` step, and the ls-files/sort/xargs pipe (appending via `>>`) is a separate `if [ "$fp_ok" = 1 ] && ! ...; then fp_ok=0; fi` step; hashing only proceeds if fp_ok stayed 1 through both. Verified via a wrapper `git` on PATH that fails only `git diff` (all other subcommands pass through to the real git): before the fix this produced a fabricated hash (e.g. f2cd51ec) instead of the reference implementation's empty result; after the fix it resolves to empty, matching xce-build.sh under the identical injected failure. Cross-checked the happy path remains byte-identical to xce-build.sh's standalone computation (e.g. 96726026), the sha256sum-missing fallback (Requirement 5.1) still degrades to empty, GIT_COMMIT's own `-dirty` suffix is unaffected in all three scenarios, and a real `nix develop`-driven `make build-cli` + `go version -m` shows the matching fingerprint (f60eb4be) embedded in the -ldflags.

## Verification
_Not recorded (migrated from buglog.json)._

## References
_Not recorded (migrated from buglog.json)._