Harden the request path, scan and error recovery

1 file changed, 12 insertions, 14 deletions

diff --git a/source/cgit.mk b/source/cgit.mk
index 1199278..4109930 100644
--- a/source/cgit.mk
+++ b/source/cgit.mk
@@ -27,18 +27,14 @@ CGIT_BUILD = $(CGIT_ROOT)/$(BUILDDIR)
 # The CGIT_ values used below are exported by the top level Makefile.
 $(CGIT_BUILD)/VERSION: force-version
 	@mkdir -p $(CGIT_BUILD)/
-	@cd $(CGIT_ROOT) && '$(SHELL_PATH_SQ)' $(TOOLSDIR)/gen-version.sh "$(CGIT_VERSION)" $(BUILDDIR)/VERSION
+	@cd $(CGIT_ROOT) && \
+		'$(SHELL_PATH_SQ)' $(TOOLSDIR)/gen-version.sh "$(CGIT_VERSION)" $(BUILDDIR)/VERSION
 -include $(CGIT_BUILD)/VERSION
 .PHONY: force-version
 
-# The language the cgit sources are written in. Both GCC and Clang default to
-# this today, so pinning it changes nothing now and stops the meaning of the
-# sources drifting when a compiler moves its default on, as GCC 15 did by
-# defaulting to gnu23. The GNU dialect rather than plain c17 because git's
-# headers use GNU extensions, and because dlsym cannot be used through a
-# conforming cast. Only the cgit objects are held to this, and Git keeps
-# whatever its own build decides, which on some platforms is a different
-# standard again.
+# Pinned so a compiler moving its default, as GCC 15 did to gnu23, cannot
+# change what the sources mean. The GNU dialect because git's headers use GNU
+# extensions and dlsym needs a non-conforming cast. Git keeps its own choice.
 CGIT_STD ?= gnu17
 
 # CGIT_CFLAGS is tracked separately so that changing it does not force a rebuild
@@ -157,12 +153,14 @@ $(CGIT_BUILD)/.depend:
 $(CGIT_BUILD)/CGIT-CFLAGS: FORCE
 	@mkdir -p $(CGIT_BUILD)/
 	@FLAGS='$(subst ','\'',$(CGIT_CFLAGS))'; \
-	    if test x"$$FLAGS" != x"`cat $(CGIT_BUILD)/CGIT-CFLAGS 2>/dev/null`" ; then \
-		echo 1>&2 "    * new CGit build flags"; \
-		echo "$$FLAGS" >$(CGIT_BUILD)/CGIT-CFLAGS; \
-	    fi
+		OLD=`cat $(CGIT_BUILD)/CGIT-CFLAGS 2>/dev/null`; \
+		if test x"$$FLAGS" != x"$$OLD"; then \
+			echo 1>&2 "    * new CGit build flags"; \
+			echo "$$FLAGS" >$(CGIT_BUILD)/CGIT-CFLAGS; \
+		fi
 
-$(CGIT_OBJS): $(CGIT_BUILD)/%.o: $(CGIT_SRC)/%.c GIT-CFLAGS $(CGIT_BUILD)/CGIT-CFLAGS $(missing_dep_dirs)
+$(CGIT_OBJS): $(CGIT_BUILD)/%.o: $(CGIT_SRC)/%.c GIT-CFLAGS $(CGIT_BUILD)/CGIT-CFLAGS \
+		$(missing_dep_dirs)
 	$(QUIET_CC)$(CC) -o $@ -c $(dep_args) $(ALL_CFLAGS) $(EXTRA_CPPFLAGS) $(CGIT_CFLAGS) $<
 
 $(CGIT_BUILD)/cgit: $(CGIT_OBJS) GIT-LDFLAGS $(GITLIBS)