EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkActive incident
Repository coverage

1979 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

184security candidates280second-pass queue1894AI analyses
26commits · 30 days
185commits · 60 days
659commits · 180 days
1641commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

71/100 average clarity
484Strong · 80–100
1224Adequate · 60–79
241Thin · 40–59
30Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
cdecker14910384
Níckolas Goline63844277
Rusty Russell96475958172
daywalker90113895164
Lagrang386578170
Vincenzo Palazzo13411182
dovgopoly15015164
Sangbida Chaudhuri14931146066
Dusty Daemon821378066
ShahanaFarooqui931093063
Peter Neuroth1024101071
Christian Decker36436072
Analysis record

Published AI watches

Last scanned 40 minutes ago

Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

contrib: add jaonoctus's signing key

This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.

41278b4eby jaonoctus+2−02 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: fixed timestamps for invented bookkeeper deposits

This is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…

498e5086by daywalker90+2−01 file
No security note in commit
Informational 21 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

docs: document missing and fix erroneous JSON-RPC error codes

This commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…

Documentation-only change with no executable code modificationsCorrects RPC schema error-code metadata to match actual handler behaviorNo change to input parsing, authorization, cryptography, or network behavior
d1b6963bby daywalker90+204−1224 files
No security note in commit
Low 46 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

channeld: initialize tx_sigs_allowed on startup

This commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …

use of uninitialized variableundefined behavior (invalid bool load)network-triggered code path
c09c4520by Erick Cestari+1−01 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

ci: fix the coverage nightly's profile handling

This commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…

5685c9a3by cdecker+12−211 file
No security note in commit
Low 37 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

schemas: make required fields match the code

This commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…

Large schema-only change with no accompanying security advisory or CVEOne semantic change to plugin hook response: invoice_payment hook can now reject with only failure_message and no resultMany fields change from optional to required in public RPC/protobuf interfaces
ddbd2963by daywalker90+1786−173950 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: document error 313 on every command which can return it

This commit only updates documentation. It adds error code 313 to the documented error lists for several Core Lightning commands (fundpsbt, utxopsbt, txprepare, multiwithdraw, and upgradewallet). The error code already existed in the code …

a34b9758by Peter Neuroth+30−86 files
No security note in commit
Low 25 AI analysisMessage 88 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tools/build-release.sh: name the checksum file when verifying the signature

This commit fixes a release-script check that verifies the cryptographic signature on a file of checksums. Previously, the script only told GPG to verify the signature file itself. If someone replaced that signature file with an inline-sig…

Incorrect cryptographic verification logic in release toolingPotential false-positive signature verification with inline-signed .asc substitutionRelease-integrity hardening
8e495707by Peter Neuroth+5−21 file
No security note in commit
Low 42 AI analysisMessage 95 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: pass the manifest explicitly to gpg --verify

This commit updates Core Lightning's release documentation to tell users and release managers to run gpg --verify with both the signature file and the manifest file named explicitly. The old one-argument form can silently succeed even if t…

Verification bypass risk in release artifact validationgpg --verify single-argument form can exit 0 without reading the intended manifestDocumentation-only hardening of release process
2dee8699by Peter Neuroth+9−62 files
Vendor flagged security relevance
Low 25 AI analysisMessage 58 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

Cargo.lock: update dependencies

This commit is a routine update to the Rust dependency lock file (Cargo.lock), bumping many third-party libraries to newer patch or minor versions. The commit message gives no security reason for the update, and no verified references link…

Routine dependency refresh with no stated security rationaleUpdates to security-sensitive transitive crates (rustls, hyper, h2, tokio, webpki-roots) but no evidence these versions fix known vulnerabilitiesNo source-code changes or patch-specific fixes visible in the diff
c1551c55by daywalker90+298−2761 file
No security note in commit
High 80 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

common: bound JSON nesting depth when parsing

This commit fixes a stack-overflow risk in Core Lightning's JSON parser. Before the fix, an attacker could send a valid JSON-RPC message containing thousands of nested brackets or braces. The parser's own helper functions used recursion fo…

Stack-overflow via deeply nested JSONRecursive JSON traversal without depth boundDenial-of-service vector in JSON-RPC input parsing
83f92e4bby Níckolas Goline+90−22 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 28 · Opaque
EP Elements ProjectCore Lightning BitcoinLightning Network

common: minor typo fixes

This commit only fixes typos and comment style. It changes two C-style comments from // to /* */ and corrects a grammar error in a documentation comment ('element' to 'elements'). There are no code behavior changes, no bug fixes, and no se…

273d7f02by w3lld1+3−32 files
No security note in commit
Informational 20 AI analysisMessage 90 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

pyln-testing: truncate long testnames

This change fixes a test-infrastructure bug in Core Lightning's Python testing helpers. When running tests against a PostgreSQL database, very long test names could be silently shortened by PostgreSQL, causing different test runs or nodes …

No security-relevant signal: change is in test framework code onlyFixes a test reliability issue, not a runtime vulnerabilityNo input sanitization, authentication, cryptography, or network changes
c4fe4cbaby Peter Neuroth+59−12 files
No security note in commit
Moderate 60 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: exclude immature coinbase outputs from fee rescue selection

This fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the n…

Consensus-invalid transaction generation preventedFee rescue / CPFP failure mode mitigatedCoinbase maturity check added to coin selection
34883ff7by cdecker+5−12 files
Vendor flagged security relevance
Moderate 59 AI analysisMessage 91 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: fix crash loading node bias with description

This commit fixes a bug in Core Lightning's askrene plugin that could prevent a node from restarting. When a saved routing layer contained a node bias with a description, the plugin accidentally freed the description's memory while using i…

Use-after-free / double-take of a tal-allocated string during plugin startupDenial-of-service-like symptom: lightningd aborts before replying to init, node cannot restartFixes publicly reported issue #9433 by endothermicdev
4681177dby Vincenzo Palazzo+2−32 files
No security note in commit
Informational 12 AI analysisMessage 91 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: restart the node which owns the layer in node bias test

This commit only fixes a test case so it actually exercises the intended code path. It does not change any production code, so it cannot introduce or fix a real-world security vulnerability by itself. The test change is a reproducer for a …

0f3f67a0by Vincenzo Palazzo+3−21 file
No security note in commit
High 78 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

dualopend: bound the feerates a peer opens at

This commit fixes a bug in Core Lightning's experimental dual-funded channel feature. When another node tried to open a channel, Core Lightning was not checking whether the proposed transaction fees were reasonable. A peer could request a …

Missing input validation on wire-parsed feerate fieldsPeer could induce signing and storage of feerate == 0RBF remote path allowed unbounded upward feerate walks
ba08356fby cdecker+140−04 files
Vendor flagged security relevance
High 72 AI analysisMessage 100 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: regression coverage for out-of-range feerates

This commit adds regression tests for three related bugs where wildly wrong Bitcoin transaction feerates could enter Core Lightning. In the worst case, a malicious or broken fee source could make the node think a feerate was zero (due to a…

Integer overflow in feerate conversion (u32 wrap from 0xFFFFFFFF perkb to 0 perkw)Absurd feerate from external fee source bypassing sanity ceilingDatabase-stored out-of-range feerate causing startup abort/crash loop
65bdbc47by cdecker+137−02 files
No security note in commit
Moderate 64 AI analysisMessage 86 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: don't assert on funding feerates read from the db

This update fixes a crash bug in Core Lightning. When the software tried to list details of a channel opening in progress, it could crash if a stored fee rate was extremely large or zero. The crash happened because the code used an interna…

Integer overflow in RBF escalation (u32 * 25 / 24) leading to assertion failureAssertion failure in read-only introspection RPC (listpeerchannels) causing crash-loop at startupDatabase value treated as invariant despite originating from external fee estimator
d67c4936by cdecker+72−227 files
Vendor flagged security relevance
Moderate 53 AI analysisMessage 86 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: clamp absurd inflight funding feerates on upgrade

This commit fixes a bug where Core Lightning nodes could get stuck in a crash loop. If a node had previously stored an extremely high or zero fee rate for an in-progress channel funding operation (a 'splice' or dual-funded channel RBF), a …

Integer overflow in fee-rate calculation (u32 overflow when multiplying by 25/24)Assertion failure leading to daemon crash loop at startupDatabase migration clamps out-of-range stored funding feerates
f057c692by cdecker+34−01 file
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityautogenerate-rpc-examples.py: added feature to be able to rewrite the request in Rewriterby ShahanaFarooqui · cf3467a3 · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui

autogenerate-rpc-examples.py: added feature to be able to rewrite the request in Rewriter

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes an internal test helper script used to generate documentation examples. It adds the ability to rewrite request parameters in example snippets, similar to the existing ability to rewrite responses. There is no change to the actual Core Lightning node software, network protocol, wallet handling, or any user-facing runtime behavior. It is not a security fix and does not introduce a security issue.

Security candidateautogenerate-rpc-examples.py: pin the full sorted UTXO set for multiwithdraw examplesby ShahanaFarooqui · 6f464e46 · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui

autogenerate-rpc-examples.py: pin the full sorted UTXO set for multiwithdraw examples

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
access control
AI analysis · Informational 15/100

This commit only changes an internal test script that automatically generates example RPC commands for documentation. It makes the examples more deterministic by explicitly selecting which coins the test wallet uses, so the generated documentation does not vary randomly between test runs. There is no change to the actual Core Lightning node software that users run, and no security vulnerability is being fixed.

Lower-priorityautogenerate-rpc-examples.py: added more rewrite for other RPCsby ShahanaFarooqui · 2e608edc · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui

autogenerate-rpc-examples.py: added more rewrite for other RPCs

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes a test helper script that automatically rewrites RPC command examples used in documentation. It adds more rules to make generated examples stable across test runs by replacing variable values like network ports, transaction IDs, and timestamps with fixed placeholder values. There is no change to the actual Core Lightning node software or its security behavior.

Lower-priorityautogenerate-rpc-examples.py: added sorting for some list example to stabilise the responseby ShahanaFarooqui · 9a50cc12 · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui

autogenerate-rpc-examples.py: added sorting for some list example to stabilise the response

And flake fixes

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes a test helper script that generates documentation examples for RPC commands. It adds sorting and renumbering of example output fields so the generated documentation stays the same across test runs. There is no change to the actual Core Lightning node software, wallet handling, network code, or any user-facing runtime behavior.

Security candidatedoc: generate all examples with newchainby ShahanaFarooqui · e392c7d7 · Jul 14, 2026 · 129 filesMessage 45 · ThinInformational 15Details
Commit message · ShahanaFarooqui

doc: generate all examples with newchain

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathboot or update pathauthentication pathparser or protocol path
AI analysis · Informational 15/100

This commit is a large documentation-only refresh. It regenerates example outputs in the project's JSON API schema files and test data so that all examples use a newer, more realistic test chain setup called 'newchain'. The values shown in the examples (node IDs, transaction IDs, payment hashes, runes, invoices, etc.) are swapped from placeholder/fake-looking strings to ones that look like real Bitcoin Lightning testnet data. There is no code change to the actual lightning node software, no bug fix, and no security patch.

Lower-priorityCI: re-enable docs examples checks.by Rusty Russell · e29915c6 · Jul 14, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Rusty Russell

CI: re-enable docs examples checks.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit simply turns a disabled GitHub Actions CI job back on. It re-enables automatic checks that update examples in the project's documentation schemas and makes the final documentation build depend on that job completing successfully. There is no code change to the lightning node software itself and no security relevance.

Lower-priorityCI: Add debug and upload artifacts on failureby ShahanaFarooqui · 4aae26dc · Jul 14, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · ShahanaFarooqui

CI: Add debug and upload artifacts on failure

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only improves GitHub Actions CI debugging. It adds extra logging and uploads test artifacts when a CI job fails. There is no change to the Core Lightning software itself, no user-facing behavior change, and no security issue.

Lower-priorityautogenerate-rpc-examples.py: use fixed port numbers.by Rusty Russell · 8475c95f · Jul 14, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell

autogenerate-rpc-examples.py: use fixed port numbers.

Move the elements config writing into an ElementsD.set_port() override. This makes many of our information outputs consistent.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit changes internal test tooling so that example-generation scripts use fixed TCP port numbers instead of random unused ports. It is a test-infrastructure and documentation-consistency change, not a fix for a security vulnerability in the Core Lightning node software itself.

Lower-prioritytests/autogenerate-rpc-examples.py: always use largest UTXO for fundchannel example.by Rusty Russell · 86aa1c04 · Jul 14, 2026 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Rusty Russell

tests/autogenerate-rpc-examples.py: always use largest UTXO for fundchannel example.

Now order has changed, the first one is insufficient; this is more robust.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This is a one-line change to a test script that auto-generates example RPC commands for documentation. It sorts a node's available coins by amount and picks the largest one, instead of picking whichever one happened to be listed first. This only affects documentation generation and has no security relevance.

Lower-prioritymake: Fix repeat-dpc-examples scriptby ShahanaFarooqui · c7605972 · Jul 14, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · ShahanaFarooqui

make: Fix repeat-dpc-examples script

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This is a tiny Makefile fix for an internal developer script that repeatedly runs documentation example tests. The change defines a BASE_PORTNUM variable so each test iteration uses a different network port range, preventing port collisions between iterations. There is no security relevance.

Security candidatecommon: add randbytes() wrapper to override cryptographic entropy: $CLN_DEV_ENTROPY_SEEDby Rusty Russell · 1c925e0a · Jul 14, 2026 · 5 filesMessage 90 · StrongInformational 18Details
Commit message · Rusty Russell

common: add randbytes() wrapper to override cryptographic entropy: $CLN_DEV_ENTROPY_SEED

Only in developer mode, ofc.

Notes:
1. We have to move the initialization before the lightningd main trace_start,
since that uses pseudorand().
2. To make the results stable, we need to use per-caller values to randbytes().
Otherwise external timing changes the call order.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

90/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Names security-relevant behavior explicitly
Why it was queued
entropy or randomness
AI analysis · Informational 18/100

This commit adds a developer-only feature that lets programmers override the randomness source used by Core Lightning during testing, via an environment variable. It is explicitly gated behind 'developer mode' and is not intended for production use. The patch itself only updates test build files and adds missing stub functions so unit tests compile with the new wrapper. There is no indication it weakens real network security.

Lower-prioritymake: Pinning PATH in doc scripts so generation always uses the tree's own binariesby ShahanaFarooqui · 4f5ca1e0 · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui

make: Pinning PATH in doc scripts so generation always uses the tree's own binaries

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit changes the build system so that documentation examples are generated using the project's own freshly-built command-line tools, rather than whatever tools happen to be installed on the developer's system. It is a build-hygiene and reproducibility fix, not a security patch, and it does not fix any vulnerability in running software.

AI review queuedlightningd: cancel watching original funding when we switch to the new one via splice.by Rusty Russell · 3226d686 · Jul 14, 2026 · 2 filesMessage 73 · AdequateLow 41Details
Commit message · Rusty Russell

lightningd: cancel watching original funding when we switch to the new one via splice.

This happens if the channel is *not* announcable yet. Then we hit the assertion
in funding_depth_cb that the txid is the same as the current funding.txid.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-EXPERIMENTAL: fixed crash when we splice a channel which hasn't been announced yet.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Low 41/100

This commit fixes a crash in Core Lightning that can happen when a user splices a channel that hasn't been publicly announced yet. Splicing is an experimental feature that changes a channel's funding transaction. The bug caused the program to hit an internal consistency check (assertion) because it was still monitoring the old funding transaction after switching to the new one. The commit only adds test stub functions and does not show the actual fix code, so we can only infer the intended change from the commit message.

Security candidatecommon: don't consume deterministic randbytes stream for trace idsby ShahanaFarooqui · 23b4b38a · Jul 14, 2026 · 1 fileMessage 83 · StrongLow 37Details
Commit message · ShahanaFarooqui

common: don't consume deterministic randbytes stream for trace ids

Trace/span ids now come from a plain counter when CLN_DEV_ENTROPY_SEED is active, so tracing (which CI's HAVE_USDT=1 build enables by default) no longer shifts the deterministic RNG stream that PSBT serial ids and locktime fuzz are drawn from.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
entropy or randomnesssigning boundaryfuzzing or regression evidence
AI analysis · Low 37/100

This change fixes a subtle bug in Core Lightning's tracing code. When running with a special developer-only deterministic randomness override (CLN_DEV_ENTROPY_SEED), trace IDs were being drawn from the same predictable random stream used for actual transaction details like PSBT serial IDs and locktime fuzzing. Because tracing may be enabled or disabled depending on build settings, this meant the same test or operation could produce different transaction outputs depending on whether tracing was compiled in. The fix makes trace IDs use a separate simple counter when deterministic mode is active, so tracing no longer shifts the random stream and transaction results stay consistent.

Security candidatecommon: don't trigger siphash_seed() init from span hashing either.by ShahanaFarooqui · e54fe678 · Jul 14, 2026 · 1 fileMessage 73 · AdequateInformational 19Details
Commit message · ShahanaFarooqui

common: don't trigger siphash_seed() init from span hashing either.

Previous commit stopped trace ids consuming the deterministic
randbytes stream, but tracing still touched it once: span_key_hash()
calls siphash_seed(), whose lazy init draws 16 bytes from the stream.
Since randbytes call sites are assigned their offset blocks in
first-use order, that single draw shifts every later draw in the
process by 1000 when tracing is active (HAVE_USDT builds, as in CI):
keysend preimages and invoicerequest payer keys then differ from a
build with tracing disabled, showing up as an 11-file doc-examples
diff.

Use a cheap multiplicative hash for span keys when the deterministic
override is active, so tracing touches the RNG stream zero times.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
entropy or randomness
AI analysis · Informational 19/100

This is a small bug-fix commit in Core Lightning's tracing code. It fixes a situation where enabling tracing accidentally changed the sequence of random numbers used elsewhere in the program, causing test outputs to differ between builds with and without tracing. The change makes tracing use a simple math hash instead of a randomness-seeded hash when deterministic mode is active. There is no direct security vulnerability here; it is a determinism/reproducibility fix.

Lower-priorityautogenerate-rpc-examples.py: more block generation and synchronization.by Rusty Russell · 03b239a4 · Jul 14, 2026 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

autogenerate-rpc-examples.py: more block generation and synchronization.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI analysis · Informational 15/100

This change only touches an internal test script that automatically generates example RPC output for documentation. It adds extra block generation and synchronization steps to make the example generator more reliable. There is no change to the actual Core Lightning node software, wallet logic, or network protocol, so it has no security impact on users.

Lower-priorityautogenerate-rpc-examples.py: fixed recover examples via `lightning-hsmtool getsecret`by ShahanaFarooqui · 16657264 · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui

autogenerate-rpc-examples.py: fixed recover examples via `lightning-hsmtool getsecret`

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit updates a test script that automatically generates documentation examples for backup and recovery commands. It changes how the script retrieves a secret value for examples, switching from a developer tool command to a different command and from a raw hex secret to a 12-word mnemonic phrase. There is no indication this affects real user funds, live nodes, or production code paths.

Lower-priorityautogenerate-rpc-examples.py: added 17 new RPC to ignore listby ShahanaFarooqui · c3a3a0ec · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui

autogenerate-rpc-examples.py: added 17 new RPC to ignore list

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only updates a test script's list of RPC commands that should be skipped when automatically generating documentation examples. It adds 17 more RPC names to an existing ignore list. There is no change to production code, network behavior, or security-sensitive logic.

Security candidatecommon: seed deterministic RNG from basename of argv0, not full pathby ShahanaFarooqui · 4ca60ba6 · Jul 14, 2026 · 1 fileMessage 95 · StrongInformational 19Details
Commit message · ShahanaFarooqui

common: seed deterministic RNG from basename of argv0, not full path

dev_override_randbytes() hashes argv0 into the CLN_DEV_ENTROPY_SEED
stream, so every plugin and subdaemon gets a distinct seed. But
lightningd execs them with absolute paths, so the "deterministic"
stream silently depended on where the source tree was checked out:
canned blocks generated in one directory would not replay in another
(funding tx output order and nlocktime fuzz diverge, so txids change).
This is why check-doc-examples passed locally but failed in CI.

Hash only the basename: binaries still get distinct seeds, but the
stream no longer depends on the checkout path.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
entropy or randomnessfuzzing or regression evidence
AI analysis · Informational 19/100

This change fixes a test-flakiness bug in a developer-only random-number override used during testing. It makes the random stream depend only on the program name, not the full file path, so tests produce the same results on different computers. It is not a security vulnerability fix.

Lower-priorityautogenerate-rpc-examples.py: ensure blockheights are consistent.by Rusty Russell · 5f1a0772 · Jul 14, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell

autogenerate-rpc-examples.py: ensure blockheights are consistent.

This makes our transaction generation (nlocktime) consistent, as well as our htlcs
for payment.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This change only touches a test helper script that auto-generates example RPC output for documentation. It adds calls to keep all test nodes synchronized on the current block height during example generation. There is no change to production code, no user-facing behavior change, and no security relevance.

Security candidateglobal: replace randombytes_buf() with randbytes() wrapper.by Rusty Russell · 72fd8b5c · Jul 14, 2026 · 24 filesMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

global: replace randombytes_buf() with randbytes() wrapper.

This allows us to override it for deterministic results.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet pathparser or protocol path
AI analysis · Informational 15/100

This commit only adds a new header include (<common/randbytes.h>) to 24 test files. It does not change any production code, cryptographic operations, or runtime behavior. The change is a test-infrastructure refactor to support deterministic randomness in tests, not a security fix or vulnerability.

Lower-priorityautogenerate-rpc-examples: sanitize plugin paths in plugin examplesby ShahanaFarooqui · 645a13c0 · Jul 14, 2026 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · ShahanaFarooqui

autogenerate-rpc-examples: sanitize plugin paths in plugin examples

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
defensive validation
AI analysis · Informational 15/100

This commit changes a test helper script that auto-generates documentation examples for the 'plugin' RPC command. It replaces real build-directory plugin paths with a generic '/usr/local/libexec/plugins/' path so the generated examples look clean and consistent. There is no change to the actual Core Lightning node code, no security fix, and no vulnerability.

Lower-priorityautogenerate-rpc-examples.py: more refinement.by Rusty Russell · 6f52691e · Jul 14, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · Rusty Russell

autogenerate-rpc-examples.py: more refinement.

1. Don't mangle bookkeeper events.
2. Use l3, not l1, for listtransactions: it's more stable.
3. Use l2, not l1, for listpeerchannels and listchannels.
3. Use l2, not l2, for listfunds.

(l1 has a lot of variation).

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit only changes a test helper script that generates documentation examples for RPC commands. It switches which simulated Lightning node is used for some example screenshots and stops filtering bookkeeper events. There is no change to the actual Core Lightning software that users run, so it cannot affect real wallets, payments, or network security.

Lower-prioritytests: use bitcoind.conf_file instead of hardcoded bitcoin.conf in RawProxy mocksby ShahanaFarooqui · 5de2c855 · Jul 14, 2026 · 2 filesMessage 83 · StrongInformational 15Details
Commit message · ShahanaFarooqui

tests: use bitcoind.conf_file instead of hardcoded bitcoin.conf in RawProxy mocks

These tests built their RawProxy against a hardcoded bitcoin.conf in the node's datadir. That only worked on liquid-regtest by accident: BitcoinD.__init__ used to write bitcoin.conf even when the node was actually an ElementsD. Now that config writing is deferred to set_port() and ElementsD only writes elements.conf, the mocks found no config and no .cookie, so their RPC calls failed and bcli's getblock timed out, leaving lightningd stuck during restart.

Use bitcoind.conf_file, which points at the config the running daemon actually uses (elements.conf on liquid-regtest, bitcoin.conf on egtest).

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This change only updates internal test code to use the correct configuration file path when simulating Bitcoin RPC connections during automated tests. It does not alter the Core Lightning software that users run, and it has no security relevance for real deployments.

AI review queuedcln-grpc: vendor protoc as a build-dependencyby daywalker90 · 608f6952 · Jul 13, 2026 · 13 filesMessage 68 · AdequateInformational 18Details
Commit message · daywalker90

cln-grpc: vendor protoc as a build-dependency

our current version of `grpcio-tools` 1.75.1 bundles `protoc` version:

```
uv run python -m grpc_tools.protoc --version
libprotoc 31.1
```

In CI/Dockerfiles we use 29.4 or whatever the OS provides with the
`protobuf-compiler` package, which for the most part is 21.12.

We actually want to somewhat match these versions but we don't have any
control over OS packages' versions.

We can instead bundle `protoc` as a build dependency for `cln-grpc`.
The current version for that bundles 31.1 as well.

This way the versions of `protoc` are more consistent everywhere.

One downside is that arm 32-bit hosts get no bundled protoc for `cln-grpc`
and have to still install `protobuf-compiler` themselves.

Changelog-None

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 18/100

This change swaps how the project gets its Protocol Buffers compiler (protoc) for one Rust component. Instead of relying on whatever version the operating system or CI happens to install, it bundles a specific protoc version as a build-time dependency. The goal is to make builds more consistent and avoid mismatches between protoc and the Python/Rust protobuf tooling. It is a build-system hygiene patch, not a fix for an active security flaw.