CommitWatch RSS
EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkNormal
Source repository ↗
Repository coverage

1854 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

158security candidates263second-pass queue362AI analyses
147commits · 30 days
226commits · 60 days
804commits · 180 days
1850commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
431Strong · 80–100
1163Adequate · 60–79
231Thin · 40–59
29Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Rusty Russell95873178072
Sangbida Chaudhuri1473158066
Dusty Daemon771313066
ShahanaFarooqui931011063
daywalker9089522062
Níckolas Goline4059076
Lagrang37647069
Christian Decker3645072
Vincenzo Palazzo834080
Chandra Pratap56224082
ekzyis222063
Peter Neuroth9716070
Analysis record

Published AI watches

Last scanned 31 minutes ago

Informational 17 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: internal cleanups since all non-command JSON IDs are strings.

This is a routine internal cleanup commit in Core Lightning. It removes an unused helper function and simplifies how JSON-RPC request IDs are stored and formatted, since the project now always uses string IDs for non-command JSON traffic. …

No security-relevant keywords in commit title or messageNo CVE, advisory, or bug reference presentChanges are refactor/cleanup in nature
a70ae963by Rusty Russell+25−378 files
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade: we need to remove "impressions" from askrene datastore when downgrading to v26.06.

This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…

Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
4d926285by Rusty Russell+43−111 file
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade tool: fix invalid memory bug

This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…

Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
42995326by Lagrang3+8−81 file
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit invoices to 10 minutes for recurring offers in other currencies.

This change tightens the lifetime of recurring invoices priced in foreign currencies (like USD) to 10 minutes by default, and refreshes them with current exchange rates when they expire. Previously, such invoices could remain valid for the…

Fixes stale exchange-rate exposure for currency-denominated recurring invoicesAdds configurable expiry cap for recurring currency invoicesDistinguishes user-cancellation (0s expiry) from natural expiry to avoid misleading errors
446312cfby Rusty Russell+134−148 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: don't bother with checking recurrence timing.

This commit removes local timing checks in Core Lightning's fetchinvoice plugin for recurring payments. Instead of the plugin refusing too-early or too-late invoice requests, it now lets the remote node decide and report back. The change i…

Removal of local input-validation checks for recurring invoice requestsReliance on remote-party enforcement for recurrence period limits and pay windowsTest expectations changed from local rejection to remote failure messages
3e49d908by Rusty Russell+2−682 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 90 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

add a test for downgrading askrene datastore

This commit adds a regression test for Core Lightning's database downgrade path. It ensures that when a user downgrades from an upcoming v26.09 release to an older version (v26.06), the new 'impressions' data added by the askrene routing s…

Database downgrade path for new askrene schema (impressions table)Regression test only; no production code changeNo input validation, cryptography, network, or authorization changes
1818553eby Lagrang3+156−13 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 81 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: don't crash when truncating large log messages

This commit fixes a crash bug in Core Lightning's logging code. When a log message was very long and got truncated, the program accidentally used the standard free() on memory that had been allocated by the project's own tal allocation sys…

Use-after-free / allocator mismatch: free() called on tal-allocated memoryDenial of service via large log message triggering truncation path crashMemory ownership semantics corrected with TAKES annotations
81425f17by Matt Whitlock+22−183 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightning-hsmtool: Fix getsecret does not show mnemonic after typing passphrase

This is a bug fix in a command-line helper tool used by Core Lightning node operators. The `getsecret` command was accidentally refusing to show the wallet recovery words (mnemonic) when the wallet was protected by a passphrase. After the …

Functional bug in secret-recovery pathError path blocked legitimate mnemonic recoveryNo input validation, memory-safety, or cryptographic change
8480f6c2by ekzyis+1−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 60 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: add regression test for hsmtool commands with passphrase

This commit only adds and updates a regression test in the project's test suite. It checks that the hsmtool utility correctly handles both empty and non-empty passphrases when working with BIP39 mnemonic-based wallet secrets. There is no c…

Regression test added for passphrase handling in hsmtoolNo production code changes observedTest-only change to tests/test_wallet.py
8c42be35by ekzyis+47−201 file
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 76 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wally: update libwally to v1.5.6

This commit updates the bundled libwally library to version 1.5.6. The practical effect is that calling the JSON-RPC `signpsbt` command on a PSBT that is already signed now succeeds as a harmless no-op, instead of returning an error on Bit…

Dependency update to incorporate upstream bug fixBehavior change from error to no-op on re-signing signed PSBTsTaproot keypath handling change in upstream cryptographic library
37526ca4by daywalker90+7−82 files
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: make datastore helpers self-wrap a wallet transaction

This change fixes a crash bug in Core Lightning's wallet datastore helpers. Previously, four datastore functions required the caller to already be inside a database transaction, and would fatally crash if called outside one. The patch make…

Fixes fatal assertion/crash in database statement preparationResolves transaction-context mismatch in wallet datastore helperswatchman plugin persistence path was affected
ae1a3347by Sangbida Chaudhuri+23−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: handle bwatch wallet/utxo spend notifications

This commit adds the missing bookkeeping that runs when Core Lightning's own on-chain wallet spends a UTXO. It makes the node mark the UTXO as spent, record the spending transaction, and log a withdrawal coin movement. It also handles bloc…

Missing spend tracking for wallet-owned UTXOs could lead to stale UTXO state or incorrect coin-movement accountingReorg handling clears spendheight, preventing a spent output from becoming permanently unspendable in the wallet's viewDefensive log_broken calls on unexpected missing UTXO or malformed watch suffix
4ba051caby Sangbida Chaudhuri+149−03 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 54 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: handle reorgs for our_outputs/our_txs by hand

This commit fixes how Core Lightning's wallet records handle blockchain reorganizations (reorgs) for two newer database tables, our_outputs and our_txs. Previously, these tables were not properly updated when blocks were removed or rolled …

Incorrect state persistence across blockchain reorgsMissing reorg handling for wallet tables without foreign-key cascadePotential stale spend/confirmation metadata in our_outputs/our_txs
bcdea215by Sangbida Chaudhuri+40−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: read UTXO state from our_outputs

This commit switches Core Lightning's wallet code to read UTXO (unspent transaction output) data from a new database table called our_outputs instead of the older outputs table. It also deletes several old helper functions and updates test…

Large internal data-model migration with reader/writer split between old and new tablesDual-write mirroring to legacy outputs table for downgrade compatibilityDeletion of legacy UTXO reading helpers
0a10e74eby Sangbida Chaudhuri+433−5772 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: rename b32script to scriptpubkey in PSBT change paths

This commit is a simple variable rename inside a Bitcoin/Lightning wallet file. The old name 'b32script' suggested all change addresses were bech32 format, but the project now uses a newer address type (p2tr) by default. The developer rena…

b8a60579by Sangbida Chaudhuri+12−141 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: update test_wallet.py raw-SQL queries for our_outputs

This commit only updates internal test code to query a new database table (our_outputs) instead of an old one (outputs). It does not change the actual wallet or node software that users run, so it cannot directly affect security.

d14ee378by Sangbida Chaudhuri+31−281 file
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: register scriptpubkey watches at startup

This change makes Core Lightning register long-lasting 'watches' for all wallet deposit addresses when the node starts up, so the new bwatch plugin can spot incoming payments from the first block it scans. It also removes a now-redundant p…

Change is part of an experimental chain-watcher (bwatch) featureAdds startup registration of scriptPubKey watches for all derived wallet keysRemoves a redundant unconfirmed-change watch, relying on the new blanket coverage
4a951d65by Sangbida Chaudhuri+89−114 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: dual-write chaintopology UTXO changes into our_outputs

This is a database refactoring commit in Core Lightning. It makes the wallet write UTXO (unspent transaction output) state to a new table called our_outputs in addition to the legacy outputs table, while reads still use the old table. The …

Database schema migration with dual-write mirror patternNo security claim in commit title or messageNo CVE, advisory, or researcher attribution in commit metadata
824e8195by Sangbida Chaudhuri+118−162 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: record bwatch-discovered wallet outputs

This commit adds new wallet bookkeeping code for Core Lightning. It records Bitcoin deposits found by a new chain-watcher ('bwatch') into database tables and handles blockchain reorganizations by demoting transactions back to unconfirmed r…

New database write paths for wallet UTXOs and transactionsReorg revert logic demotes rather than deletes rows to preserve metadataOwner-string constructors added to avoid silent unwatch failures from format mismatches
bc021011by Sangbida Chaudhuri+543−07 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedcln-bip353: add plugin that fetches payment instructions from human readable addressesby daywalker90 · e3e41163 · Aug 14, 2025 · 21 filesMessage 65 · AdequateTriage 0Details
Commit message · daywalker90

cln-bip353: add plugin that fetches payment instructions from human readable addresses

Changelog-Add: new plugin cln-bip353 that can fetch BIP-353 payment instructions from human readable addresses

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
second-pass: unusually broad change
AI review queuedcommon/json_parse_simple: make convenience functions inlineby Matt Whitlock · 9112c1d5 · Aug 14, 2025 · 7 filesMessage 85 · StrongInformational 18Details
Commit message · Matt Whitlock

common/json_parse_simple: make convenience functions inline

json_tok_streq(…) and json_get_member(…) are convenience wrappers for
json_tok_strneq(…) and json_get_membern(…) respectively. Unfortunately, using
them incurs a performance penalty in the common case where they are called with
a string literal argument because the compiler is unable to substitute a
compile-time constant in place of the buried call to strlen(…).

For example,

json_get_member(buf, tok, "example");

…will have worse performance than…

json_get_membern(buf, tok, "example", strlen("example"));

…because the former is forced to scan over "example" at run-time to count its
length whereas the latter is able to elide the strlen(…) call at compile time.

Hoist these convenience functions up into common/json_parse_simple.h and mark
them as inline so that the compiler can elide the strlen(…) call in the common
case of calling these functions with a string literal argument.

Changelog-None

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This change moves two helper functions from a source file into a header file and marks them 'inline' so the compiler can optimize common calls. It is a performance cleanup, not a security fix. The functions behave the same way as before; only how the compiler sees them changes. Test stub files are updated to match the new internal layout.

AI review queuedbitcoin: have random_scid() function.by Rusty Russell · 639452ac · Aug 14, 2025 · 5 filesMessage 50 · ThinInformational 15Details
Commit message · Rusty Russell

bitcoin: have random_scid() function.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a small code cleanup: it creates a shared helper function called random_scid() that generates a random channel identifier, and replaces two places that previously did this directly with calls to the new helper. It also adds a couple of test setup lines so wallet tests don't reuse stale channel maps. There is no security fix here—just refactoring and test hygiene.

AI review queuedwallet: we can assume local_alias field is non-null.by Rusty Russell · bb4dda6f · Aug 14, 2025 · 3 filesMessage 73 · AdequateLow 26Details
Commit message · Rusty Russell

wallet: we can assume local_alias field is non-null.

We have a migration which ensures this, but then I discovered that did
*not* address channels without an SCID yet. So fixed the migration, and
simpligied the code.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 26/100

This commit fixes a database migration in Core Lightning that was supposed to ensure every channel has a local alias (a routing identifier), but it missed channels that didn't yet have a stable channel ID (SCID). The patch moves and broadens the migration so all channels without a local alias get one, and then simplifies the code to always expect the field to be present. It is a data-integrity bug fix rather than an obvious remote exploit, but if a channel lacked a local alias it could lead to inconsistent routing behavior or crashes in later code paths that assume the alias exists.

AI review queuedlightningd: save previous short_channel_ids during splice, and keep in db.by Rusty Russell · 4abd0af3 · Aug 14, 2025 · 8 filesMessage 73 · AdequateInformational 23Details
Commit message · Rusty Russell

lightningd: save previous short_channel_ids during splice, and keep in db.

There can be any number of these, and it will be useful to allow
routing by older scids (when other nodes haven't seen our gossip, or
even before we *can* announce the new post-splice channel).

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 23/100

This commit adds bookkeeping for previous channel identifiers (short_channel_ids) when a Lightning channel is spliced. Splicing changes the channel's identifier, so the software now remembers old identifiers in memory and in the wallet database. This is a routing/reliability improvement, not a security fix, and the commit message does not describe any vulnerability.

AI review queuedwallet: remove now-gratuitous counters from update statements.by Rusty Russell · 51d6afec · Aug 14, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Rusty Russell

wallet: remove now-gratuitous counters from update statements.

When we had to use the number to the db_bind call, these annotations made
sense, but since 0bcff1e76d6796e20a26c883ad83bc8fad17efeb (for v23.08) we
removed that.

So remove all the counters, which are simple overhead if we want to
change something.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply removes inline number comments (like '// 0', '// 1') from SQL UPDATE statements in the wallet code. These numbers used to help match database bind parameters, but are no longer needed after an earlier code change. There is no functional change to the program's behavior, no bug fix, and no security relevance.

AI review queuedlightningd: require local_alias in new_channel().by Rusty Russell · 5e263bac · Aug 14, 2025 · 7 filesMessage 68 · AdequateLow 25Details
Commit message · Rusty Russell

lightningd: require local_alias in new_channel().

We allowed NULL for stub channels, but just don't put the stub scid
into the hash tables. This cleans up all the callers to make it
clear this is a non-optional parameter.

We opencode channel_set_random_local_alias, since there's only one caller now.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 25/100

This commit is a code-cleanup change in Core Lightning that makes the local channel alias a required value when creating a channel record, instead of allowing it to be optional/NULL. It removes a fallback that generated a random alias if one was missing. The change is defensive: it ensures every channel has a known local alias and avoids subtle bugs where a missing alias could lead to inconsistent channel lookup tables. There is no direct evidence in the commit or supplied references that this fixes an active security vulnerability.

AI review queuedpytest: refactor reckless check_stderrby Alex Myers · 542b54c6 · Aug 11, 2025 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · Alex Myers

pytest: refactor reckless check_stderr

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedfix: coincurve build issueby Lakshya Singh · 0ca833fe · Aug 11, 2025 · 2 filesMessage 90 · StrongTriage 0Details
Commit message · Lakshya Singh

fix: coincurve build issue

hatchling build requires license file but the build that coincurve
21.0.0 uses doesn’t account for that in `build_hatch.py` this was added
to prevent need of `cffi` as a runtime dependency but we can probably
live without it until it gets fixed.

change MR: https://github.com/ofek/coincurve/pull/176

reported issue: https://github.com/ofek/coincurve/issues/187

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedfeat: replace poetry with uv for dependency managementby Lakshya Singh · 69102c62 · Aug 11, 2025 · 4 filesMessage 85 · StrongTriage 0Details
Commit message · Lakshya Singh

feat: replace poetry with uv for dependency management

Replace poetry with uv for managing Python dependencies and running
commands across CI workflow.

- Add astral-sh/setup-uv@v5 action to install uv
- Replace all poetry run commands with uv run
- Remove poetry-specific installation steps
- Update Python setup in multiple jobs

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discountsecond-pass: broader security terminology
AI review queuedfuzz-tests: Add coverage increasing inputs to seed corporaby Chandra Pratap · a1c554fd · Aug 6, 2025 · 107 filesMessage 83 · StrongInformational 15Details
Commit message · Chandra Pratap

fuzz-tests: Add coverage increasing inputs to seed corpora

Improvements in the fuzz-testing scheme of
`fuzz-bolt12-invrequest-decode` led to the discovery of test inputs
that result in greater in code coverage.

Add these inputs to the test's seed corpus.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidenceparser or protocol pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds 107 new test input files to a fuzz-test seed corpus. Fuzz-test seed corpora are collections of example inputs used to exercise code during automated testing. The commit does not change any production code, libraries, or configuration used by running Core Lightning nodes. It is purely a testing improvement and has no direct security impact on deployed software.

AI review queuedfuzz-tests: Make `fuzz-bolt12-invrequest-decode` roundripby Chandra Pratap · d9685a6c · Aug 6, 2025 · 1 fileMessage 91 · StrongInformational 15Details
Commit message · Chandra Pratap

fuzz-tests: Make `fuzz-bolt12-invrequest-decode` roundrip

Changelog-None: Currently, the `BOLT #12` invrequest parsing test
only tests the invrequest decode function. Add a test for the
encoding function as well by making the test roundtrip.

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidenceparser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes a fuzz test file. It extends an existing test so that after decoding a BOLT 12 invoice request, it re-encodes the result and decodes it again, then checks the two decoded versions match. There is no change to production code, no bug fix, and no security patch.

AI review queuedconfigure: Fix debug symbols for installed binaries on macOSby Sangbida Chaudhuri · 9e55e8dd · Aug 6, 2025 · 2 filesMessage 95 · StrongTriage 0Details
Commit message · Sangbida Chaudhuri

configure: Fix debug symbols for installed binaries on macOS

When installing core lightning on macOS I found that the debug symbols were not being preserved leading to "no debug info in
Mach-O executable". This is because the .dSYM files, which contain the debug information, is generated in the build directory and could not be found by the installed binaries.

Changes:
- Add -fno-standalone-debug flag to CDEBUGFLAGS on macOS to reduce
dependency on absolute source paths
- Modify install-program target to copy .dSYM bundles alongside
binaries for BIN_PROGRAMS, PKGLIBEXEC_PROGRAMS, and PLUGINS

Testing:
1. ./configure --reconfigure
2. make install PREFIX=/tmp/lightning-install
3. make clean (removes all .dSYM files from build directory)
4. /tmp/lightning-install/bin/lightningd --help
5. Verified stack traces now work correctly without "no debug info" errors

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology