tools: Fix `sign` and `docker` target detection when passed as single argument
What the developer wrote
Authored by ShahanaFarooqui
tools: Fix `sign` and `docker` target detection when passed as single argument
The sign target detection uses pattern matching that requires spaces on
both sides of "sign" in the TARGETS variable. When only "sign" is passed
as an argument, TARGETS becomes " sign" (leading space only), causing
the condition to fail.
Add an additional pattern match to detect "sign" with a leading space
but no trailing space, which occurs when "sign" is the only target or
the last target in the list.
This regression seems to have been exposed by GitHub Actions runner
updates (Ubuntu 22.04 → 24.04), which changed argument passing behavior.
Changelog-None: Fixes the release signing issue in CI only.
What changed, and why it matters
This commit fixes a shell-script pattern-matching bug in the release build tool. When a maintainer ran the release script with only 'sign' or 'docker' as the target, the script failed to detect it because it expected spaces on both sides of the word. The fix adds an extra check for when the word appears at the end of the target list. It is a CI/release workflow bug, not a vulnerability in the Lightning node software itself.
No security action required. This is a CI/release-script correctness fix. Reviewers may verify that the new patterns correctly cover single-target and last-target cases without introducing unintended matches.
Security signals we found
No strong security signals were identified.
Evidence from the diff
In tools/build-release.sh, TARGETS is built by prepending a space to each argument. When a single target such as ‘sign’ or ‘docker’ is passed, TARGETS becomes ’ sign’ (leading space, no trailing space). The original detection used parameter expansion patterns ‘ docker ’ and ‘ sign ’, which require a trailing space and therefore failed to match a single trailing target. The patch adds an alternative pattern ‘ docker’ and ‘ sign’ to match the trailing-position case. This restores intended release signing and Docker image build behavior in CI.
Changed components
tools/build-release.shInspect captured patch +2 / −2
diff --git a/tools/build-release.sh b/tools/build-release.sh
index 3ad03dd..4e67f1d 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -209,7 +209,7 @@ for target in $TARGETS; do
esac
done
-if [ -z "${TARGETS##* docker *}" ]; then
+if [ -z "${TARGETS##* docker *}" ] || [ -z "${TARGETS##* docker}" ]; then
echo "Building Docker Images"
DOCKER_USER="elementsproject"
echo "Creating multi-platform images tagged as $VERSION and latest"
@@ -230,7 +230,7 @@ if [ -z "${TARGETS##* docker *}" ]; then
echo "Pushed multi-platform images tagged as $VERSION and latest"
fi
-if [ -z "${TARGETS##* sign *}" ]; then
+if [ -z "${TARGETS##* sign *}" ] || [ -z "${TARGETS##* sign}" ]; then
echo "Signing Release"
cd release/ || exit
sha256sum clightning-"$VERSION"-*.tar.* clightning-"$VERSION".zip > SHA256SUMS-"$VERSION"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.