What the developer wrote
Authored by Christian Decker
ci: Use uv in Fedora build
What changed, and why it matters
This commit updates a Fedora-based CI build container to use a newer Python packaging tool called 'uv' instead of the older pip/virtualenv/poetry setup. It is a routine build-infrastructure change with no apparent security relevance.
No security action required. Review the change as normal build-maintenance; optionally verify the uv install script is fetched over HTTPS and pinned if reproducibility is desired.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The Dockerfile for the Fedora CI builder is refactored: it removes python3-devel, python3-mako, python3-pip, python3-virtualenv, python3-setuptools, and the previous pip/virtualenv/poetry bootstrap, then installs the ‘uv’ Python package manager via Astral’s install script and sets UV_PYTHON=3.12. The change is purely CI/tooling hygiene.
Changed components
contrib/docker/Dockerfile.builder.fedoraInspect captured patch +5 / −12
diff --git a/contrib/docker/Dockerfile.builder.fedora b/contrib/docker/Dockerfile.builder.fedora
index cae7ca57..5bbbff78 100644
--- a/contrib/docker/Dockerfile.builder.fedora
+++ b/contrib/docker/Dockerfile.builder.fedora
@@ -1,6 +1,8 @@
FROM fedora:35
+ENV UV_PYTHON=3.12
ENV BITCOIN_VERSION=27.1
+
WORKDIR /tmp
RUN dnf update -y && \
@@ -10,11 +12,6 @@ RUN dnf update -y && \
dnf install -y \
clang \
libsq3-devel \
- python3-devel \
- python3-mako \
- python3-pip \
- python3-virtualenv \
- python3-setuptools \
redhat-lsb \
net-tools \
valgrind \
@@ -26,8 +23,6 @@ RUN dnf update -y && \
cargo && \
dnf clean all
-RUN python3 -m pip install uv
-
RUN wget https://bitcoincore.org/bin/bitcoin-core-$BITCOIN_VERSION/bitcoin-$BITCOIN_VERSION-x86_64-linux-gnu.tar.gz -O bitcoin.tar.gz && \
tar -xvzf bitcoin.tar.gz && \
mv bitcoin-$BITCOIN_VERSION/bin/bitcoin* /usr/local/bin/ && \
@@ -36,8 +31,6 @@ RUN wget https://bitcoincore.org/bin/bitcoin-core-$BITCOIN_VERSION/bitcoin-$BITC
mv bitcoin-$BITCOIN_VERSION/share/man/man1/* /usr/share/man/man1 && \
rm -rf bitcoin.tar.gz bitcoin-$BITCOIN_VERSION
-ENV PATH=/opt/venv/bin:${PATH}
-RUN python3 -m pip install pip wheel && \
- python3 -m virtualenv /opt/venv && \
- /opt/venv/bin/python3 -m pip install --force-reinstall -U pip poetry wheel
-RUN poetry self add poetry-plugin-export
+# Ensure `uv` can be found
+ENV PATH=${PATH}:/root/.local/bin
+RUN wget -qO- https://astral.sh/uv/install.sh | sh
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.