← Watch feed
reprobuild: use uv, not poetry, inside reproducible Docker files.
Public commit record
65/100 · Adequate
What the developer wrote
Authored by Rusty Russell
reprobuild: use uv, not poetry, inside reproducible Docker files.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
What changed, and why it matters
This commit swaps the Python package tool used inside Core Lightning's reproducible build Docker containers, replacing Poetry with a newer tool called 'uv'. It only touches build infrastructure files and does not change any wallet, network, or consensus code. There is no indication this fixes or introduces a security vulnerability.
Recommended action
No security action required. Treat as routine build-tooling maintenance; verify reproducible build outputs remain consistent if desired.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies three Dockerfiles under contrib/reprobuild/ used for deterministic release builds. It removes Poetry, pip bootstrap, and manual requirements.txt export/installation, substituting installation of ‘uv’ via Astral’s install script and using ‘uv sync’ / ‘uv run’ to manage Python dependencies. PATH is updated to include /root/.local/bin where uv is installed. No runtime or protocol code is affected.
Changed components
contrib/reprobuild/Dockerfile.focalcontrib/reprobuild/Dockerfile.jammycontrib/reprobuild/Dockerfile.nobleInspect captured patch +12 / −24
diff --git a/contrib/reprobuild/Dockerfile.focal b/contrib/reprobuild/Dockerfile.focal
index cf5f7021..e61524d4 100644
--- a/contrib/reprobuild/Dockerfile.focal
+++ b/contrib/reprobuild/Dockerfile.focal
@@ -3,7 +3,7 @@ FROM focal
ENV TZ=UTC
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
ENV RUST_PROFILE=release
-ENV PATH=/root/.pyenv/shims:/root/.pyenv/bin:/root/.cargo/bin:$PATH
+ENV PATH=/root/.pyenv/shims:/root/.pyenv/bin:/root/.cargo/bin:/root/.local/bin:$PATH
ENV PROTOC_VERSION=29.4
RUN sed -i '/updates/d' /etc/apt/sources.list && \
@@ -47,10 +47,7 @@ RUN git clone https://github.com/pyenv/pyenv.git /root/.pyenv && \
pyenv install 3.10.0 && \
pyenv global 3.10.0
-RUN wget https://bootstrap.pypa.io/get-pip.py -O /tmp/get-pip.py && python3 /tmp/get-pip.py \
- && rm /tmp/get-pip.py \
- && pip install poetry==2.0.1 mako grpcio-tools==1.62.2 && \
- poetry self add poetry-plugin-export
+RUN wget -qO- https://astral.sh/uv/install.sh | sh
RUN wget https://sh.rustup.rs -O rustup-install.sh && \
bash rustup-install.sh --default-toolchain none --quiet -y && \
@@ -73,7 +70,6 @@ WORKDIR /build
# uncommitted changes in the working directory on the host. Notice
# that we no longer take the zipfile.
CMD git clone /repo . \
- && poetry export -o requirements.txt --without-hashes \
- && pip install -r requirements.txt \
- && tools/repro-build.sh \
+ && uv sync --all-extras --all-groups \
+ && uv run tools/repro-build.sh \
&& cp *.xz /repo/release/
diff --git a/contrib/reprobuild/Dockerfile.jammy b/contrib/reprobuild/Dockerfile.jammy
index bedd4fbe..b363bc3b 100644
--- a/contrib/reprobuild/Dockerfile.jammy
+++ b/contrib/reprobuild/Dockerfile.jammy
@@ -3,7 +3,7 @@ FROM jammy
ENV TZ=UTC
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
ENV RUST_PROFILE=release
-ENV PATH=/root/.pyenv/shims:/root/.pyenv/bin:/root/.cargo/bin:$PATH
+ENV PATH=/root/.pyenv/shims:/root/.pyenv/bin:/root/.cargo/bin:/root/.local/bin:$PATH
ENV PROTOC_VERSION=29.4
RUN sed -i '/updates/d' /etc/apt/sources.list && \
@@ -45,10 +45,7 @@ RUN git clone https://github.com/pyenv/pyenv.git /root/.pyenv && \
pyenv install 3.10.0 && \
pyenv global 3.10.0
-RUN wget https://bootstrap.pypa.io/get-pip.py -O /tmp/get-pip.py && python3 /tmp/get-pip.py \
- && rm /tmp/get-pip.py \
- && pip install poetry==2.0.1 mako grpcio-tools && \
- poetry self add poetry-plugin-export
+RUN wget -qO- https://astral.sh/uv/install.sh | sh
RUN wget https://sh.rustup.rs -O rustup-install.sh && \
bash rustup-install.sh --default-toolchain none --quiet -y && \
@@ -71,7 +68,6 @@ WORKDIR /build
# uncommitted changes in the working directory on the host. Notice
# that we no longer take the zipfile.
CMD git clone /repo . \
- && poetry export -o requirements.txt --without-hashes \
- && pip install -r requirements.txt \
- && tools/repro-build.sh \
+ && uv sync --all-extras --all-groups \
+ && uv run tools/repro-build.sh \
&& cp *.xz /repo/release/
diff --git a/contrib/reprobuild/Dockerfile.noble b/contrib/reprobuild/Dockerfile.noble
index 4692eabd..f9c4506b 100644
--- a/contrib/reprobuild/Dockerfile.noble
+++ b/contrib/reprobuild/Dockerfile.noble
@@ -3,7 +3,7 @@ FROM ubuntu:noble
ENV TZ=UTC
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
ENV RUST_PROFILE=release
-ENV PATH=/root/.pyenv/shims:/root/.pyenv/bin:/root/.cargo/bin:$PATH
+ENV PATH=/root/.pyenv/shims:/root/.pyenv/bin:/root/.cargo/bin:/root/.local/bin:$PATH
ENV PROTOC_VERSION=29.4
RUN sed -i '/updates/d' /etc/apt/sources.list && \
@@ -43,10 +43,7 @@ RUN git clone https://github.com/pyenv/pyenv.git /root/.pyenv && \
pyenv install 3.10.0 && \
pyenv global 3.10.0
-RUN wget https://bootstrap.pypa.io/get-pip.py -O /tmp/get-pip.py && python3 /tmp/get-pip.py \
- && rm /tmp/get-pip.py \
- && pip install poetry==2.0.1 mako grpcio-tools && \
- poetry self add poetry-plugin-export
+RUN wget -qO- https://astral.sh/uv/install.sh | sh
RUN wget https://sh.rustup.rs -O rustup-install.sh && \
bash rustup-install.sh --default-toolchain none --quiet -y && \
@@ -69,7 +66,6 @@ WORKDIR /build
# uncommitted changes in the working directory on the host. Notice
# that we no longer take the zipfile.
CMD git clone /repo . \
- && poetry export -o requirements.txt --without-hashes \
- && pip install -r requirements.txt \
- && tools/repro-build.sh \
+ && uv sync --all-extras --all-groups \
+ && uv run tools/repro-build.sh \
&& cp *.xz /repo/release/
Risk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.