contrib: Added fixed SOURCE_DATE_EPOCH flag for reproducible ubuntu builds
What the developer wrote
Authored by ShahanaFarooqui
contrib: Added fixed SOURCE_DATE_EPOCH flag for reproducible ubuntu builds
clnrest's `utoipa-swagger-ui` library has an indirect `rust-embed` dependency which by default includes timestamps in build. It results in non-deterministic build for clnrest. Using environment variable `SOURCE_DATE_EPOCH` with fixed value will enforce a consistent timestamp for builds.
Also adding the `--locked` flag to ensure the release build uses exact dependencies from Cargo.lock. The `--locked` flag is particularly important for deterministic builds as it prevents Cargo from updating the lockfile.
Fixes #8288.
Changelog-Fixed: Core lightning builds for Ubuntu Focal, Jammy and Noble are deterministic again.
What changed, and why it matters
This change makes Core Lightning's Ubuntu release builds produce identical output every time (reproducible builds). It does not fix a vulnerability in running software; instead, it removes a source of randomness in build timestamps and dependency versions that could make it hard to verify that a published binary truly came from the published source code. Reproducible builds help users and developers detect supply-chain tampering, but the patch itself is a build-hardening improvement, not an exploit fix.
No immediate runtime action is required. Builders and release maintainers should verify that the reproducible-build Docker images now produce identical artifacts across independent builds. Users who verify release binaries against the published source should confirm reproducibility claims once the next release is published.
Security signals we found
Build reproducibility / deterministic builds
Supply-chain integrity hardening
SOURCE_DATE_EPOCH timestamp normalization
Cargo --locked dependency lockfile enforcement
Indirect rust-embed timestamp nondeterminism
Evidence from the diff
The commit adds a fixed SOURCE_DATE_EPOCH (2023-01-01 00:00:00 UTC) to the Focal, Jammy, and Noble reproducible-build Dockerfiles and adds the –locked flag to non-debug Cargo invocations in the Makefile. SOURCE_DATE_EPOCH forces rust-embed (an indirect dependency of clnrest’s utoipa-swagger-ui) to embed a deterministic timestamp instead of the current build time. –locked prevents Cargo from silently updating Cargo.lock during release builds. Together they restore bit-for-bit deterministic builds for the affected Ubuntu release packages.
Changed components
Makefile (CARGO_OPTS for release/profile builds)contrib/reprobuild/Dockerfile.focalcontrib/reprobuild/Dockerfile.jammycontrib/reprobuild/Dockerfile.nobleclnrest (via utoipa-swagger-ui -> rust-embed)Inspect captured patch +4 / −1
diff --git a/Makefile b/Makefile
index e67f0ca7..635dbc25 100644
--- a/Makefile
+++ b/Makefile
@@ -346,7 +346,7 @@ endif
RUST_PROFILE ?= debug
ifneq ($(RUST_PROFILE),debug)
-CARGO_OPTS := --profile=$(RUST_PROFILE) --quiet
+CARGO_OPTS := --profile=$(RUST_PROFILE) --locked --quiet
else
CARGO_OPTS := --quiet
endif
diff --git a/contrib/reprobuild/Dockerfile.focal b/contrib/reprobuild/Dockerfile.focal
index e61524d4..4d960aa6 100644
--- a/contrib/reprobuild/Dockerfile.focal
+++ b/contrib/reprobuild/Dockerfile.focal
@@ -2,6 +2,7 @@ FROM focal
ENV TZ=UTC
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
+ENV SOURCE_DATE_EPOCH=1672531200
ENV RUST_PROFILE=release
ENV PATH=/root/.pyenv/shims:/root/.pyenv/bin:/root/.cargo/bin:/root/.local/bin:$PATH
ENV PROTOC_VERSION=29.4
diff --git a/contrib/reprobuild/Dockerfile.jammy b/contrib/reprobuild/Dockerfile.jammy
index b363bc3b..3f156a6f 100644
--- a/contrib/reprobuild/Dockerfile.jammy
+++ b/contrib/reprobuild/Dockerfile.jammy
@@ -2,6 +2,7 @@ FROM jammy
ENV TZ=UTC
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
+ENV SOURCE_DATE_EPOCH=1672531200
ENV RUST_PROFILE=release
ENV PATH=/root/.pyenv/shims:/root/.pyenv/bin:/root/.cargo/bin:/root/.local/bin:$PATH
ENV PROTOC_VERSION=29.4
diff --git a/contrib/reprobuild/Dockerfile.noble b/contrib/reprobuild/Dockerfile.noble
index f9c4506b..a630596b 100644
--- a/contrib/reprobuild/Dockerfile.noble
+++ b/contrib/reprobuild/Dockerfile.noble
@@ -2,6 +2,7 @@ FROM ubuntu:noble
ENV TZ=UTC
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
+ENV SOURCE_DATE_EPOCH=1672531200
ENV RUST_PROFILE=release
ENV PATH=/root/.pyenv/shims:/root/.pyenv/bin:/root/.cargo/bin:/root/.local/bin:$PATH
ENV PROTOC_VERSION=29.4
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.