tools: Add script to update `stable` tag on Dockerhub
What changed, and why it matters
This commit adds a new helper script that automates moving the 'latest' Docker image tag to 'stable' on Docker Hub after a waiting period. It is a release/infrastructure convenience tool, not a change to the Lightning node software itself. There is no security vulnerability in the code added.
No security action required. As a general hardening suggestion for future iterations, consider reading credentials from a secrets manager or Docker credential helper rather than plain environment variables, and avoid echoing credentials or tokens.
Security signals we found
No strong security signals were identified.
Evidence from the diff
tools/promote-stable.sh is a new bash script that logs into Docker Hub, checks how long the ‘latest’ tag of elementsproject/lightningd has existed, and optionally re-tags it as ‘stable’ using docker buildx imagetools create. It requires DOCKER_USERNAME and DOCKER_PASSWORD to be set by the operator. The script does not modify Core Lightning source code, network protocol handling, cryptography, or wallet logic.
Changed components
tools/promote-stable.shInspect captured patch +46 / −0
diff --git a/tools/promote-stable.sh b/tools/promote-stable.sh
new file mode 100644
index 00000000..f3efddd6
--- /dev/null
+++ b/tools/promote-stable.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+# DOCKER_USERNAME=<your-username> DOCKER_PASSWORD=<your-password> source ./tools/promote-stable.sh
+
+IMAGE_NAME="elementsproject/lightningd"
+MINIMUM_DAYS_BEFORE_STABLE=15
+
+if [ -z "$DOCKER_USERNAME" ] || [ -z "$DOCKER_PASSWORD" ]; then
+ echo "❌ Oops! Looks like someone forgot their Docker Hub credentials at home!"
+ echo "🔑 Please set DOCKER_USERNAME and DOCKER_PASSWORD as environment variables."
+ echo "💡 Hint: We can't log in with 'your-username' and 'your-password' (nice try though!)"
+ return 1 2>/dev/null || exit 1
+fi
+
+# Get Docker image information
+DOCKER_TOKEN=$(curl -s -H "Content-Type: application/json" -X POST -d "{\"username\": \"$DOCKER_USERNAME\", \"password\": \"$DOCKER_PASSWORD\"}" \
+ https://hub.docker.com/v2/users/login/ | jq -r .token)
+LATEST_INFO=$(curl -s -H "Authorization: JWT $DOCKER_TOKEN" https://hub.docker.com/v2/repositories/${IMAGE_NAME}/tags/latest/)
+LAST_UPDATED=$(echo "$LATEST_INFO" | jq -r .last_updated) || 0
+DAYS_OLD=$(( ($(date +%s) - $(date -d "$LAST_UPDATED" +%s)) / 86400 ))
+
+if [ $DAYS_OLD -ge $MINIMUM_DAYS_BEFORE_STABLE ]; then
+ echo "🎂 Ah, the latest tag has aged beautifully for $DAYS_OLD days, like a perfectly fermented sourdough!"
+ echo "📦 Time for its grand debut as 'stable'..."
+ echo ""
+ docker buildx imagetools create --tag $IMAGE_NAME:stable $IMAGE_NAME:latest
+ echo ""
+ echo "✅ 🎉 Congratulations! Your image has officially graduated to stable status!"
+else
+ DAYS_REMAINING=$((MINIMUM_DAYS_BEFORE_STABLE - DAYS_OLD))
+ echo "⏰ Whoa there! This latest tag is only $DAYS_OLD days old."
+ echo "🧀 It's like cheese - it needs time to mature! Wait for $DAYS_REMAINING more day(s)..."
+ read -p "❓ But hey, it's your rodeo. Still want to promote it to stable? (y/n): " -n 1 -r
+ echo ""
+
+ if [[ $REPLY =~ ^[Yy]$ ]]; then
+ echo "🤠 Living dangerously, I see! Alright, throwing caution to the wind..."
+ echo "🚀 Strapping rockets to this latest image and sending it to stable anyway!"
+ echo ""
+ docker buildx imagetools create --tag $IMAGE_NAME:stable $IMAGE_NAME:latest
+ echo ""
+ echo "✅ 💥 Done! Let's hope this doesn't come back to haunt us..."
+ else
+ echo "🎯 Smart move! Your reputation as the cautious one remains intact."
+ echo "☕ Grab a coffee, touch some grass, and revisit this in $DAYS_REMAINING day(s)."
+ fi
+fi
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.