← Watch feed
docker: install lowdown and libsodium-dev for reproducible builds
Public commit record
73/100 · Adequate
What the developer wrote
Authored by ShahanaFarooqui
docker: install lowdown and libsodium-dev for reproducible builds
After external lowdown and libsodium-dev removal with PR #8536, we need to explicitly install them in Dockerfiles.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
What changed, and why it matters
This commit updates Docker build files to add two missing software dependencies (libsodium development files and the lowdown document converter) that were accidentally left out after an earlier cleanup. It is a build-system maintenance fix with no apparent security relevance.
Recommended action
No security action required; treat as routine build maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies four Dockerfiles and a reproducible-build checksum list. It installs libsodium-dev (or libsodium-devel on Fedora) and builds lowdown from source so that Core Lightning’s reproducible Docker builds continue to work after PR #8536 removed external copies of these dependencies. The changes are purely dependency restoration in the build environment.
Changed components
contrib/docker/Dockerfile.builder.fedoracontrib/reprobuild/Dockerfile.focalcontrib/reprobuild/Dockerfile.jammycontrib/reprobuild/Dockerfile.nobletools/repro-build.shInspect captured patch +69 / −35
diff --git a/contrib/docker/Dockerfile.builder.fedora b/contrib/docker/Dockerfile.builder.fedora
index 617467c6..7d4b903f 100644
--- a/contrib/docker/Dockerfile.builder.fedora
+++ b/contrib/docker/Dockerfile.builder.fedora
@@ -20,7 +20,17 @@ RUN dnf update -y && \
jq \
xz \
zlib-devel \
- cargo && \
+ cargo \
+ libsodium-devel && \
+ wget https://github.com/kristapsdz/lowdown/archive/refs/tags/VERSION_1_0_2.tar.gz && \
+ tar -xzf VERSION_1_0_2.tar.gz && \
+ cd lowdown-VERSION_1_0_2 && \
+ ./configure && \
+ make && \
+ make install && \
+ ldconfig && \
+ cd /tmp && \
+ rm -rf VERSION_1_0_2.tar.gz lowdown-VERSION_1_0_2 && \
dnf clean all
RUN wget https://storage.googleapis.com/c-lightning-tests/bitcoind/bitcoin-${BITCOIN_VERSION}-x86_64-linux-gnu.tar.gz \
diff --git a/contrib/reprobuild/Dockerfile.focal b/contrib/reprobuild/Dockerfile.focal
index 4d960aa6..7c716e76 100644
--- a/contrib/reprobuild/Dockerfile.focal
+++ b/contrib/reprobuild/Dockerfile.focal
@@ -11,22 +11,32 @@ RUN sed -i '/updates/d' /etc/apt/sources.list && \
sed -i '/security/d' /etc/apt/sources.list
RUN apt-get update \
- && apt-get install -y --no-install-recommends \
- autoconf \
- build-essential \
- ca-certificates \
- file \
- gettext \
- git \
- libpq-dev \
- libsodium23 \
- libtool \
- m4 \
- sudo \
- unzip \
- wget \
- git \
- zip
+ && apt-get install -y --no-install-recommends \
+ autoconf \
+ build-essential \
+ ca-certificates \
+ file \
+ gettext \
+ git \
+ libpq-dev \
+ libsodium23 \
+ libsodium-dev \
+ libtool \
+ m4 \
+ sudo \
+ unzip \
+ wget \
+ zip \
+ && cd /tmp \
+ && wget https://github.com/kristapsdz/lowdown/archive/refs/tags/VERSION_1_0_2.tar.gz \
+ && tar -xzf VERSION_1_0_2.tar.gz \
+ && cd lowdown-VERSION_1_0_2 \
+ && ./configure \
+ && make \
+ && make install \
+ && ldconfig \
+ && cd / \
+ && rm -rf /tmp/VERSION_1_0_2.tar.gz /tmp/lowdown-VERSION_1_0_2
# Ensure correct ownership
RUN chown root:root /etc/sudoers
diff --git a/contrib/reprobuild/Dockerfile.jammy b/contrib/reprobuild/Dockerfile.jammy
index 3f156a6f..dd976049 100644
--- a/contrib/reprobuild/Dockerfile.jammy
+++ b/contrib/reprobuild/Dockerfile.jammy
@@ -10,24 +10,35 @@ ENV PROTOC_VERSION=29.4
RUN sed -i '/updates/d' /etc/apt/sources.list && \
sed -i '/security/d' /etc/apt/sources.list
-RUN apt-get update \
- && apt-get install -y --no-install-recommends \
- autoconf \
- build-essential \
- ca-certificates \
- file \
- gettext \
- git \
- libsqlite3-dev \
- libpq-dev \
- libsodium23 \
- libtool \
- m4 \
- sudo \
- unzip \
- wget \
- jq \
- zip
+RUN apt-get update && \
+ apt-get install -y --no-install-recommends \
+ autoconf \
+ build-essential \
+ ca-certificates \
+ file \
+ gettext \
+ git \
+ libsqlite3-dev \
+ libpq-dev \
+ libsodium23 \
+ libsodium-dev \
+ libtool \
+ m4 \
+ sudo \
+ unzip \
+ wget \
+ jq \
+ zip \
+ && cd /tmp \
+ && wget https://github.com/kristapsdz/lowdown/archive/refs/tags/VERSION_1_0_2.tar.gz \
+ && tar -xzf VERSION_1_0_2.tar.gz \
+ && cd lowdown-VERSION_1_0_2 \
+ && ./configure \
+ && make \
+ && make install \
+ && ldconfig \
+ && cd / \
+ && rm -rf /tmp/VERSION_1_0_2.tar.gz /tmp/lowdown-VERSION_1_0_2
# Ensure correct ownership
RUN chown root:root /etc/sudoers
diff --git a/contrib/reprobuild/Dockerfile.noble b/contrib/reprobuild/Dockerfile.noble
index a630596b..8752d231 100644
--- a/contrib/reprobuild/Dockerfile.noble
+++ b/contrib/reprobuild/Dockerfile.noble
@@ -22,6 +22,8 @@ RUN apt-get update \
libsqlite3-dev \
libpq-dev \
libsodium23 \
+ libsodium-dev \
+ lowdown \
libtool \
m4 \
sudo \
diff --git a/tools/repro-build.sh b/tools/repro-build.sh
index 02cdddd1..eaebe873 100755
--- a/tools/repro-build.sh
+++ b/tools/repro-build.sh
@@ -118,6 +118,7 @@ adae5a301c7899c1bce8ae26b5423716a47e516df25c09d6d536607bc34853bc /var/cache/apt
d8b8653388e676a3ae2fcf565c2b1a42a01a1104062317f641e8d24f0eaff9c3 /var/cache/apt/archives/libpq-dev_14.2-1ubuntu1_amd64.deb
542dcee1409c74d03ecdd4ca4a0cfd467e5d2804d9985b58e39d3c5889a409e3 /var/cache/apt/archives/libpq5_14.2-1ubuntu1_amd64.deb
885ee09c37d0e37ef6042e8cb4a22ccbab92101f21ab0c8f51ae961e4484407c /var/cache/apt/archives/libsodium23_1.0.18-1build2_amd64.deb
+09584c8ab2f840bf3db4a5763f6e4b450688aa8879acd4c8f4c1942375b9ca57 /var/cache/apt/archives/libsodium-dev_1.0.18-1build2_amd64.deb
000a1d5c0df0373c75fadbfea604afb6b1325bf866a3ce637ae0138abe6d556d /var/cache/apt/archives/libsqlite3-0_3.37.2-2_amd64.deb
1b2a93020593c9e94a25f750ce442da5a6e8ff48a20f52cec92dfc3fa35336d8 /var/cache/apt/archives/linux-libc-dev_5.15.0-25.25_amd64.deb
572a544d2c18bf49d25c465720c570cd8e6e38731386ac9c0a7f29bed2486f3e /var/cache/apt/archives/m4_1.4.18-5ubuntu2_amd64.deb
Risk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.