tools: insist on lowdown for zipfile.
What the developer wrote
Authored by Rusty Russell
tools: insist on lowdown for zipfile.
On GitHub where we build the zipfile, it exists, so we don't check out
the submodule. If you do, your zipfile won't match!
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit is a build-script hardening change, not a fix for an exploitable vulnerability. It makes the release-zip build process fail early if the 'lowdown' tool is missing, so that different developers or CI environments don't accidentally produce release zip files with different contents. That reproducibility problem could in theory allow someone to ship a tampered release by claiming it was built without lowdown, but the commit itself does not describe any such attack and there is no direct evidence of one.
No urgent action required. Treat as a normal build hygiene improvement. If auditing release artifacts, verify that published zipfiles were built on an environment with lowdown present and that checksums match the reproducible build expectations.
Security signals we found
Build reproducibility / deterministic release artifact concern
No runtime security boundary changed
No cryptographic, network, or parsing code modified
No CVE, advisory, researcher credit, or vendor security statement present
Evidence from the diff
The patch adds a guard in tools/build-release.sh: after running ./configure –reconfigure it greps config.vars for HAVE_LOWDOWN=1 and aborts with ‘Please install lowdown’ if the marker is absent. The stated goal is to ensure release zipfiles are deterministic regardless of whether the lowdown submodule is checked out. The change is defensive and improves build reproducibility; it does not modify runtime code, cryptography, network handling, or privilege boundaries.
Changed components
tools/build-release.shInspect captured patch +2 / −0
diff --git a/tools/build-release.sh b/tools/build-release.sh
index fb647890..af215516 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -127,6 +127,8 @@ if [ "$WITHOUT_ZIP" = "false" ]; then
# submodcheck needs to know if we have lowdown
touch config.vars
./configure --reconfigure
+ # If you don't have lowdown, your zip file will include it: we assume everyone has it now!
+ grep -q "HAVE_LOWDOWN=1" config.vars || (echo "Please install lowdown" >&2; exit 1)
# If it's a completely clean directory, we need submodules!
make submodcheck
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.