tools/build-release.sh: don't assume you need sudo to run docker.
What changed, and why it matters
This change updates the release build script so that it no longer hardcodes 'sudo' before every Docker command. Instead, a new '--sudo' flag lets the release manager opt in to using sudo only when their system requires it. The accompanying documentation is updated to mention the new flag and to adjust supported Ubuntu versions. This is a minor developer-experience and hardening improvement, not a fix for an active security vulnerability.
No urgent action needed. Maintainers who previously relied on the implicit sudo should now pass --sudo when running tools/build-release.sh. Review local Docker group membership and permissions to decide whether sudo is required.
Security signals we found
Principle of least privilege: release script no longer elevates to root by default
Reduced attack surface for build host: avoids running Docker buildx as root unless necessary
Potential prior misconfiguration risk: hardcoded sudo could have caused root-owned release artifacts or accidental privileged operations
Evidence from the diff
The patch removes the unconditional use of ‘sudo docker …’ in tools/build-release.sh and replaces it with a configurable $SUDO variable that defaults to empty. A new –sudo argument sets SUDO=sudo, restoring the previous behavior only when requested. The release checklist now instructs maintainers to pass –sudo if their Docker setup needs root, and notes that root-owned tarballs only occur in that case. The list of reproducible Ubuntu targets is also updated (dropping 18.04 and adding 24.04).
Changed components
tools/build-release.shdoc/contribute-to-core-lightning/release-checklist.mdInspect captured patch +11 / −7
diff --git a/doc/contribute-to-core-lightning/release-checklist.md b/doc/contribute-to-core-lightning/release-checklist.md
index 1ca3e669..624df560 100644
--- a/doc/contribute-to-core-lightning/release-checklist.md
+++ b/doc/contribute-to-core-lightning/release-checklist.md
@@ -64,13 +64,13 @@ Here's a checklist for the release process.
- `git pull`
- `git tag -a -s v${VERSION} -m v${VERSION}`
- `git push --tags`
-5. Run `tools/build-release.sh` to:
+5. Run `tools/build-release.sh` (with `--sudo` if you need root to run Docker) to:
- Create reproducible zipfile
- Build non-reproducible Fedora image
- - Build reproducible Ubuntu-v18.04, Ubuntu-v20.04, Ubuntu-v22.04 images. Follow [link](https://docs.corelightning.org/docs/repro#building-using-the-builder-image) for manually Building Ubuntu Images.
+ - Build reproducible Ubuntu-v20.04, Ubuntu-v22.04 and Ubuntu-v24.04 images. Follow [link](https://docs.corelightning.org/docs/repro#building-using-the-builder-image) for manually Building Ubuntu Images.
- Build Docker images for amd64 and arm64v8. Follow [link](https://docs.corelightning.org/docs/docker-images) for more details on Docker publishing.
- Create and sign checksums. Follow [link](https://docs.corelightning.org/docs/repro#co-signing-the-release-manifest) for manually signing the release.
-6. The tarballs may be owned by root, so revert ownership if necessary:
+6. If you used `--sudo`, the tarballs may be owned by root, so revert ownership if necessary:
`sudo chown ${USER}:${USER} *${VERSION}*`
7. Upload the resulting files to github and save as a draft.
(<https://github.com/ElementsProject/lightning/releases/>)
diff --git a/tools/build-release.sh b/tools/build-release.sh
index 8c1866e5..673bea70 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -26,6 +26,7 @@ fi
FORCE_UNCLEAN=false
VERIFY_RELEASE=false
WITHOUT_ZIP=false
+SUDO=
ALL_TARGETS="bin-Fedora bin-Ubuntu docker sign"
# ALL_TARGETS="bin-Fedora bin-Ubuntu tarball deb docker sign"
@@ -47,6 +48,9 @@ for arg; do
--without-zip)
WITHOUT_ZIP=true
;;
+ --sudo)
+ SUDO=sudo
+ ;;
--help)
echo "Usage: [--force-version=<ver>] [--force-unclean] [--force-mtime=YYYY-MM-DD] [--verify] [TARGETS]"
echo Known targets: "$ALL_TARGETS"
@@ -201,13 +205,13 @@ if [ -z "${TARGETS##* docker *}" ]; then
DOCKER_OPTS="$DOCKER_OPTS -t $DOCKER_USER/lightningd:latest"
DOCKER_OPTS="$DOCKER_OPTS --cache-to=type=local,dest=/tmp/docker-cache --cache-from=type=local,src=/tmp/docker-cache"
echo "Docker Options: $DOCKER_OPTS"
- if sudo docker buildx ls | grep -q 'cln-builder'; then
- sudo docker buildx use cln-builder
+ if $SUDO docker buildx ls | grep -q 'cln-builder'; then
+ $SUDO docker buildx use cln-builder
else
- sudo docker buildx create --name=cln-builder --use
+ $SUDO docker buildx create --name=cln-builder --use
fi
# shellcheck disable=SC2086
- sudo docker buildx build $DOCKER_OPTS .
+ $SUDO docker buildx build $DOCKER_OPTS .
echo "Pushed multi-platform images tagged as $VERSION and latest"
fi
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.