build-release: fix VERSION build-arg and add --no-push for the docker target
What the developer wrote
Authored by ShahanaFarooqui
build-release: fix VERSION build-arg and add --no-push for the docker target
Pass the computed VERSION as a build-arg, mirroring the docker-release workflow. Without it the container's VERSION is set-but-empty, `VERSION ?=` in the Makefile won't overwrite it, the git-describe fallback never runs, and `make install-program` fails with "git is required for generating version information".
Also add --no-push, so a release captain can do a full test build without publishing elementsproject/lightningd:$VERSION and :latest (the target always runs `docker buildx build --push`, since multi-arch images cannot be --load'ed into the classic docker store). The build only populates the builder's cache; a subsequent run without the flag pushes from cache quickly.
Co-Authored-By: Claude <claude@users.noreply.github.com>
What changed, and why it matters
This is a build-script bug fix, not a security vulnerability. The release script for Core Lightning was failing to pass the version number into Docker builds, which caused the build to fail with a confusing git-related error. The patch also adds a --no-push option so release builders can test the Docker build without accidentally publishing images. There is no attacker-controlled behavior or code execution risk.
No security action required. Treat as a normal build/release reliability fix.
Security signals we found
No strong security signals were identified.
Evidence from the diff
tools/build-release.sh now passes VERSION as a Docker build-arg and adds a –no-push flag. The VERSION fix aligns the local release script with the existing docker-release GitHub workflow. Without the build-arg, the Dockerfile sets VERSION to an empty value, the Makefile’s VERSION ?= default does not override it, and the git-describe fallback fails because the Docker build context lacks a git repository. The –no-push option removes --push from docker buildx build so multi-arch images can be built into the buildx cache without being published. This is a reliability/usability improvement for release engineering.
Changed components
tools/build-release.shInspect captured patch +18 / −5
diff --git a/tools/build-release.sh b/tools/build-release.sh
index 4e67f1df..fcdc8dce 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -31,6 +31,7 @@ fi
FORCE_UNCLEAN=false
VERIFY_RELEASE=false
WITHOUT_ZIP=false
+NO_PUSH=false
SUDO=
ALL_TARGETS="bin-Fedora bin-Ubuntu docker sign"
@@ -63,11 +64,14 @@ while [ $# -gt 0 ]; do
--without-zip)
WITHOUT_ZIP=true
;;
+ --no-push)
+ NO_PUSH=true
+ ;;
--sudo)
SUDO=sudo
;;
--help)
- echo "Usage: [--force-version=<ver>] [--force-unclean] [--force-mtime=YYYY-MM-DD] [--verify] [TARGETS]"
+ echo "Usage: [--force-version=<ver>] [--force-unclean] [--force-mtime=YYYY-MM-DD] [--verify] [--no-push] [TARGETS]"
echo Known targets: "$ALL_TARGETS"
echo "Example: tools/build-release.sh"
echo "Example: tools/build-release.sh --force-version=v23.05 --force-unclean --force-mtime=2023-05-01 bin-Fedora bin-Ubuntu sign"
@@ -213,9 +217,14 @@ if [ -z "${TARGETS##* docker *}" ] || [ -z "${TARGETS##* docker}" ]; then
echo "Building Docker Images"
DOCKER_USER="elementsproject"
echo "Creating multi-platform images tagged as $VERSION and latest"
- # --load does not work with multiarch. Only --push works.
- # ERROR: docker exporter does not currently support exporting manifest lists
- DOCKER_OPTS="--push --platform linux/amd64,linux/arm64,linux/arm/v7"
+ if $NO_PUSH; then
+ # Build without publishing: the result only populates the builder's
+ # cache, so a later run without --no-push pushes from cache quickly.
+ DOCKER_OPTS="--platform linux/amd64,linux/arm64,linux/arm/v7"
+ else
+ DOCKER_OPTS="--push --platform linux/amd64,linux/arm64,linux/arm/v7"
+ fi
+ DOCKER_OPTS="$DOCKER_OPTS --build-arg VERSION=$VERSION"
DOCKER_OPTS="$DOCKER_OPTS -t $DOCKER_USER/lightningd:$VERSION"
DOCKER_OPTS="$DOCKER_OPTS -t $DOCKER_USER/lightningd:latest"
DOCKER_OPTS="$DOCKER_OPTS --cache-to=type=local,dest=/tmp/docker-cache --cache-from=type=local,src=/tmp/docker-cache"
@@ -227,7 +236,11 @@ if [ -z "${TARGETS##* docker *}" ] || [ -z "${TARGETS##* docker}" ]; then
fi
# shellcheck disable=SC2086
$SUDO docker buildx build $DOCKER_OPTS .
- echo "Pushed multi-platform images tagged as $VERSION and latest"
+ if $NO_PUSH; then
+ echo "Built multi-platform images without pushing (rerun without --no-push to publish)"
+ else
+ echo "Pushed multi-platform images tagged as $VERSION and latest"
+ fi
fi
if [ -z "${TARGETS##* sign *}" ] || [ -z "${TARGETS##* sign}" ]; then
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.