docker: Dockerfile fixes after poetry to uv migration
What the developer wrote
Authored by ShahanaFarooqui
docker: Dockerfile fixes after poetry to uv migration
Cargo utilizes `git ls-remote` to resolve git dependencies specified by commit hashes. GitHub only advertises commits that are reachable from branches, tags, or PR references. The `bip353-plugin` was referencing an orphaned commit in the `bitcoin-payment-instructions` dependency that was unreachable through any advertised reference. This can be resolved by installing the tarball release v0.5.0.
Changelog-None.
What changed, and why it matters
This commit fixes Docker build problems after the project switched its Python tooling from Poetry to uv. The main change replaces a Rust dependency that was pinned to a specific orphaned Git commit with a published crate version, because GitHub no longer advertises unreachable commits. It also cleans up Dockerfile commands and environment variables so builds work again. There is no direct evidence this fixes an exploitable security vulnerability; it appears to be a build/maintenance fix.
Treat as a routine build fix. Verify the published crate bitcoin-payment-instructions 0.5.0 matches the previously intended functionality and review its changelog for any behavior changes. No urgent security patch action is indicated by the commit itself.
Security signals we found
Dependency source changed from git commit to published registry crate
Unreachable git commit could previously break deterministic builds
Dockerfile syntax and stage reference errors fixed
Evidence from the diff
The commit updates plugins/bip353-plugin/Cargo.toml and Cargo.lock to use bitcoin-payment-instructions version 0.5.0 from crates.io instead of a git revision (d071ce277…) that became unreachable via git ls-remote. Dockerfile changes move the uv installation after source copy, add CARGO_NET_GIT_FETCH_WITH_CLI=true, set a UV cache directory, remove a broken COPY of a non-existent builder-python stage, and fix a missing line-continuation syntax error. These are build-system corrections following a poetry-to-uv migration.
Changed components
plugins/bip353-plugin/Cargo.tomlCargo.lockDockerfileInspect captured patch +12 / −13
diff --git a/Cargo.lock b/Cargo.lock
index 6582b976..75f85c53 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -363,8 +363,9 @@ checksum = "0b47c4ab7a93edb0c7198c5535ed9b52b63095f4e9b45279c6736cec4b856baf"
[[package]]
name = "bitcoin-payment-instructions"
-version = "0.4.0"
-source = "git+https://github.com/rust-bitcoin/bitcoin-payment-instructions.git?rev=d071ce27734ca13be2471f81abf8699d902c3a10#d071ce27734ca13be2471f81abf8699d902c3a10"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f00d509810205bfef492f1d6cefe1e2ac35b5e66675d51642315ddc5cee0e78"
dependencies = [
"bitcoin 0.32.6",
"dnssec-prover",
diff --git a/Dockerfile b/Dockerfile
index e80f3b8e..dc2c4d10 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -90,8 +90,6 @@ RUN apt-get update -qq && \
ENV PATH="/root/.local/bin:$PATH" \
PYTHON_VERSION=3
-RUN wget -qO- https://astral.sh/uv/install.sh | sh && \
- && uv sync --all-extras --all-groups
RUN wget -q https://zlib.net/fossils/zlib-1.2.13.tar.gz -O zlib.tar.gz && \
wget -q https://www.sqlite.org/2019/sqlite-src-3290000.zip -O sqlite.zip && \
@@ -102,7 +100,9 @@ COPY . /tmp/lightning
RUN git clone --recursive /tmp/lightning . && \
git checkout $(git --work-tree=/tmp/lightning --git-dir=/tmp/lightning/.git rev-parse HEAD)
-# Do not build python plugins here, python doesn't support cross compilation.
+RUN wget -qO- https://astral.sh/uv/install.sh | sh && \
+ uv sync --all-extras --all-groups
+
WORKDIR /
FROM base-builder AS base-builder-linux-amd64
@@ -202,6 +202,10 @@ RUN mkdir /var/libpq && cp -a "$(${PG_CONFIG} --libdir)"/libpq.* /var/libpq
ENV RUST_PROFILE=release \
PATH="/root/.cargo/bin:/root/.local/bin:$PATH"
+ENV UV_CACHE_DIR=/tmp/uv-cache
+ENV CARGO_NET_GIT_FETCH_WITH_CLI=true
+ENV CARGO_NET_GIT_FETCH_WITH_CLI_ALWAYS=true
+
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y ${RUSTUP_INSTALL_OPTS}
RUN rustup toolchain install stable --component rustfmt --allow-downgrade
@@ -218,14 +222,11 @@ RUN ( ! [ "${target_host}" = "arm-linux-gnueabihf" ] ) || \
# Ensure that git differences are removed before making bineries, to avoid `-modded` suffix
RUN git reset --hard HEAD
-
RUN ./configure --prefix=/tmp/lightning_install --enable-static && uv run make install
WORKDIR /opt/lightningd
RUN echo 'RUSTUP_INSTALL_OPTS="${RUSTUP_INSTALL_OPTS}"' > /tmp/rustup_install_opts.txt
-# Copy rustup_install_opts.txt file from builder
-COPY --from=builder /tmp/rustup_install_opts.txt /tmp/rustup_install_opts.txt
# Setup ENV $RUSTUP_INSTALL_OPTS for this stage
RUN export $(cat /tmp/rustup_install_opts.txt)
ENV PATH="/root/.cargo/bin:/root/.venvs/cln/bin:$PATH"
@@ -241,7 +242,7 @@ RUN apt-get update && \
socat \
inotify-tools \
jq \
- python3 \
+ python3 && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*
@@ -262,7 +263,6 @@ RUN --mount=type=bind,from=builder,source=/var/libpq,target=/var/libpq,rw \
ldconfig
COPY --from=builder /tmp/lightning_install/ /usr/local/
-COPY --from=builder-python /root/.venvs/cln/lib/python3.11/site-packages /usr/local/lib/python3.11/dist-packages/
COPY --from=downloader /opt/bitcoin/bin /usr/bin
COPY --from=downloader /opt/litecoin/bin /usr/bin
COPY tools/docker-entrypoint.sh entrypoint.sh
diff --git a/plugins/bip353-plugin/Cargo.toml b/plugins/bip353-plugin/Cargo.toml
index b1b877fe..7d60e2b7 100644
--- a/plugins/bip353-plugin/Cargo.toml
+++ b/plugins/bip353-plugin/Cargo.toml
@@ -19,9 +19,7 @@ log-panics = "2"
cln-plugin = { version = "0.5", path = "../../plugins" }
-bitcoin-payment-instructions = { git = "https://github.com/rust-bitcoin/bitcoin-payment-instructions.git", rev = "d071ce27734ca13be2471f81abf8699d902c3a10", features = [
- "http",
-] }
+bitcoin-payment-instructions = { version = "0.5.0", features = ["http"] }
reqwest = { version = "0.11", default-features = false, features = [
"rustls-tls",
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.