← Watch feed
CI: cache the apt packages, protoc and bitcoind/elements downloads.
Public commit record
85/100 · Strong
What the developer wrote
Authored by Rusty Russell
CI: cache the apt packages, protoc and bitcoind/elements downloads.
Usually downloading and installing takes 90 seconds. But sometimes it
takes an hour! Use caching for this, to keep it consistent.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
What changed, and why it matters
This change only speeds up the project's automated testing by caching downloaded software packages (Bitcoin/Elements binaries, the protoc compiler, and Linux apt packages) between CI runs. It does not alter the Core Lightning node software that users run, does not change network or wallet behavior, and introduces no obvious security vulnerability.
Recommended action
No security action required. As a hygiene measure, the project may want to include version-specific components in the cache key (e.g., Bitcoin/Elements/protoc versions and apt cache timestamp) to avoid unexpectedly stale caches, but this is a reliability/performance concern, not a security issue.
Security signals we found
01
No changes to runtime code, protocol handling, or cryptographic operations.
02
CI-only change with no user-facing functionality.
03
Cache key is coarse (apt-${{ runner.os }}), which could lead to stale apt package caches, but apt-get update is still run and apt resolves dependencies.
04
Cached protoc zip is integrity-tested with `unzip -t` before being stored.
05
No new secrets, credentials, or network endpoints introduced.
Evidence from the diff
The commit modifies GitHub Actions CI scripts to use actions/cache@v4 for ~/ci-cache and adjusts setup.sh/install-bitcoind.sh to populate and reuse that cache for apt .deb archives, protoc zip files, and bitcoind/elementsd release tarballs. The cache key is static (apt-${{ runner.os }}), so stale cached artifacts could be reused across runs, but the same upstream binaries are still extracted/installed and apt still resolves package versions. No product code, cryptography, RPC interface, or consensus logic is touched.
Changed components
.github/scripts/install-bitcoind.sh.github/scripts/setup.sh.github/workflows/ci.yamlInspect captured patch +90 / −10
diff --git a/.github/scripts/install-bitcoind.sh b/.github/scripts/install-bitcoind.sh
index 842c6ccd..edf73474 100755
--- a/.github/scripts/install-bitcoind.sh
+++ b/.github/scripts/install-bitcoind.sh
@@ -1,4 +1,6 @@
#!/bin/sh
+# If an argument is specified, that dir is checked before downloading,
+# and updated after successful install.
set -e
@@ -18,13 +20,23 @@ cd /tmp/
# testing against `bitcoind` but still believe that we ran against
# `elementsd`.
if [ "$TEST_NETWORK" = "liquid-regtest" ]; then
- wget "https://github.com/ElementsProject/elements/releases/download/elements-${ELEMENTS_VERSION}/${EFILENAME}"
+ if [ -f "$1/${EFILENAME}" ]; then
+ cp "$1/${EFILENAME}" .
+ else
+ wget "https://github.com/ElementsProject/elements/releases/download/elements-${ELEMENTS_VERSION}/${EFILENAME}"
+ fi
tar -xf "${EFILENAME}"
+ [ "$1" = "" ] || cp "${EFILENAME}" "$1"/
sudo mv "${EDIRNAME}"/bin/* "/usr/local/bin"
rm -rf "${EFILENAME}" "${EDIRNAME}"
else
- wget "https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/${FILENAME}"
+ if [ -f "$1/${FILENAME}" ]; then
+ cp "$1/${FILENAME}" .
+ else
+ wget "https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/${FILENAME}"
+ fi
tar -xf "${FILENAME}"
+ [ "$1" = "" ] || cp "${FILENAME}" "$1"/
sudo mv "${DIRNAME}"/bin/* "/usr/local/bin"
rm -rf "${FILENAME}" "${DIRNAME}"
fi
diff --git a/.github/scripts/setup.sh b/.github/scripts/setup.sh
index 715a61da..1f5d7ce9 100755
--- a/.github/scripts/setup.sh
+++ b/.github/scripts/setup.sh
@@ -4,14 +4,14 @@ export DEBIAN_FRONTEND=noninteractive
export RUST_VERSION=stable
sudo useradd -ms /bin/bash tester
+sudo mkdir -p /var/cache/apt/archives
+mkdir -p ~/ci-cache/apt/
+sudo cp -a ~/ci-cache/apt/. /var/cache/apt/archives/ 2>/dev/null || true
+
sudo apt-get update
-# Sometimes this command stalls, so I added debug flags.
sudo apt-get install --no-install-recommends --allow-unauthenticated -yy \
- -o Debug::pkgProblemResolver=yes \
- -o Debug::Acquire::http=true \
- -o Debug::Acquire::https=true \
- -o Debug::Acquire::gpgv=true \
+ -o APT::Keep-Downloaded-Packages=true \
autoconf \
automake \
binfmt-support \
@@ -69,7 +69,7 @@ sudo apt-get install --no-install-recommends --allow-unauthenticated -yy \
echo "tester ALL=(root) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/tester
sudo chmod 0440 /etc/sudoers.d/tester
-"$(dirname "$0")"/install-bitcoind.sh
+"$(dirname "$0")"/install-bitcoind.sh ~/ci-cache/
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- \
-y --default-toolchain ${RUST_VERSION}
@@ -97,8 +97,14 @@ uv tool install poetry
PROTOC_VERSION=29.4
PB_REL="https://github.com/protocolbuffers/protobuf/releases"
-curl -LO $PB_REL/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-x86_64.zip
-sudo unzip protoc-${PROTOC_VERSION}-linux-x86_64.zip -d /usr/local/
+PROTOC_ZIP=protoc-${PROTOC_VERSION}-linux-x86_64.zip
+if [ ! -f ~/ci-cache/$PROTOC_ZIP ]; then
+ curl -LO $PB_REL/download/v${PROTOC_VERSION}/$PROTOC_ZIP
+ # Check it before we commit it to the cache!
+ unzip -t $PROTOC_ZIP
+ cp $PROTOC_ZIP ~/ci-cache/
+fi
+sudo unzip ~/ci-cache/$PROTOC_ZIP -d /usr/local/
sudo chmod a+x /usr/local/bin/protoc
export PROTOC=/usr/local/bin/protoc
export PATH=$PATH:/usr/local/bin
@@ -115,3 +121,5 @@ sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
# Add ourselves to the wireshark group (still need "sg wireshark..." for it to take effect)
sudo usermod -aG wireshark "$(id -nu)"
+# Copy archives back for caching
+cp /var/cache/apt/archives/*.deb ~/ci-cache/apt/ || true
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6f9d3297..fe1394b3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -81,6 +81,11 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - uses: actions/cache@v4
+ with:
+ path: ~/ci-cache
+ key: apt-${{ runner.os }}
+
- name: Install dependencies
env:
TEST_NETWORK: ${{ matrix.TEST_NETWORK }}
@@ -153,6 +158,11 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - uses: actions/cache@v4
+ with:
+ path: ~/ci-cache
+ key: apt-${{ runner.os }}
+
- name: Install dependencies
env:
TEST_NETWORK: ${{ matrix.TEST_NETWORK }}
@@ -203,6 +213,11 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - uses: actions/cache@v4
+ with:
+ path: ~/ci-cache
+ key: apt-${{ runner.os }}
+
- name: Install dependencies
env:
TEST_NETWORK: ${{ matrix.TEST_NETWORK }}
@@ -263,6 +278,11 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - uses: actions/cache@v4
+ with:
+ path: ~/ci-cache
+ key: apt-${{ runner.os }}
+
- name: Install dependencies
env:
TEST_NETWORK: ${{ matrix.TEST_NETWORK }}
@@ -308,6 +328,11 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - uses: actions/cache@v4
+ with:
+ path: ~/ci-cache
+ key: apt-${{ runner.os }}
+
- name: Install dependencies
env:
TEST_NETWORK: ${{ matrix.TEST_NETWORK }}
@@ -356,6 +381,11 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - uses: actions/cache@v4
+ with:
+ path: ~/ci-cache
+ key: apt-${{ runner.os }}
+
- name: Install dependencies
env:
TEST_NETWORK: ${{ matrix.TEST_NETWORK }}
@@ -442,6 +472,11 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - uses: actions/cache@v4
+ with:
+ path: ~/ci-cache
+ key: apt-${{ runner.os }}
+
- name: Install dependencies
env:
TEST_NETWORK: ${{ matrix.TEST_NETWORK }}
@@ -536,6 +571,11 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - uses: actions/cache@v4
+ with:
+ path: ~/ci-cache
+ key: apt-${{ runner.os }}
+
- name: Install dependencies
env:
TEST_NETWORK: ${{ matrix.TEST_NETWORK }}
@@ -611,6 +651,11 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - uses: actions/cache@v4
+ with:
+ path: ~/ci-cache
+ key: apt-${{ runner.os }}
+
- name: Install dependencies
run: |
bash -x .github/scripts/setup.sh
@@ -673,6 +718,11 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - uses: actions/cache@v4
+ with:
+ path: ~/ci-cache
+ key: apt-${{ runner.os }}
+
- name: Install dependencies
env:
TEST_NETWORK: ${{ matrix.TEST_NETWORK }}
@@ -730,6 +780,11 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - uses: actions/cache@v4
+ with:
+ path: ~/ci-cache
+ key: apt-${{ runner.os }}
+
- name: Install dependencies
run: |
bash -x .github/scripts/setup.sh
@@ -791,6 +846,11 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@v5
+ - uses: actions/cache@v4
+ with:
+ path: ~/ci-cache
+ key: apt-${{ runner.os }}
+
- name: Install dependencies
env:
TEST_NETWORK: ${{ matrix.TEST_NETWORK }}
Risk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.