clnrest: change utoipa to my GH branch with daywalker90's deterministic PR merged.
What the developer wrote
Authored by Rusty Russell
clnrest: change utoipa to my GH branch with daywalker90's deterministic PR merged.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: Build: release builds with tools/build-release.sh are deterministic again.
What changed, and why it matters
This commit switches a software dependency (the 'utoipa' Rust library, used by Core Lightning's REST plugin) from the official published version to a personal GitHub branch maintained by the project's own Rusty Russell. The reason given is to include another contributor's fix that makes release builds deterministic again—meaning builds from the same source code produce identical output. There is no direct evidence in the commit of a security vulnerability; the concern is that relying on an unofficial, personal fork instead of a released crate introduces supply-chain and maintenance risks.
Treat this as a supply-chain hygiene issue rather than an active vulnerability. Verify the exact git commit referenced (26f4908b092a4a746cbec935e05165852ea01289) matches the claimed upstream deterministic-build PR, monitor for an official utoipa release that includes the fix, and revert to crates.io once available. Review the fork for unexpected changes beyond the determinism patch.
Security signals we found
Dependency source changed from official crates.io registry to a personal GitHub fork
No CVE, advisory, or security disclosure referenced in commit or supplied materials
Changelog labels this as a build determinism fix, not a security fix
Pinning to a specific git commit reduces but does not eliminate supply-chain risk compared to a signed registry release
Evidence from the diff
The patch updates Cargo.lock and plugins/rest-plugin/Cargo.toml to replace crates.io-sourced utoipa, utoipa-gen, utoipa-swagger-ui, and utoipa-swagger-ui-vendored with versions from a Git repository at https://github.com/rustyrussell/utoipa.git (commit 26f4908b…). The commit message states this branch merges daywalker90’s deterministic-build pull request and that the change fixes deterministic release builds via tools/build-release.sh. The diff itself only changes package sources/checksums; no application code is modified.
Changed components
plugins/rest-plugin/Cargo.tomlCargo.lockclnrest (REST plugin)utoipa dependency treeInspect captured patch +6 / −10
diff --git a/Cargo.lock b/Cargo.lock
index 75f85c53..8e995fcc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3126,8 +3126,7 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
[[package]]
name = "utoipa"
version = "5.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fcc29c80c21c31608227e0912b2d7fddba57ad76b606890627ba8ee7964e993"
+source = "git+https://github.com/rustyrussell/utoipa.git#26f4908b092a4a746cbec935e05165852ea01289"
dependencies = [
"indexmap 2.10.0",
"serde",
@@ -3138,8 +3137,7 @@ dependencies = [
[[package]]
name = "utoipa-gen"
version = "5.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d79d08d92ab8af4c5e8a6da20c47ae3f61a0f1dabc1997cdf2d082b757ca08b"
+source = "git+https://github.com/rustyrussell/utoipa.git#26f4908b092a4a746cbec935e05165852ea01289"
dependencies = [
"proc-macro2",
"quote",
@@ -3150,8 +3148,7 @@ dependencies = [
[[package]]
name = "utoipa-swagger-ui"
version = "9.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d047458f1b5b65237c2f6dc6db136945667f40a7668627b3490b9513a3d43a55"
+source = "git+https://github.com/rustyrussell/utoipa.git#26f4908b092a4a746cbec935e05165852ea01289"
dependencies = [
"axum 0.8.4",
"base64 0.22.1",
@@ -3169,8 +3166,7 @@ dependencies = [
[[package]]
name = "utoipa-swagger-ui-vendored"
version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2eebbbfe4093922c2b6734d7c679ebfebd704a0d7e56dfcb0d05818ce28977d"
+source = "git+https://github.com/rustyrussell/utoipa.git#26f4908b092a4a746cbec935e05165852ea01289"
[[package]]
name = "valuable"
diff --git a/plugins/rest-plugin/Cargo.toml b/plugins/rest-plugin/Cargo.toml
index 32b74a4f..09b38fae 100644
--- a/plugins/rest-plugin/Cargo.toml
+++ b/plugins/rest-plugin/Cargo.toml
@@ -26,12 +26,12 @@ rcgen = "0.13"
hyper = "1"
tower= "0.5"
tower-http = { version = "0.6", features = ["cors", "set-header"] }
-utoipa = { version = "5", features = ['axum_extras'] }
+utoipa = { git = "https://github.com/rustyrussell/utoipa.git", features = ['axum_extras'] }
log-panics = "2"
socketioxide = "0.15"
cln-plugin = { version = "0.5", path = "../../plugins" }
cln-rpc = { version = "0.5", path = "../../cln-rpc" }
-utoipa-swagger-ui = { version = "9.0.0", features = ["vendored", "axum"] }
+utoipa-swagger-ui = { git = "https://github.com/rustyrussell/utoipa.git", features = ["vendored", "axum"] }
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.