What the developer wrote
Authored by ShahanaFarooqui
tools: Sort Fedora tar by name
And do not replace Fedora shasums from verification because Fedora binaries are deterministic now.
What changed, and why it matters
This commit changes the release build script for Core Lightning. It makes the Fedora release tarball list its files in a fixed alphabetical order and removes a workaround that copied Fedora checksums from an external source. The change improves build reproducibility and simplifies verification, but it does not appear to fix or introduce a security vulnerability.
No security action required. Treat as a normal build/release hygiene improvement. Reviewers may optionally verify that deterministic Fedora builds are indeed reproducible before relying on the removed checksum-copy fallback.
Security signals we found
No security-relevant code paths modified
No cryptographic primitives changed
No input parsing or network handling changed
Change improves release reproducibility, which is a supply-chain hygiene improvement rather than a vulnerability fix
Evidence from the diff
The patch modifies tools/build-release.sh. It replaces a non-deterministic tar command with LC_ALL=C tar –sort=name to ensure the tarball’s file listing is deterministic. It also removes the special handling of Fedora checksums because Fedora builds are now deterministic. The remaining sha256sum –check –ignore-missing call still ignores missing entries, which could mask a missing Fedora checksum, but that behavior is unchanged by this commit. There is no code change to the lightning daemon, wallet, network protocol, or cryptographic handling.
Changed components
tools/build-release.shInspect captured patch +2 / −6
diff --git a/tools/build-release.sh b/tools/build-release.sh
index 35649bfc..d59a4a7e 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -19,7 +19,7 @@ if [ "$1" = "--inside-docker" ]; then
uv run make -j"$MAKEPAR" VERSION="$VER"
uv run make -j"$MAKEPAR" install DESTDIR=/"$VER-$PLTFM-$PLTFMVER-$ARCH" RUST_PROFILE=release
cd /"$VER-$PLTFM-$PLTFMVER-$ARCH"
- tar cvfz /release/clightning-"$VER-$PLTFM-$PLTFMVER-$ARCH".tar.gz --mtime='@1672531200' -- *
+ LC_ALL=C tar --sort=name -c -v -z -f /release/clightning-"$VER-$PLTFM-$PLTFMVER-$ARCH".tar.gz --mtime='@1672531200' -- *
echo "Inside docker: build finished"
exit 0
fi
@@ -242,14 +242,10 @@ if [ "$VERIFY_RELEASE" = "true" ]; then
fi
sumfile="$(pwd)/${sumfile}"
cd release/ || exit
- # Check that the release captains sum matches. Ignore missing entries as we
- # do not have a repro build for Fedora. Strictly this is not necessary here
+ # Check that the release captains sum matches. Strictly this is not necessary here
# as we compare our checksums with the release captains checksums later, but
# it gives a direct hint which specific checksums don't match if so.
sha256sum --check --ignore-missing "${sumfile}"
- # Creating SHA256SUMS, except Fedora (copy that from theirs)
- grep 'Fedora-' "$sumfile" > SHA256SUMS
- sha256sum clightning-"$VERSION"* | grep -v 'Fedora' >> SHA256SUMS
# compare our and release captain's SHA256SUMS contents
if cmp -s SHA256SUMS "$sumfile"; then
echo "SHA256SUMS are Identical"
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.