script: Poetry migration to uv for Fedora build
What the developer wrote
Authored by ShahanaFarooqui
script: Poetry migration to uv for Fedora build
Fixes current error:
```
ERROR: Invalid requirement: 'Updating dependencies': Expected end or semicolon (after name and no valid version specifier)
```
What changed, and why it matters
This commit swaps one Python packaging tool (Poetry) for another (uv) in the Fedora release build container. It fixes a broken build command that produced an invalid requirements file. There is no security vulnerability here—just a tooling fix to make release builds work again.
No security action needed. Treat as a normal build-system maintenance change; review for supply-chain hygiene if desired (e.g., pinning uv version, verifying uv source).
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch updates contrib/docker/Dockerfile.builder.fedora and tools/build-release.sh to migrate from Poetry to uv. It installs uv via pip and the cargo package, then replaces ‘poetry export –without-hashes’ with ‘uv export –format requirements.txt’ and ‘python3 -m pip install’ with ‘uv pip install’. The change addresses a build-time parsing error where Poetry’s output was being misinterpreted as a requirement named ‘Updating dependencies’.
Changed components
contrib/docker/Dockerfile.builder.fedoratools/build-release.shInspect captured patch +6 / −3
diff --git a/contrib/docker/Dockerfile.builder.fedora b/contrib/docker/Dockerfile.builder.fedora
index b49775f0..cae7ca57 100644
--- a/contrib/docker/Dockerfile.builder.fedora
+++ b/contrib/docker/Dockerfile.builder.fedora
@@ -22,9 +22,12 @@ RUN dnf update -y && \
git \
jq \
xz \
- zlib-devel && \
+ zlib-devel \
+ cargo && \
dnf clean all
+RUN python3 -m pip install uv
+
RUN wget https://bitcoincore.org/bin/bitcoin-core-$BITCOIN_VERSION/bitcoin-$BITCOIN_VERSION-x86_64-linux-gnu.tar.gz -O bitcoin.tar.gz && \
tar -xvzf bitcoin.tar.gz && \
mv bitcoin-$BITCOIN_VERSION/bin/bitcoin* /usr/local/bin/ && \
diff --git a/tools/build-release.sh b/tools/build-release.sh
index 827ecc10..3b65ac1d 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -11,8 +11,8 @@ if [ "$1" = "--inside-docker" ]; then
git config --global --add safe.directory /src/.git
git clone /src /build
cd /build || exit
- poetry export --without-hashes > /tmp/requirements.txt
- python3 -m pip install -r /tmp/requirements.txt
+ uv export --format requirements.txt > /tmp/requirements.txt
+ uv pip install -r /tmp/requirements.txt
./configure
make VERSION="$VER"
make install DESTDIR=/"$VER-$PLTFM-$PLTFMVER-$ARCH" RUST_PROFILE=release
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.