tools: Read the correct default-key from gpgconf
What the developer wrote
Authored by ShahanaFarooqui
tools: Read the correct default-key from gpgconf
Workflow error `gpg: using "4129A994AA7E9852" is thrown due to incorrect gpg parsing. Update the awk parsing logic to properly locate and extract the key fingerprint within the gpgconf --list-options output structure, ensuring automated signing uses the correct key.
Changelog-None.
What changed, and why it matters
This is a one-line fix in the release build script. It changes how the script tells GnuPG which key to use when signing release checksum files. Previously the key fingerprint was accidentally passed as a filename argument to gpg, which caused a harmless workflow error and could have led to the wrong key being used for signing. The fix moves the fingerprint to the proper --default-key option so signing uses the intended key.
No immediate action for node operators. Project maintainers should verify the corrected signing command in the next release build and confirm the expected key fingerprint is selected.
Security signals we found
Incorrect GPG argument ordering could cause release artifacts to be signed with an unintended key
Fixes a release automation/workflow error
No change to Core Lightning daemon, wallet, or network code
Evidence from the diff
In tools/build-release.sh, the release signing step was invoking: gpg -sb –armor -o
Changed components
tools/build-release.sh release signing workflowInspect captured patch +1 / −1
diff --git a/tools/build-release.sh b/tools/build-release.sh
index a42f1dc..1280d79 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -228,7 +228,7 @@ if [ -z "${TARGETS##* sign *}" ]; then
echo "Signing Release"
cd release/ || exit
sha256sum clightning-"$VERSION"* > SHA256SUMS-"$VERSION"
- gpg -sb --armor -o SHA256SUMS-"$VERSION".asc "$(gpgconf --list-options gpg | awk -F: '$1 == "default-key" {print $10}' | tr -d '"')" SHA256SUMS-"$VERSION"
+ gpg -sb --armor --default-key "$(gpgconf --list-options gpg | awk -F: '$1 == "default-key" {print $10}' | tr -d '"')" -o SHA256SUMS-"$VERSION".asc SHA256SUMS-"$VERSION"
cd ..
echo "Release Signed"
fi
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.