CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 16 Bitcoin

pyln-proto: use coincurve 21 for python <=3.13 and add self-compiled wheels for python 3.14

EPeb42ca93 View source ↗
Public commit record

What the developer wrote

Authored by daywalker90

85/100 · Strong
pyln-proto: use coincurve 21 for python <=3.13 and add self-compiled wheels for python 3.14

coincurve 20 is broken for all python versions since it now pulls in a transient dependency that turned
a warning into an error:

```
× Failed to build `coincurve==20.0.0`
├─▶ The build backend returned an error
╰─▶ Call to `hatchling.build.build_wheel` failed (exit status: 7)

[stderr]
ERROR: Use build.verbose instead of cmake.verbose for scikit-build-core >= 0.10

hint: This usually indicates a problem with the package or the build environment.
help: `coincurve` (v20.0.0) was included because `cln-meta-project` (v0.1.0) depends on `pyln-proto` (v26.6.2) which depends on `coincurve`
```

coincurve 21 does not have this issue but it does have another issue with python 3.14:

```
Resolved 1 package in 289ms
× Failed to build `coincurve==21.0.0`
├─▶ The build backend returned an error
╰─▶ Call to `hatchling.build.build_wheel` failed (exit status: 1)

[stderr]
Traceback (most recent call last):
File "<string>", line 11, in <module>
wheel_filename = backend.build_wheel("/home/user/.cache/uv/builds-v0/.tmpfcwWrQ", {}, None)
File "/home/user/.cache/uv/builds-v0/.tmpNmyA8G/lib/python3.14/site-packages/hatchling/build.py", line 58, in build_wheel
return os.path.basename(next(builder.build(directory=wheel_directory, versions=["standard"])))
~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/user/.cache/uv/builds-v0/.tmpNmyA8G/lib/python3.14/site-packages/hatchling/builders/plugin/interface.py", line 149, in build
build_hook.initialize(version, build_data)
~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
File "/home/user/.cache/uv/sdists-v9/pypi/coincurve/21.0.0/sA4L50tQMHeL37XJdHnME/src/hatch_build.py", line 34, in initialize
raise RuntimeError(message)
RuntimeError: Expected exactly one LICENSE file in cffi distribution, got 0

hint: This usually indicates a problem with the package or the build environment.
```

coincurve for python 3.14 is fixed upstream but there is no release yet, so we use self-compiled wheels just for python 3.14

Changelog-None
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
The short version

What changed, and why it matters

This change updates how the project installs a cryptographic helper library called coincurve. The old pinned version was failing to build, so the team switched to a newer official version for most Python releases and, only for Python 3.14, to pre-built wheels hosted by an individual contributor (daywalker90) while waiting for an official fix. The main risk is that Python 3.14 users now trust a third-party package index and compiled binaries instead of the official PyPI release.

Recommended action

Treat this as a supply-chain hygiene issue rather than an active vulnerability. Users building on Python 3.14 should verify the daywalker90 wheel hashes independently, prefer building coincurve from source or an audited fork, and revert to the official PyPI coincurve release once upstream publishes a fixed 3.14 wheel. Project maintainers should document the temporary nature of the third-party index and track the upstream release.

Security signals we found

01

Third-party package index introduced for Python 3.14 builds

02

Self-compiled/pre-built wheels used instead of official upstream release

03

Dependency source moved from pinned Git commit to mutable registry versions

04

No vendor security framing or CVE referenced in commit

Risk score

Why this scored 16/100

Our methodology →
Potential impact 2/30
Exploitability 2/25
Stealth signal 3/15
Affected reach 4/15
Confidence 3/10
Evidence quality 2/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from Core Lightning

Related watches

Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "doc: require Homebrew GNU make and gpatch on macOS"

This commit is a simple documentation revert. It undoes a previous change that told macOS users to install GNU make and GNU patch from Homebrew and to put those tools first in their command path. The reverted instructions now omit gpatch a…

0cfa949fby Sangbida Chaudhuri+4−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 75 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "tests: drop obsolete x-prefix in compacter-slow.sh"

This commit re-adds an old-style 'x' prefix to a string comparison in a test helper script. It is a test-only change with no effect on the actual Core Lightning node software, user funds, network behavior, or security. The change simply re…

116fd7cdby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: require Homebrew GNU make and gpatch on macOS

This commit only updates macOS installation instructions in the documentation. It tells macOS users to install newer GNU versions of 'make' and 'patch' from Homebrew because Apple's built-in tools are too old for building and running sourc…

d3ff1474by Sangbida Chaudhuri+8−41 file
No security note in commit
Open full analysis →Source commit ↗