docker: Added fixed SOURCE_DATE_EPOCH flag for reproducible Fedora build
What the developer wrote
Authored by ShahanaFarooqui
docker: Added fixed SOURCE_DATE_EPOCH flag for reproducible Fedora build
- Using environment variable `SOURCE_DATE_EPOCH` with fixed value will enforce a consistent timestamp for Fedora build.
. Similar to Ubuntu fix in commit https://github.com/ElementsProject/lightning/commit/490fb0fc3b55284d47f8d391a7301c857e425b68
- Locked cargo version
- Add `no-cache` to Fedora build
Changelog-Fixed: Core lightning builds for Fedora on all systems are deterministic.
What changed, and why it matters
This commit is a build-hardening change, not a security fix for a vulnerability. It makes Fedora release builds reproducible by pinning timestamps, locking the Rust compiler version, disabling a binary identifier that can vary between builds, and avoiding stale Docker cache. There is no indication it patches an exploitable flaw.
No security action required. Treat as normal build-quality/reproducibility improvement.
Security signals we found
Deterministic/reproducible build improvement
Toolchain version pinning
Build cache hygiene (--no-cache)
Evidence from the diff
The commit modifies the Fedora release build Dockerfile and build script to improve build reproducibility: sets SOURCE_DATE_EPOCH=1672531200, adds RUSTFLAGS=-C link-arg=-Wl,–build-id=none, removes the distro cargo package in favor of rustup with pinned toolchain 1.92.0, and adds –no-cache to the docker build command. These are deterministic-build improvements; no runtime code or cryptographic logic is changed, and no vulnerability is described or fixed.
Changed components
contrib/docker/Dockerfile.builder.fedoratools/build-release.shInspect captured patch +4 / −3
diff --git a/contrib/docker/Dockerfile.builder.fedora b/contrib/docker/Dockerfile.builder.fedora
index ec0c2d37..f30e1a54 100644
--- a/contrib/docker/Dockerfile.builder.fedora
+++ b/contrib/docker/Dockerfile.builder.fedora
@@ -2,6 +2,8 @@ FROM fedora:40
ENV UV_PYTHON=3.12
ENV BITCOIN_VERSION=27.1
+ENV SOURCE_DATE_EPOCH=1672531200
+ENV RUSTFLAGS="-C link-arg=-Wl,--build-id=none"
WORKDIR /tmp
@@ -20,7 +22,6 @@ RUN dnf update -y && \
jq \
xz \
zlib-devel \
- cargo \
libsodium-devel \
which \
sed \
@@ -35,7 +36,7 @@ RUN dnf update -y && \
dnf clean all
# Install Rust via rustup (for lockfile v4 support)
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.92.0
ENV PATH="/root/.cargo/bin:${PATH}"
# Install lowdown
diff --git a/tools/build-release.sh b/tools/build-release.sh
index d1b9fa41..62b409c2 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -177,7 +177,7 @@ for target in $TARGETS; do
TAG=fedora
DOCKERFILE=contrib/docker/Dockerfile.builder.fedora
FEDORA_VERSION=$(grep -oP '^FROM fedora:\K[0-9]+' "$DOCKERFILE")
- docker build -f $DOCKERFILE -t $TAG --load .
+ docker build --no-cache -f $DOCKERFILE -t $TAG --load .
docker run --rm=true -v "$(pwd)":/src:ro -v "$RELEASEDIR":/release $TAG /src/tools/build-release.sh --inside-docker "$VERSION" "$platform" "$FEDORA_VERSION" "$ARCH" "$MAKEPAR"
docker run --rm=true -w /build $TAG rm -rf /"$VERSION-$platform-$FEDORA_VERSION-$ARCH" /build
echo "Fedora Image Built"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.