doc: rc1 build-release instructions.
What the developer wrote
Authored by Rusty Russell
doc: rc1 build-release instructions.
Signing `--without-zip` will not work. You will end up with a empty SHA256SUMS file.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This is a one-line documentation fix in the release checklist. It removes the `--without-zip` flag from an example command because using that flag would produce an empty SHA256SUMS file. There is no code change and no security vulnerability.
No security action needed. Treat as a normal documentation update.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates doc/contribute-to-core-lightning/release-checklist.md to change the recommended local signing command from tools/build-release.sh --without-zip sign to tools/build-release.sh sign. The author notes that signing with --without-zip results in an empty SHA256SUMS file. This is purely a process documentation correction; no source code, build script logic, or cryptographic handling is modified.
Changed components
doc/contribute-to-core-lightning/release-checklist.mdInspect captured patch +1 / −1
diff --git a/doc/contribute-to-core-lightning/release-checklist.md b/doc/contribute-to-core-lightning/release-checklist.md
index bbf8b126..6d1a545a 100644
--- a/doc/contribute-to-core-lightning/release-checklist.md
+++ b/doc/contribute-to-core-lightning/release-checklist.md
@@ -34,7 +34,7 @@ Here's a checklist for the release process.
3. Confirm that the tag will show up for builds with `git describe`
4. Push the tag to remote `git push --tags` (pushing the tag will kickoff the "Release 🚀" CI action which builds the release targets and a draft release).
7. Run the script `contrib/cl-repro.sh` for [Builder image setup](https://docs.corelightning.org/docs/repro#builder-image-setup). This will create the required builder images `cl-repro-<codename>` for the next step.
-8. Sign the release locally by running `tools/build-release.sh --without-zip sign` which will sign the release contents and create SHA256SUMS and SHA256SUMS.asc in the release folder. Compare these with `c-lightning-<release tag>`.zip on GitHub.
+8. Sign the release locally by running `tools/build-release.sh sign` which will sign the release contents and create SHA256SUMS and SHA256SUMS.asc in the release folder. Compare these with `c-lightning-<release tag>`.zip on GitHub.
9. Check the generated draft `v<VERSION>rc1` release on Github and check `Set as a pre-release` option. Add the SHA256SUMS.asc from your local release folder to newly drafted release, replacing it.
9. Announce rc1 release on core-lightning's release-chat channel on Discord & [BuildOnL2](https://community.corelightning.org/c/general-questions/).
10. Use `devtools/credit --verbose v<PREVIOUS-VERSION>` to get commits, days and contributors data for release note.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.