Back to dev (#3339)

ACINQ/Eclair

ee7d9f6d View source ↗

Public commit record

What the developer wrote

Authored by Bastien Teinturier

36/100 · Opaque

Back to dev (#3339)

After the v0.14.1 release.

✓ Subject identifies a change✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body

The short version

What changed, and why it matters

This commit is a routine post-release housekeeping change. It bumps the project version from 0.14.1 to 0.15.0-SNAPSHOT, re-enables a Maven trusted-checksum feature used for build verification, adds a placeholder release-notes file, and includes a safety guard that refuses to start the development snapshot unless a special override flag is set. There is no security vulnerability in the diff itself; the startup guard is an intentional protective measure, not an exploit.

Recommended action

No security action required. This is normal release-cycle maintenance. Operators should not run SNAPSHOT builds in production; the added startup guard already enforces this unless explicitly overridden.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The commit transitions the repository back to development mode after the v0.14.1 release. Changes include: version bumps in pom.xml files to 0.15.0-SNAPSHOT; re-enabling aether.artifactResolver.postProcessor.trustedChecksums in .mvn/maven.config (it was disabled for the release and is now turned back on for normal development); creation of docs/release-notes/eclair-vnext.md as a template; and addition of a startup check in Boot.scala that throws RuntimeException unless -Declair.allow-unsafe-startup=true is provided, preventing accidental use of an unreleased snapshot in production. No code-level security defect is introduced.

Changed components

Build configuration (.mvn/maven.config, pom.xml files)Release notes template (docs/release-notes/eclair-vnext.md)Node startup logic (eclair-node/src/main/scala/fr/acinq/eclair/Boot.scala)

Inspect captured patch +74 / −6

diff --git a/.mvn/maven.config b/.mvn/maven.config
index e92391e..acf5164 100644
--- a/.mvn/maven.config
+++ b/.mvn/maven.config
@@ -2,7 +2,7 @@
 -Daether.trustedChecksumsSource.summaryFile=true
 -Daether.trustedChecksumsSource.summaryFile.basedir=${session.rootDirectory}/.mvn/checksums/
 # post processor: trusted checksums
--Daether.artifactResolver.postProcessor.trustedChecksums=false
+-Daether.artifactResolver.postProcessor.trustedChecksums=true
 -Daether.artifactResolver.postProcessor.trustedChecksums.checksumAlgorithms=SHA-256
 -Daether.artifactResolver.postProcessor.trustedChecksums.failIfMissing=true
 -Daether.artifactResolver.postProcessor.trustedChecksums.snapshots=false
diff --git a/docs/release-notes/eclair-vnext.md b/docs/release-notes/eclair-vnext.md
new file mode 100644
index 0000000..3fa7787
--- /dev/null
+++ b/docs/release-notes/eclair-vnext.md
@@ -0,0 +1,64 @@
+# Eclair vnext
+
+<insert here a high-level description of the release>
+
+## Major changes
+
+<insert changes>
+
+### Configuration changes
+
+<insert changes>
+
+### API changes
+
+<insert changes>
+
+### Miscellaneous improvements and bug fixes
+
+<insert changes>
+
+## Verifying signatures
+
+You will need `gpg` and our release signing key E04E48E72C205463. Note that you can get it:
+
+- from our website: https://acinq.co/pgp/drouinf2.asc
+- from github user @sstone, a committer on eclair: https://api.github.com/users/sstone/gpg_keys
+
+To import our signing key:
+
+```sh
+$ gpg --import drouinf2.asc
+```
+
+To verify the release file checksums and signatures:
+
+```sh
+$ gpg -d SHA256SUMS.asc > SHA256SUMS.stripped
+$ sha256sum -c SHA256SUMS.stripped
+```
+
+## Building
+
+Eclair builds are deterministic. To reproduce our builds, please use the following environment (*):
+
+- Ubuntu 24.04.1
+- Adoptium OpenJDK 21.0.6
+
+Then use the following command to generate the eclair-node packages:
+
+```sh
+./mvnw clean install -DskipTests
+```
+
+That should generate `eclair-node/target/eclair-node-<version>-XXXXXXX-bin.zip` with sha256 checksums that match the one we provide and sign in `SHA256SUMS.asc`
+
+(*) You may be able to build the exact same artefacts with other operating systems or versions of JDK 21, we have not tried everything.
+
+## Upgrading
+
+This release is fully compatible with previous eclair versions. You don't need to close your channels, just stop eclair, upgrade and restart.
+
+## Changelog
+
+<fill this section when publishing the release with `git log v0.14.1... --format=oneline --reverse`>
diff --git a/eclair-core/pom.xml b/eclair-core/pom.xml
index aea82bd..8108813 100644
--- a/eclair-core/pom.xml
+++ b/eclair-core/pom.xml
@@ -21,7 +21,7 @@
     <parent>
         <groupId>fr.acinq.eclair</groupId>
         <artifactId>eclair_2.13</artifactId>
-        <version>0.14.1</version>
+        <version>0.15.0-SNAPSHOT</version>
     </parent>
 
     <artifactId>eclair-core_2.13</artifactId>
diff --git a/eclair-front/pom.xml b/eclair-front/pom.xml
index 104870b..57dc724 100644
--- a/eclair-front/pom.xml
+++ b/eclair-front/pom.xml
@@ -21,7 +21,7 @@
     <parent>
         <groupId>fr.acinq.eclair</groupId>
         <artifactId>eclair_2.13</artifactId>
-        <version>0.14.1</version>
+        <version>0.15.0-SNAPSHOT</version>
     </parent>
 
     <artifactId>eclair-front_2.13</artifactId>
diff --git a/eclair-fuzz/pom.xml b/eclair-fuzz/pom.xml
index 402a772..42042f9 100644
--- a/eclair-fuzz/pom.xml
+++ b/eclair-fuzz/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>fr.acinq.eclair</groupId>
         <artifactId>eclair_2.13</artifactId>
-        <version>0.14.1</version>
+        <version>0.15.0-SNAPSHOT</version>
     </parent>
 
     <artifactId>eclair-fuzz_2.13</artifactId>
diff --git a/eclair-node/pom.xml b/eclair-node/pom.xml
index d2f4b56..2d16440 100644
--- a/eclair-node/pom.xml
+++ b/eclair-node/pom.xml
@@ -21,7 +21,7 @@
     <parent>
         <groupId>fr.acinq.eclair</groupId>
         <artifactId>eclair_2.13</artifactId>
-        <version>0.14.1</version>
+        <version>0.15.0-SNAPSHOT</version>
     </parent>
 
     <artifactId>eclair-node_2.13</artifactId>
diff --git a/eclair-node/src/main/scala/fr/acinq/eclair/Boot.scala b/eclair-node/src/main/scala/fr/acinq/eclair/Boot.scala
index 7e29046..1d6c4ec 100644
--- a/eclair-node/src/main/scala/fr/acinq/eclair/Boot.scala
+++ b/eclair-node/src/main/scala/fr/acinq/eclair/Boot.scala
@@ -33,6 +33,10 @@ import scala.util.{Failure, Success}
  */
 object Boot extends App with Logging {
   try {
+    if (!System.getProperty("eclair.allow-unsafe-startup", "false").toBooleanOption.contains(true)) {
+      throw new RuntimeException("This version of eclair is unsafe to use: please wait for the next official release to update your node.")
+    }
+
     val datadir = new File(System.getProperty("eclair.datadir", System.getProperty("user.home") + "/.eclair"))
     val config = NodeParams.loadConfiguration(datadir)
 
diff --git a/pom.xml b/pom.xml
index 3c44bb8..4ee8291 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,7 +20,7 @@
 
     <groupId>fr.acinq.eclair</groupId>
     <artifactId>eclair_2.13</artifactId>
-    <version>0.14.1</version>
+    <version>0.15.0-SNAPSHOT</version>
     <packaging>pom</packaging>
 
     <modules>

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

Eclair v0.14.1 release (#3338)

Disable Bolt12 recipient path fee discount (#3332)

Prevent `channel_id` collisions (#3337)