build: appimage: fix build: bump alpine apk deps
What the developer wrote
Authored by SomberNight
build: appimage: fix build: bump alpine apk deps
note: magic incantation to clear relevant docker build cache:
```
$ docker builder prune --all
```
build log:
```
$ ./contrib/build-linux/appimage/build.sh
[...]
=> ERROR [2/6] RUN apk add --no-cache bash=5.2.37-r0 alpine-sdk=1.1-r0 util-linux=2.40.4-r1 strace=6.12-r0 file=5.46-r2 autoconf=2.72-r0 automake=1.17-r0 libtool=2.4.7-r3 xz=5.6.3-r1 eudev-dev=3.2.14-r5 gettext- 0.6s
------
> [2/6] RUN apk add --no-cache bash=5.2.37-r0 alpine-sdk=1.1-r0 util-linux=2.40.4-r1 strace=6.12-r0 file=5.46-r2 autoconf=2.72-r0 automake=1.17-r0 libtool=2.4.7-r3 xz=5.6.3-r1 eudev-dev=3.2.14-r5 gettext-dev=0.22.5-r0 linux-headers=6.6-r1 meson=1.6.1-r0 zstd-dev=1.5.6-r2 zstd-static=1.5.6-r2 zlib-dev=1.3.2-r0 zlib-static=1.3.2-r0 clang19=19.1.4-r0 musl-dev=1.2.5-r11 mimalloc2-dev=2.1.7-r0:
0.224 fetch https://dl-cdn.alpinelinux.org/alpine/v3.21/main/x86_64/APKINDEX.tar.gz
0.309 fetch https://dl-cdn.alpinelinux.org/alpine/v3.21/community/x86_64/APKINDEX.tar.gz
0.475 ERROR: unable to select packages:
0.476 xz-5.8.3-r0:
0.476 breaks: world[xz=5.6.3-r1]
0.476 satisfies: gettext-dev-0.22.5-r0[xz]
------
Dockerfile:4
--------------------
3 | # includes dependencies from https://git.alpinelinux.org/aports/tree/main/fuse3/APKBUILD
4 | >>> RUN apk add --no-cache \
5 | >>> bash=5.2.37-r0 \
6 | >>> alpine-sdk=1.1-r0 \
7 | >>> util-linux=2.40.4-r1 \
8 | >>> strace=6.12-r0 \
9 | >>> file=5.46-r2 \
10 | >>> autoconf=2.72-r0 \
11 | >>> automake=1.17-r0 \
12 | >>> libtool=2.4.7-r3 \
13 | >>> xz=5.6.3-r1 \
14 | >>> eudev-dev=3.2.14-r5 \
15 | >>> gettext-dev=0.22.5-r0 \
16 | >>> linux-headers=6.6-r1 \
17 | >>> meson=1.6.1-r0 \
18 | >>> zstd-dev=1.5.6-r2 \
19 | >>> zstd-static=1.5.6-r2 \
20 | >>> zlib-dev=1.3.2-r0 \
21 | >>> zlib-static=1.3.2-r0 \
22 | >>> clang19=19.1.4-r0 \
23 | >>> musl-dev=1.2.5-r11 \
24 | >>> mimalloc2-dev=2.1.7-r0
25 |
--------------------
ERROR: failed to solve: process "/bin/sh -c apk add --no-cache bash=5.2.37-r0 alpine-sdk=1.1-r0 util-linux=2.40.4-r1 strace=6.12-r0 file=5.46-r2 autoconf=2.72-r0 automake=1.17-r0 libtool=2.4.7-r3 xz=5.6.3-r1 eudev-dev=3.2.14-r5 gettext-dev=0.22.5-r0 linux-headers=6.6-r1 meson=1.6.1-r0 zstd-dev=1.5.6-r2 zstd-static=1.5.6-r2 zlib-dev=1.3.2-r0 zlib-static=1.3.2-r0 clang19=19.1.4-r0 musl-dev=1.2.5-r11 mimalloc2-dev=2.1.7-r0" did not complete successfully: exit code: 2
🗯 ERROR: Error building type2-runtime.
```
What changed, and why it matters
This is a routine build fix for Electrum's Linux AppImage packaging. The Alpine Linux package repository no longer offered an older version of the xz compression library, so the build script was updated to request the newer available version. There is no indication this change fixes or introduces a security vulnerability; it simply makes the automated build work again.
No security action required. Treat as normal build maintenance. Optionally verify the updated xz package hash and build reproducibility if the project has a reproducible-build policy.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates a single pinned Alpine APK dependency version in contrib/build-linux/appimage/patches/type2-runtime-reproducible-build.patch, changing xz from 5.6.3-r1 to 5.8.3-r0. The commit message and build log show the previous version was no longer satisfiable in Alpine v3.21, causing the Docker image build to fail. The patch restores build reproducibility by pinning the currently available package version.
Changed components
contrib/build-linux/appimage/patches/type2-runtime-reproducible-build.patchInspect captured patch +1 / −1
diff --git a/contrib/build-linux/appimage/patches/type2-runtime-reproducible-build.patch b/contrib/build-linux/appimage/patches/type2-runtime-reproducible-build.patch
index 28aca9b..3192d92 100644
--- a/contrib/build-linux/appimage/patches/type2-runtime-reproducible-build.patch
+++ b/contrib/build-linux/appimage/patches/type2-runtime-reproducible-build.patch
@@ -108,7 +108,7 @@ index 07b6533..fba9c6e 100644
+ autoconf=2.72-r0 \
+ automake=1.17-r0 \
+ libtool=2.4.7-r3 \
-+ xz=5.6.3-r1 \
++ xz=5.8.3-r0 \
+ eudev-dev=3.2.14-r5 \
+ gettext-dev=0.22.5-r0 \
+ linux-headers=6.6-r1 \
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.