docker: add a trixie docker image, update node and emsdk
What changed, and why it matters
This commit updates the project's Docker build images. It adds support for Debian Trixie, upgrades the included Node.js version from 20 to 24, updates the Emscripten SDK used for JavaScript builds, and fixes Java environment settings for both Intel/AMD and ARM processors. There are no changes to the library's actual cryptographic or wallet code.
No security action required. Treat as routine build-environment maintenance. Reviewers may optionally verify the pinned SHA-256 digest of the debian:trixie base image and the NDK zip checksum, and confirm that Node v24 and emsdk 3.1.57 are the intended versions.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit is purely build/CI infrastructure maintenance. It adds contrib/Dockerfile_trixie and contrib/trixie_deps.sh, updates Debian release labels in existing Dockerfiles (bookworm → oldstable, bullseye → oldoldstable), moves Node.js from v20 to v24, bumps emsdk to 3.1.57, removes the broken update-java-alternatives call, and parameterizes JAVA_HOME and JDK install paths by TARGETARCH. No source code, APIs, or cryptographic logic in libwally-core is modified.
Changed components
contrib/Dockerfile_bookwormcontrib/Dockerfile_bullseyecontrib/Dockerfile_trixiecontrib/trixie_deps.shInspect captured patch +96 / −2
diff --git a/contrib/Dockerfile_bookworm b/contrib/Dockerfile_bookworm
index 417fce1..c3b186f 100644
--- a/contrib/Dockerfile_bookworm
+++ b/contrib/Dockerfile_bookworm
@@ -1,5 +1,5 @@
#
-# Dockerfile for wally builds on Debian bookworm (stable).
+# Dockerfile for wally builds on Debian bookworm (oldstable).
# build from this directory with e.g:
# docker buildx build --platform linux/arm64,linux/amd64 -f Dockerfile_bullseye -t greenaddress/wallycore:bookworm .
#
diff --git a/contrib/Dockerfile_bullseye b/contrib/Dockerfile_bullseye
index 277292a..443ec30 100644
--- a/contrib/Dockerfile_bullseye
+++ b/contrib/Dockerfile_bullseye
@@ -1,5 +1,5 @@
#
-# Dockerfile for wally builds on Debian bullseye (oldstable).
+# Dockerfile for wally builds on Debian bullseye (oldoldstable).
# build from this directory with e.g:
# DOCKER_BUILDKIT=1 docker build . -t greenaddress/wallycore -f Dockerfile_bullseye
# and for linux/arm64:
diff --git a/contrib/Dockerfile_trixie b/contrib/Dockerfile_trixie
new file mode 100644
index 0000000..436e7fc
--- /dev/null
+++ b/contrib/Dockerfile_trixie
@@ -0,0 +1,16 @@
+#
+# Dockerfile for wally builds on Debian trixie (stable).
+# build from this directory with e.g:
+# DOCKER_BUILDKIT=1 docker build . -t blockstream/wallycore -f Dockerfile_trixie
+# and for linux/arm64:
+# DOCKER_BUILDKIT=1 docker build . -t blockstream/wallycore -f Dockerfile_trixie --platform linux/arm64 --build-arg TARGETARCH=arm64
+#
+FROM debian:trixie@sha256:35b8ff74ead4880f22090b617372daff0ccae742eb5674455d542bef71ef1999
+WORKDIR /root
+COPY trixie_deps.sh ./deps.sh
+COPY requirements.txt ./contrib/requirements.txt
+ARG TARGETARCH=amd64
+ENV TARGETARCH=${TARGETARCH}
+ENV JAVA_HOME=/usr/lib/jvm/java-21-openjdk-${TARGETARCH}
+RUN ./deps.sh && rm ./deps.sh
+ENV ANDROID_NDK=/opt/android-ndk-r26b
diff --git a/contrib/trixie_deps.sh b/contrib/trixie_deps.sh
new file mode 100755
index 0000000..e2d6651
--- /dev/null
+++ b/contrib/trixie_deps.sh
@@ -0,0 +1,78 @@
+#! /usr/bin/env bash
+# Install required dependencies for building wally
+# Options:
+# -e : Don't install emsdk (used for JS builds)
+# -j : Don't install Java SDK (used for Java builds)
+# -n : Don't install Android NDK (used for Android builds)
+# -w : Don't install MinGW (used for Windows cross compiles)
+set -e
+
+skip_emsdk=
+skip_ndk=
+skip_java=
+skip_windows=
+while getopts enjw name
+do
+ case $name in
+ e) skip_emsdk=1;;
+ n) skip_ndk=1;;
+ j) skip_java=1;;
+ w) skip_windows=1;;
+ *) echo "Invalid flag"; exit 1;;
+ esac
+done
+shift $(($OPTIND - 1))
+
+apt update -qq
+apt upgrade -yqq
+
+java_packages=
+if [ -z "$skip_java" ]; then
+ jdk_package="openjdk-21-jdk"
+ jdk_install_dir="java-21-openjdk-$TARGETARCH"
+ jre_package="openjdk-21-jre"
+fi
+windows_packages=
+if [ -z "$skip_windows" ]; then
+ windows_packages="g++-mingw-w64-x86-64"
+fi
+apt install --no-install-recommends unzip autoconf automake autotools-dev pkg-config build-essential libtool python3{,-dev,-pip,-virtualenv} python{,-dev}-is-python3 clang{,-format,-tidy} git swig curl cmake libssl-dev libtool-bin $jdk_package $jre_package $windows_packages valgrind jq -yqq
+
+# Note --break-system-packages to allow installing our requirements system-wide
+pip install valgrind-codequality gcovr -r contrib/requirements.txt --break-system-packages
+
+pushd /opt
+
+if [ -z "$skip_ndk" ]; then
+ curl -L -o ndk.zip https://dl.google.com/android/repository/android-ndk-r26b-linux.zip
+ echo "ad73c0370f0b0a87d1671ed2fd5a9ac9acfd1eb5c43a7fbfbd330f85d19dd632 ndk.zip" | shasum -a 256 -c
+ unzip ndk.zip
+ rm ndk.zip
+fi
+
+if [ -z "$skip_emsdk" ]; then
+ # Install node 24
+ curl -fsSL https://deb.nodesource.com/setup_24.x | bash -
+ apt install nodejs -yqq
+ # Install emsdk
+ git clone https://github.com/emscripten-core/emsdk
+ cd emsdk
+ EMSDK_VERSION=3.1.57
+ ./emsdk install ${EMSDK_VERSION}
+ ./emsdk activate ${EMSDK_VERSION}
+ # Force emsdk to use the installed node version instead of its own
+ sed -i "s/^NODE_JS = .*$/NODE_JS = 'node'/g" /opt/emsdk/.emscripten
+ # Make emsdk commands available
+ source ./emsdk_env.sh
+fi
+
+if [ -f /.dockerenv ]; then
+ # Installing dependencies into a docker image.
+ # Purge uneeded files to keep the image as small as possible.
+ apt remove --purge curl unzip -yqq
+ apt -yqq autoremove
+ apt -yqq clean
+ rm -rf /var/lib/apt/lists/* /var/cache/* /tmp/* /usr/share/locale/* /usr/share/man /usr/share/doc /lib/xtables/libip6* /root/.cache
+fi
+
+popd
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.