What the developer wrote
Authored by Boris Nagaev
release.sh: make sure GNU gzip is used
On MacOS, the default BSD gzip produces a different output than the GNU gzip
on Linux. To ensure reproducible builds, we need to use GNU gzip.
This is similar to what we do to enforce GNU tar.
What changed, and why it matters
This change is a build-script hardening fix, not a security vulnerability. It makes the release script prefer GNU gzip over the default macOS BSD gzip so that release tarballs are byte-for-byte identical (reproducible) across different developer machines. There is no attacker-controlled behavior or user data at risk.
No security action required. Treat as a normal build/maintenance improvement. If reviewing release integrity, verify that published release tarballs remain reproducible after this change.
Security signals we found
build reproducibility tooling change
no runtime code modified
no input validation, authentication, or cryptography changes
no memory safety, concurrency, or resource exhaustion concerns
Evidence from the diff
The commit updates scripts/release.sh to detect whether the system gzip is GNU gzip, and if not, to require and use the Homebrew-provided ggzip. It then uses the selected gzip command when producing release tarballs. This is a reproducible-builds tooling change, analogous to the existing GNU tar (gtar) enforcement in the same function. It does not modify LND runtime code, cryptography, network handling, or wallet logic.
Changed components
scripts/release.shInspect captured patch +17 / −1
diff --git a/scripts/release.sh b/scripts/release.sh
index 3ae8c1e..3231ad6 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -22,6 +22,7 @@ BUILD_DATE_STAMP="202001010000.00"
function reproducible_tar_gzip() {
local dir=$1
local tar_cmd=tar
+ local gzip_cmd=gzip
# MacOS has a version of BSD tar which doesn't support setting the --mtime
# flag. We need gnu-tar, or gtar for short to be installed for this script to
@@ -38,12 +39,27 @@ function reproducible_tar_gzip() {
tar_cmd=gtar
fi
+ # On MacOS, the default BSD gzip produces a different output than the GNU
+ # gzip on Linux. To ensure reproducible builds, we need to use GNU gzip.
+ gzip_version=$(gzip --version 2>&1 || true)
+ if [[ ! "$gzip_version" =~ "GNU" ]]; then
+ if ! command -v "ggzip" >/dev/null 2>&1; then
+ echo "GNU gzip is required but cannot be found!"
+ echo "On MacOS please run 'brew install gzip' to install ggzip."
+ exit 1
+ fi
+
+ # We have ggzip installed, use that instead.
+ gzip_cmd=ggzip
+ fi
+
# Pin down the timestamp time zone.
export TZ=UTC
find "${dir}" -print0 | LC_ALL=C sort -r -z | $tar_cmd \
"--mtime=${BUILD_DATE}" --no-recursion --null --mode=u+rw,go+r-w,a+X \
- --owner=0 --group=0 --numeric-owner -c -T - | gzip -9n > "${dir}.tar.gz"
+ --owner=0 --group=0 --numeric-owner -c -T - | $gzip_cmd \
+ -9n > "${dir}.tar.gz"
rm -r "${dir}"
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.