Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version
The Bitcoin Lightning software program’s maintainers say 4 picture tags delivered unpatched binaries whereas reporting version v26.06.7 at startup, leaving affected customers with one other activity: verify the picture digest and obtain a corrected picture if it differs.
Some Core Lightning operators who tried the v26.06.7 improve by means of Docker should be lacking its safety fixes.
The updated release notice identifies the affected tags as v26.06.7, newest, v26.06.7-vls and latest-vls. They served photos with out the discharge’s fixes between Aug. 28 at 16:04 UTC and Sept. 1. The discover provides no exact finish time.
An automated construct course of printed the photographs from a placeholder tag. Maintainers say they’ve changed them and eliminated each tag’s reference to the wrong manifests. But an operator who retained a defective picture can not depend on its startup version to verify the patch arrived.
The Aug. 28 launch set a 14-day embargo on publishing its supply, pointing to a deliberate Sept. 11 disclosure. As of Sept. 8, the discover nonetheless describes that publication as upcoming. Maintainers say the delay provides operators time to improve earlier than potential attackers can reverse-engineer the fixes.
How to verify the Docker picture to repair the Lightning bug
Maintainers ask anybody who beforehand pulled one of many 4 tags to check its digest, the picture’s figuring out hash, in opposition to the corrected values:
| Docker tags | Corrected digest |
|---|---|
| v26.06.7, newest | sha256:0421a5f0d1b2e1ad639edfa17d777816040e3850d91bae7f2d32186d9c1e6da4 |
| v26.06.7-vls, latest-vls | sha256:6a5e05c13a65613f8c0fe3830c60248a6724e7206c1c23dd26ac2e98a3e72c1f |
For the usual versioned picture, the discover provides this command to examine the native picture. Its output alone doesn’t set up which picture an current container is operating:
docker picture examine --format '{{index .RepoDigests 0}}' elementsproject/lightningd:v26.06.7If the digest differs, its corresponding obtain command is:
docker pull elementsproject/lightningd:v26.06.7The discover additionally provides docker pull elementsproject/lightningd:newest for that tag. VLS customers want the separate VLS digest within the desk. Their VLS_CLN_VERSION setting should additionally match v26.06.7, or remote_hsmd_socket will refuse to begin; the signer itself stays VLS v0.14.0.
Users pinned to v26.06.6 or earlier escaped this packaging mistake. The exemption issues the defective packaging; the brand new safety fixes belong to v26.06.7.
The packaging correction adjustments the operator’s fast drawback of an tried improve could should be checked once more whereas that window stays open.
Another obtain entice exists in the course of the embargo. GitHub’s robotically hooked up source-code archives will not be the v26.06.7 supply, maintainers warn, so constructing these archives won’t produce the marketed patched binaries.
The submit Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version appeared first on CryptoSlate.
