Bitcoin Lightning Software Delivering Unpatched Binaries Despite Correct Version Report
The Bitcoin Lightning software maintainers have revealed that four image tags delivered unpatched binaries despite reporting the correct version at startup. The affected tags are v26.06.7, latest, v26.06.7-vls, and latest-vls. These images were served between August 28th at 16:04 UTC and September 1st.
The maintainers say they have replaced the faulty images and removed every tag's reference to the incorrect manifests. However, an operator who retained a faulty image cannot rely on its startup version to confirm the patch arrived.
The notice advises anyone who previously pulled one of the four tags to compare its digest against the corrected values. The correct digests are sha256:0421a5f0d1b2e1ad639edfa17d777816040e3850d91bae7f2d32186d9c1e6da4 for v26.06.7 and latest, and sha256:6a5e05c13a65613f8c0fe3830c60248a6724e7206c1c23dd26ac2e98a3e72c1f for v26.06.7-vls and latest-vls.
The maintainers have also warned that GitHub's automatically attached source-code archives are not the v26.06.7 source, so building those archives will not produce the advertised patched binaries.