From 46bdd601799d34e498688e26fa5dbbaf87a13d14 Mon Sep 17 00:00:00 2001 From: Impa10r <101550606+Impa10r@users.noreply.github.com> Date: Thu, 10 Sep 2026 17:10:12 +0200 Subject: [PATCH 1/4] Update to v23.3.4 --- 23.3.4/Dockerfile | 47 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 23.3.4/Dockerfile diff --git a/23.3.4/Dockerfile b/23.3.4/Dockerfile new file mode 100644 index 0000000..fdbdafc --- /dev/null +++ b/23.3.4/Dockerfile @@ -0,0 +1,47 @@ +FROM debian:trixie-slim AS builder + +# VERSION of Elements Core to be download +ARG VERSION=23.3.4 +ARG TARGETPLATFORM + +RUN set -ex \ + && if [ "${TARGETPLATFORM}" = "linux/amd64" ]; then export TARGETPLATFORM=x86_64-linux-gnu; fi \ + && if [ "${TARGETPLATFORM}" = "linux/arm64" ]; then export TARGETPLATFORM=aarch64-linux-gnu; fi \ + && apt-get update \ + && apt-get install -qq --no-install-recommends ca-certificates wget \ + && cd /tmp \ + && wget -qO elements.tar.gz "https://github.com/ElementsProject/elements/releases/download/elements-$VERSION/elements-$VERSION-$TARGETPLATFORM.tar.gz" \ + && mkdir bin \ + && tar -xzvf elements.tar.gz -C /tmp/bin --strip-components=2 "elements-$VERSION/bin/elements-cli" "elements-$VERSION/bin/elementsd" + +FROM debian:trixie-slim + +# $USER name, and data $DIR to be used in the `final` image +ARG USER=elements +ARG DIR=/home/elements + +COPY --from=builder "/tmp/bin" /usr/local/bin + +# NOTE: Default GID == UID == 1000 +RUN useradd -M \ + -d "$DIR/" \ + -s /usr/sbin/nologin \ + -u 1000 \ + -U \ + -c "" \ + "$USER" && \ + mkdir -p "$DIR" && \ + chown -R "$USER:$USER" "$DIR/" + +USER $USER + +# Prevents `VOLUME $DIR/.elements/` being created as owned by `root` +RUN mkdir -p "$DIR/.elements/" + +# Expose volume containing all `elementsd` data +VOLUME $DIR/.elements/ + + +ENTRYPOINT [ "elementsd" ] + + From c006112eb4e381125bc01d2261dbd0aa12a27f5a Mon Sep 17 00:00:00 2001 From: Impa10r <101550606+Impa10r@users.noreply.github.com> Date: Thu, 10 Sep 2026 17:11:22 +0200 Subject: [PATCH 2/4] Update to v23.3.4 --- .github/workflows/docker-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index eebcfc2..e4567d6 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -9,7 +9,7 @@ on: env: # TODO: Change variable to your image's name. IMAGE_NAME: elements - VERSION: "23.3.3" + VERSION: "23.3.4" jobs: # Push image to GitHub Packages. From 3cb5db73f3c1c613f38a00f1a72e854c72191b50 Mon Sep 17 00:00:00 2001 From: Impa10r <101550606+Impa10r@users.noreply.github.com> Date: Thu, 10 Sep 2026 17:27:32 +0200 Subject: [PATCH 3/4] Fix docker publish workflow --- .github/workflows/docker-publish.yml | 37 +++++++++++++--------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index e4567d6..970a27d 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -5,44 +5,41 @@ on: # Publish `master` as Docker `latest` image. branches: - master + workflow_dispatch: env: - # TODO: Change variable to your image's name. IMAGE_NAME: elements VERSION: "23.3.4" jobs: - # Push image to GitHub Packages. - # See also https://docs.docker.com/docker-hub/builds/ push: runs-on: ubuntu-latest - if: github.event_name == 'push' - env: - DOCKER_CLI_EXPERIMENTAL: "enabled" + permissions: + contents: read + packages: write steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - name: Set up QEMU - uses: docker/setup-qemu-action@v1 - + uses: docker/setup-qemu-action@v3 + - name: Set up Docker Buildx - id: buildx - uses: docker/setup-buildx-action@v1 - with: - install: true + uses: docker/setup-buildx-action@v3 - name: Login to GitHub Container Registry - uses: docker/login-action@v1 + uses: docker/login-action@v3 with: registry: ghcr.io - username: ${{ github.repository_owner }} + username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build image run: >- - docker buildx build --push - --file ./$VERSION/Dockerfile - --tag ghcr.io/vulpemventures/$IMAGE_NAME:latest - --tag ghcr.io/vulpemventures/$IMAGE_NAME:$VERSION - --platform linux/arm64,linux/amd64 . + OWNER="${GITHUB_REPOSITORY_OWNER,,}" && + docker buildx build --push + --file "./$VERSION/Dockerfile" + --build-arg "VERSION=$VERSION" + --tag "ghcr.io/$OWNER/$IMAGE_NAME:latest" + --tag "ghcr.io/$OWNER/$IMAGE_NAME:$VERSION" + --platform linux/arm64,linux/amd64 . \ No newline at end of file From e4e67d15f094fc5bcf4ff627d36ff1aebfae641d Mon Sep 17 00:00:00 2001 From: Impa10r <101550606+Impa10r@users.noreply.github.com> Date: Thu, 10 Sep 2026 19:14:08 +0200 Subject: [PATCH 4/4] Verify Elements release signature and checksum in Docker build Import Blockstream's release signing keys and check the downloaded tarball against the signed SHA256SUMS before extracting, matching the verification Blockstream's own elementsd image performs. Co-Authored-By: Claude Sonnet 5 --- 23.3.4/Dockerfile | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/23.3.4/Dockerfile b/23.3.4/Dockerfile index fdbdafc..acb2e69 100644 --- a/23.3.4/Dockerfile +++ b/23.3.4/Dockerfile @@ -4,15 +4,22 @@ FROM debian:trixie-slim AS builder ARG VERSION=23.3.4 ARG TARGETPLATFORM +ENV BYRON_PGP_KEY=710E44C2DAAE938F778744A1DE8F6EA20A661697 +ENV PABLO_PGP_KEY=BD0F3062F87842410B06A0432F656B0610604482 + RUN set -ex \ && if [ "${TARGETPLATFORM}" = "linux/amd64" ]; then export TARGETPLATFORM=x86_64-linux-gnu; fi \ && if [ "${TARGETPLATFORM}" = "linux/arm64" ]; then export TARGETPLATFORM=aarch64-linux-gnu; fi \ && apt-get update \ - && apt-get install -qq --no-install-recommends ca-certificates wget \ + && apt-get install -qq --no-install-recommends ca-certificates wget gnupg \ && cd /tmp \ - && wget -qO elements.tar.gz "https://github.com/ElementsProject/elements/releases/download/elements-$VERSION/elements-$VERSION-$TARGETPLATFORM.tar.gz" \ + && wget -q "https://github.com/ElementsProject/elements/releases/download/elements-$VERSION/elements-$VERSION-$TARGETPLATFORM.tar.gz" \ + && wget -qO SHA256SUMS.asc "https://github.com/ElementsProject/elements/releases/download/elements-$VERSION/SHA256SUMS.asc" \ + && gpg --keyserver hkps://keys.openpgp.org --recv-keys "$BYRON_PGP_KEY" "$PABLO_PGP_KEY" \ + && gpg --output SHA256SUMS --decrypt SHA256SUMS.asc \ + && grep "elements-$VERSION-$TARGETPLATFORM.tar.gz" SHA256SUMS | sha256sum -c \ && mkdir bin \ - && tar -xzvf elements.tar.gz -C /tmp/bin --strip-components=2 "elements-$VERSION/bin/elements-cli" "elements-$VERSION/bin/elementsd" + && tar -xzvf "elements-$VERSION-$TARGETPLATFORM.tar.gz" -C /tmp/bin --strip-components=2 "elements-$VERSION/bin/elements-cli" "elements-$VERSION/bin/elementsd" FROM debian:trixie-slim