Fix reprobuild

[rustyrussell]

This fixes two issues:

1. If you don't have lowdown installed, the zipfile will differ from GH (which does have it installed).
2. Rust utoipa non-determinism using our own tree on GH.

[ShahanaFarooqui]

Since we build with uv run make install, uv wraps Cargo and applies stricter rules for git dependencies. Locally, uv may resolve a dependency because the commit is already cached in .cargo/git. But in a clean CI/Docker environment, uv starts from scratch and Cargo’s fetch uses git ls-remote under the hood, so if the commit is only in GitHub’s object DB but not referenced by any ref (branch, tag, or PR ref), Cargo fails with revspec '<commit-id>' not found.

To prevent the Docker image publishing issue again which we encountered with CLN v25.09 (resolved in #8531 by installing the released crate directly), we must ensure that installing utoipa from our own git tree does not introduce a similar build failure.

[daywalker90]

So, tag the commit and add it to Cargo.toml:

utoipa = { git = "https://github.com/rustyrussell/utoipa.git", features = ['axum_extras'], tag = "mytag" }
utoipa-swagger-ui = { git = "https://github.com/rustyrussell/utoipa.git", features = ["vendored", "axum"], tag = "mytag" }

?

[ShahanaFarooqui]

So, tag the commit and add it to Cargo.toml:

utoipa = { git = "https://github.com/rustyrussell/utoipa.git", features = ['axum_extras'], tag = "mytag" }
utoipa-swagger-ui = { git = "https://github.com/rustyrussell/utoipa.git", features = ["vendored", "axum"], tag = "mytag" }

?

I also tried that with the other library (bitcoin-payment-instructions). It works when building the Docker image locally, but fails in GitHub Actions. Whether I use a commit SHA, tag, or branch, it builds fine locally but still fails in the Docker publishing workflow.

[daywalker90]

But why?, git ls-remote does list tag commits.

[ShahanaFarooqui]

Running docker buildx directly successfully creates the image, but when invoked through build-release.sh, the build context changes and uv/Cargo fail to resolve the commit. We can reproduce the workflow error locally with tools/build-release.sh --force-version=v25.09.dummy --force-unclean --force-mtime=2025-09-03 docker command:

...
344.9 PYTHONPATH=contrib/msggen python3 contrib/msggen/msggen/__main__.py bundle doc/schemas
345.0 Combining schemas from /opt/lightningd/doc/schemas into /opt/lightningd/contrib/msggen/msggen/schema.json
345.0 Created /opt/lightningd/contrib/msggen/msggen/schema.json from 2 files
345.0 msggen cln-rpc/src/model.rs
345.3 cargo build --profile=release --quiet --bin cln-grpc
345.5 warning: `/opt/lightningd/.cargo/config` is deprecated in favor of `config.toml`
345.5 note: if you need to support cargo 1.38 or earlier, you can symlink `config` to `config.toml`
411.3 error: failed to get `utoipa` as a dependency of package `clnrest v0.2.0 (/opt/lightningd/plugins/rest-plugin)`
411.4 
411.4 Caused by:
411.4   failed to load source for dependency `utoipa`
411.4 
411.4 Caused by:
411.4   Unable to update https://github.com/rustyrussell/utoipa.git#26f4908b
411.4 
411.4 Caused by:
411.4   revspec '26f4908b092a4a746cbec935e05165852ea01289' not found; class=Reference (4); code=NotFound (-3)
411.4 make: *** [plugins/Makefile:313: target/release/cln-grpc] Error 101
411.4 rm external/build-arm-linux-gnueabihf/libwally-core-build/src/secp256k1/libsecp256k1.la
------
Dockerfile:225
--------------------
 223 |     # Ensure that git differences are removed before making bineries, to avoid `-modded` suffix
 224 |     RUN git reset --hard HEAD
 225 | >>> RUN ./configure --prefix=/tmp/lightning_install --enable-static && uv run make install
 226 |     
 227 |     WORKDIR /opt/lightningd
--------------------
ERROR: failed to solve: process "/bin/sh -c ./configure --prefix=/tmp/lightning_install --enable-static && uv run make install" did not complete successfully: exit code: 2

[ShahanaFarooqui]

But why?, git ls-remote does list tag commits.

Agree, git ls-remote is working when invoked directly but somehow is failing with the changed context in the script/workflow.

[daywalker90]

Hmpf, this has to be some differently configured git i think.
So either figure out that or run cargo fetch --locked before going inside docker and copy the .cargo cache into the docker env?

[ShahanaFarooqui]

I created a local branch repro-utoipa-git-tree to reproduce/test this issue. It contains only the utoipa update from this PR in commit cf1a92c. And the GitHub Action 17435823432 failed with the following error:

 > [linux/amd64 builder 12/17] RUN ./configure --prefix=/tmp/lightning_install --enable-static && uv run make install:
239.2 Caused by:
239.2   failed to load source for dependency `utoipa`
239.2 
239.2 Caused by:
239.2   Unable to update https://github.com/rustyrussell/utoipa.git#26f4908b
239.2 
239.2 Caused by:
239.2   revspec '26f4908b092a4a746cbec935e05165852ea01289' not found; class=Reference (4); code=NotFound (-3)
239.2 make: *** [plugins/Makefile:313: target/release/cln-grpc] Error 101

@rustyrussell Could you please tag this commit in your fork? I attempted to do it myself but received a 403: forbidden error. I can test again once the tag is available.