From f2a7073106c5b67931a8db888ad1f4ff21fefc28 Mon Sep 17 00:00:00 2001
From: Boris Nagaev <bnagaev@gmail.com>
Date: Wed, 12 Aug 2026 23:44:52 +0000
Subject: [PATCH 1/2] build: initialize Docker release caches

Create and validate host cache directories before Docker bind mounts them.

On a fresh Go installation, Docker otherwise creates missing sources as
root. The release helper runs as the invoking user and cannot write
to those caches.
---
 Makefile              |  6 +++++-
 make/release_flags.mk | 33 +++++++++++++++++++++++++++++++--
 2 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index 91213847e..7dc53d94e 100644
--- a/Makefile
+++ b/Makefile
@@ -199,7 +199,11 @@ release: clean-mobile
 	./scripts/release.sh build-release "$(VERSION_TAG)" "$(BUILD_SYSTEM)" "$(RELEASE_TAGS)" "$(RELEASE_LDFLAGS)" "$(GO_VERSION)"
 
 #? docker-release: Same as release but within a docker container to support reproducible builds on BSD/MacOS platforms
-docker-release:
+docker-release-cache:
+	$(call check_docker_release_cache,$(DOCKER_RELEASE_GOCACHE))
+	$(call check_docker_release_cache,$(DOCKER_RELEASE_GOMODCACHE))
+
+docker-release: docker-release-cache
 	@$(call print, "Building release helper docker image.")
 	if [ "$(tag)" = "" ]; then echo "Must specify tag=<commit_or_tag>!"; exit 1; fi
 
diff --git a/make/release_flags.mk b/make/release_flags.mk
index d0631943f..7cfcc71f1 100644
--- a/make/release_flags.mk
+++ b/make/release_flags.mk
@@ -1,13 +1,42 @@
 VERSION_TAG = $(shell date +%Y%m%d)-01
 VERSION_CHECK = @$(call print, "Building master with date version tag")
 
+# Create these directories before Docker bind mounts them. Docker creates a
+# missing bind-mount source as root, which makes the cache unwritable because
+# the release helper deliberately runs as the invoking user.
+DOCKER_RELEASE_GOCACHE = $(shell bash -c 'cache="$$($(GOCC) env GOCACHE 2>/dev/null)" || cache=/tmp/go-cache; printf "%s" "$$cache"')
+DOCKER_RELEASE_GOMODCACHE = $(shell bash -c 'cache="$$($(GOCC) env GOMODCACHE 2>/dev/null)" || cache=/tmp/go-modcache; printf "%s" "$$cache"')
+
+define check_docker_release_cache
+	@cache="$(1)"; \
+	if ! mkdir -p "$$cache"; then \
+		echo "error: cannot create Docker release cache: $$cache"; \
+		exit 1; \
+	fi; \
+	cache_ok=1; \
+	for shard in $$(printf '%02x\n' $$(seq 0 255)); do \
+		shard_dir="$$cache/$$shard"; created=; \
+		if [ ! -e "$$shard_dir" ]; then \
+			mkdir "$$shard_dir" || { cache_ok=; break; }; created=1; \
+		fi; \
+		test_dir=$$(mktemp -d "$$shard_dir/.lnd-release-cache.XXXXXX" 2>/dev/null) || { cache_ok=; break; }; \
+		rmdir "$$test_dir"; \
+		if [ -n "$$created" ] && ! rmdir "$$shard_dir"; then cache_ok=; break; fi; \
+	done; \
+	if [ -z "$$cache_ok" ]; then \
+		echo "error: Docker release cache cannot create directories: $$cache"; \
+		echo "hint: remove or chown root-owned files in this cache"; \
+		exit 1; \
+	fi
+endef
+
 DOCKER_RELEASE_HELPER = docker run \
   -it \
   --rm \
   --user $(shell id -u):$(shell id -g) \
   -v $(shell pwd):/tmp/build/lnd \
-  -v $(shell bash -c "$(GOCC) env GOCACHE || (mkdir -p /tmp/go-cache; echo /tmp/go-cache)"):/tmp/build/.cache \
-  -v $(shell bash -c "$(GOCC) env GOMODCACHE || (mkdir -p /tmp/go-modcache; echo /tmp/go-modcache)"):/tmp/build/.modcache \
+  -v $(DOCKER_RELEASE_GOCACHE):/tmp/build/.cache \
+  -v $(DOCKER_RELEASE_GOMODCACHE):/tmp/build/.modcache \
   -e SKIP_VERSION_CHECK \
   lnd-release-helper
 

From ff98891ffe7d3d77170366d1673239de734abb38 Mon Sep 17 00:00:00 2001
From: Boris Nagaev <bnagaev@gmail.com>
Date: Wed, 12 Aug 2026 23:44:52 +0000
Subject: [PATCH 2/2] build: support Docker releases from Git worktrees

Mount a linked worktree's shared Git directory into the release helper
at its original path.

Its .git pointer otherwise resolves to a path absent from the container,
preventing tag checks and source archiving.
---
 make/release_flags.mk | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/make/release_flags.mk b/make/release_flags.mk
index 7cfcc71f1..b585467a8 100644
--- a/make/release_flags.mk
+++ b/make/release_flags.mk
@@ -7,6 +7,12 @@ VERSION_CHECK = @$(call print, "Building master with date version tag")
 DOCKER_RELEASE_GOCACHE = $(shell bash -c 'cache="$$($(GOCC) env GOCACHE 2>/dev/null)" || cache=/tmp/go-cache; printf "%s" "$$cache"')
 DOCKER_RELEASE_GOMODCACHE = $(shell bash -c 'cache="$$($(GOCC) env GOMODCACHE 2>/dev/null)" || cache=/tmp/go-modcache; printf "%s" "$$cache"')
 
+# A linked worktree has a .git file that points outside the worktree. Mount
+# its common Git directory at the same absolute path so tag checks and git
+# archive work inside the release helper too.
+DOCKER_RELEASE_GIT_COMMON_DIR = $(shell if [ -f .git ]; then git rev-parse --path-format=absolute --git-common-dir; fi)
+DOCKER_RELEASE_GIT_MOUNT = $(if $(DOCKER_RELEASE_GIT_COMMON_DIR),-v $(DOCKER_RELEASE_GIT_COMMON_DIR):$(DOCKER_RELEASE_GIT_COMMON_DIR):ro)
+
 define check_docker_release_cache
 	@cache="$(1)"; \
 	if ! mkdir -p "$$cache"; then \
@@ -35,6 +41,7 @@ DOCKER_RELEASE_HELPER = docker run \
   --rm \
   --user $(shell id -u):$(shell id -g) \
   -v $(shell pwd):/tmp/build/lnd \
+  $(DOCKER_RELEASE_GIT_MOUNT) \
   -v $(DOCKER_RELEASE_GOCACHE):/tmp/build/.cache \
   -v $(DOCKER_RELEASE_GOMODCACHE):/tmp/build/.modcache \
   -e SKIP_VERSION_CHECK \