Release 26.06.6

.version

@@ -1 +1 @@
-v26.06.2
+v26.06.6

CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [26.06.6] - 2026-07-20: "Quantum-Resistant Lightning Channel III"
+
+v26.06.3, v26.06.4, and v26.06.5 had issues during publishing with the pypi releases and were deleted.
+
+### Fixed
+
+ - update pyln-proto's coincurve to v21 to fix Python build environments
+ - reject a channel that reuses an existing funding outpoint
+
+[#9297]: https://github.com/ElementsProject/lightning/pull/9297
+[#9318]: https://github.com/ElementsProject/lightning/pull/9318
+
 ## [26.06.2] - 2026-06-25: "Quantum-Resistant Lightning Channel II"
 
 This point release if recommended for all minimal OS setups, including docker images, that have no root certificates for TLS installed.

connectd/multiplex.c

@@ -1729,7 +1729,16 @@ void peer_connect_subd(struct daemon *daemon, const u8 *msg, int fd)
 						       fmt_node_id(tmpctx, &id)));
 	}
 
-	assert(!subd->conn);
+	/* We only keep one connection per channel_id.  If one is already
+	 * attached for this channel_id, drop this fd rather than replacing
+	 * it. */
+	if (subd->conn) {
+		status_peer_debug(&id,
+				  "Already have a subd for channel_id %s: ignoring",
+				  fmt_channel_id(tmpctx, &channel_id));
+		close(fd);
+		return;
+	}
 
 	/* This sets subd->conn inside subd_conn_init, and reparents subd! */
 	io_new_conn(peer, fd, subd_conn_init, subd);

contrib/pyln-client/pyln/client/__init__.py

@@ -4,7 +4,7 @@
 from .gossmapstats import GossmapStats
 from .version import NodeVersion
 
-__version__ = "v26.06.2"
+__version__ = "v26.06.6"
 
 __all__ = [
     "LightningRpc",

contrib/pyln-client/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyln-client"
-version = "v26.06.2"
+version = "v26.06.6"
 description = "Client library and plugin library for Core Lightning"
 authors = [{ name = "Christian Decker", email = "decker.christian@gmail.com" }]
 license = { text = "BSD-MIT" }

contrib/pyln-proto/pyln/proto/__init__.py

@@ -4,7 +4,7 @@
 from .onion import OnionPayload, TlvPayload, LegacyOnionPayload
 from .wire import LightningConnection, LightningServerSocket
 
-__version__ = "v26.06.2"
+__version__ = "v26.06.6"
 
 __all__ = [
     "Invoice",

contrib/pyln-proto/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyln-proto"
-version = "v26.06.2"
+version = "v26.06.6"
 description = "This package implements some of the Lightning Network protocol in pure python. It is intended for protocol testing and some minor tooling only. It is not deemed secure enough to handle any amount of real funds (you have been warned!)."
 authors = [
     {name = "Christian Decker", email = "decker.christian@gmail.com"}
@@ -11,7 +11,7 @@ requires-python = ">=3.10,<4.0"
 dependencies = [
     "base58>=2.1.1",
     "bitstring>=4.3.0",
-    "coincurve==20.0.0",
+    "coincurve-cp314-fix>=22.0.1",
     "cryptography>=46",
     "PySocks>=1"
 ]

contrib/pyln-testing/pyln/testing/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "v26.06.2"
+__version__ = "v26.06.6"
 
 __all__ = [
     "__version__",

contrib/pyln-testing/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyln-testing"
-version = "v26.06.2"
+version = "v26.06.6"
 description = "Test your Core Lightning integration, plugins or whatever you want"
 authors = [{ name = "Christian Decker", email = "decker.christian@gmail.com" }]
 license = { text = "BSD-MIT" }

contrib/reprobuild/Dockerfile.jammy

@@ -12,23 +12,24 @@ RUN sed -i '/updates/d' /etc/apt/sources.list && \
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        autoconf \
-        build-essential \
-        ca-certificates \
-        file \
-        gettext \
-        git \
-        libsqlite3-dev \
-        libpq-dev \
-        libsodium23 \
-        libsodium-dev \
-        libtool \
-        m4 \
-        sudo \
-        unzip \
-        wget \
-        jq \
-        zip \
+    autoconf \
+    automake \
+    build-essential \
+    ca-certificates \
+    file \
+    gettext \
+    git \
+    libsqlite3-dev \
+    libpq-dev \
+    libsodium23 \
+    libsodium-dev \
+    libtool \
+    m4 \
+    sudo \
+    unzip \
+    wget \
+    jq \
+    zip \
     && cd /tmp \
     && wget https://github.com/kristapsdz/lowdown/archive/refs/tags/VERSION_1_0_2.tar.gz \
     && tar -xzf VERSION_1_0_2.tar.gz \

contrib/reprobuild/Dockerfile.noble

@@ -1,4 +1,4 @@
-FROM ubuntu:noble
+FROM noble
 
 ENV TZ=UTC
 RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
@@ -8,29 +8,31 @@ ENV PATH=/root/.pyenv/shims:/root/.pyenv/bin:/root/.cargo/bin:/root/.local/bin:$
 ENV PROTOC_VERSION=29.4
 
 RUN sed -i '/updates/d' /etc/apt/sources.list && \
-    sed -i '/security/d' /etc/apt/sources.list
+    sed -i '/security/d' /etc/apt/sources.list && \
+    sed -i 's/^deb \(.*\) noble main$/deb \1 noble main universe/' /etc/apt/sources.list
 
 RUN apt-get update \
-	&& apt-get install -y --no-install-recommends \
-	autoconf \
-	build-essential \
-	ca-certificates \
-	file \
-	gettext \
-	git \
+    && apt-get install -y --no-install-recommends \
+    autoconf \
+    automake \
+    build-essential \
+    ca-certificates \
+    file \
+    gettext \
+    git \
     curl \
     libsqlite3-dev \
-	libpq-dev \
-	libsodium23 \
+    libpq-dev \
+    libsodium23 \
     libsodium-dev \
     lowdown \
-	libtool \
-	m4 \
-	sudo \
-	unzip \
-	wget \
+    libtool \
+    m4 \
+    sudo \
+    unzip \
+    wget \
     jq \
-	zip
+    zip
 
 # Configure /repo/.git as 'safe.directory'
 RUN git config --global --add safe.directory /repo/.git

contrib/reprobuild/Dockerfile.resolute

@@ -1,4 +1,4 @@
-FROM ubuntu:resolute
+FROM resolute
 
 ENV TZ=UTC
 RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
@@ -8,11 +8,13 @@ ENV PATH=/root/.pyenv/shims:/root/.pyenv/bin:/root/.cargo/bin:/root/.local/bin:$
 ENV PROTOC_VERSION=29.4
 
 RUN sed -i '/updates/d' /etc/apt/sources.list && \
-    sed -i '/security/d' /etc/apt/sources.list
+    sed -i '/security/d' /etc/apt/sources.list && \
+    sed -i 's/^deb \(.*\) resolute main$/deb \1 resolute main universe/' /etc/apt/sources.list
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
     autoconf \
+    automake \
     build-essential \
     ca-certificates \
     file \

lightningd/channel.c

@@ -879,6 +879,18 @@ struct channel *find_channel_by_id(const struct peer *peer,
 	return NULL;
 }
 
+struct channel *find_channel_by_funding_outpoint(const struct peer *peer,
+						 const struct bitcoin_outpoint *outpoint)
+{
+	struct channel *c;
+
+	list_for_each(&peer->channels, c, list) {
+		if (bitcoin_outpoint_eq(&c->funding, outpoint))
+			return c;
+	}
+	return NULL;
+}
+
 struct channel *find_channel_by_scid(const struct peer *peer,
 				     struct short_channel_id scid)
 {

lightningd/channel.h

@@ -918,6 +918,11 @@ struct channel *channel_by_cid(struct lightningd *ld,
 struct channel *find_channel_by_id(const struct peer *peer,
 				   const struct channel_id *cid);
 
+/* Find a channel with this funding outpoint within peer (an outpoint
+ * funds at most one channel). */
+struct channel *find_channel_by_funding_outpoint(const struct peer *peer,
+						 const struct bitcoin_outpoint *outpoint);
+
 /* Find this channel within peer */
 struct channel *find_channel_by_scid(const struct peer *peer,
 				     struct short_channel_id scid);

lightningd/opening_control.c

@@ -533,6 +533,15 @@ static void opening_fundee_finished(struct subd *openingd,
 
 	derive_channel_id(&cid, &funding);
 
+	/* A funding outpoint funds at most one channel; don't accept a second
+	 * channel reusing one we already have.  Drop the connection so the
+	 * peer's open fails cleanly instead of waiting for funding_signed. */
+	if (find_channel_by_funding_outpoint(uc->peer, &funding)) {
+		force_peer_disconnect(ld, uc->peer,
+				      "Funding outpoint already in use");
+		return;
+	}
+
 	/* old_remote_per_commit not valid yet, copy valid one. */
 	channel_info.old_remote_per_commit = channel_info.remote_per_commit;
 

tools/build-release.sh

@@ -31,6 +31,7 @@ fi
 FORCE_UNCLEAN=false
 VERIFY_RELEASE=false
 WITHOUT_ZIP=false
+NO_PUSH=false
 SUDO=
 
 ALL_TARGETS="bin-Fedora bin-Ubuntu docker sign"
@@ -63,11 +64,14 @@ while [ $# -gt 0 ]; do
         --without-zip)
             WITHOUT_ZIP=true
             ;;
+        --no-push)
+            NO_PUSH=true
+            ;;
         --sudo)
             SUDO=sudo
             ;;
         --help)
-            echo "Usage: [--force-version=<ver>] [--force-unclean] [--force-mtime=YYYY-MM-DD] [--verify] [TARGETS]"
+            echo "Usage: [--force-version=<ver>] [--force-unclean] [--force-mtime=YYYY-MM-DD] [--verify] [--no-push] [TARGETS]"
             echo Known targets: "$ALL_TARGETS"
             echo "Example: tools/build-release.sh"
             echo "Example: tools/build-release.sh --force-version=v23.05 --force-unclean --force-mtime=2023-05-01 bin-Fedora bin-Ubuntu sign"
@@ -209,13 +213,18 @@ for target in $TARGETS; do
     esac
 done
 
-if [ -z "${TARGETS##* docker *}" ]; then
+if [ -z "${TARGETS##* docker *}" ] || [ -z "${TARGETS##* docker}" ]; then
     echo "Building Docker Images"
     DOCKER_USER="elementsproject"
     echo "Creating multi-platform images tagged as $VERSION and latest"
-    # --load does not work with multiarch. Only --push works.
-    # ERROR: docker exporter does not currently support exporting manifest lists
-    DOCKER_OPTS="--push --platform linux/amd64,linux/arm64,linux/arm/v7"
+    if $NO_PUSH; then
+        # Build without publishing: the result only populates the builder's
+        # cache, so a later run without --no-push pushes from cache quickly.
+        DOCKER_OPTS="--platform linux/amd64,linux/arm64,linux/arm/v7"
+    else
+        DOCKER_OPTS="--push --platform linux/amd64,linux/arm64,linux/arm/v7"
+    fi
+    DOCKER_OPTS="$DOCKER_OPTS --build-arg VERSION=$VERSION"
     DOCKER_OPTS="$DOCKER_OPTS -t $DOCKER_USER/lightningd:$VERSION"
     DOCKER_OPTS="$DOCKER_OPTS -t $DOCKER_USER/lightningd:latest"
     DOCKER_OPTS="$DOCKER_OPTS --cache-to=type=local,dest=/tmp/docker-cache --cache-from=type=local,src=/tmp/docker-cache"
@@ -227,10 +236,14 @@ if [ -z "${TARGETS##* docker *}" ]; then
     fi
     # shellcheck disable=SC2086
     $SUDO docker buildx build $DOCKER_OPTS .
-    echo "Pushed multi-platform images tagged as $VERSION and latest"
+    if $NO_PUSH; then
+        echo "Built multi-platform images without pushing (rerun without --no-push to publish)"
+    else
+        echo "Pushed multi-platform images tagged as $VERSION and latest"
+    fi
 fi
 
-if [ -z "${TARGETS##* sign *}" ]; then
+if [ -z "${TARGETS##* sign *}" ] || [ -z "${TARGETS##* sign}" ]; then
     echo "Signing Release"
     cd release/ || exit
     sha256sum clightning-"$VERSION"-*.tar.* clightning-"$VERSION".zip > SHA256SUMS-"$VERSION"

tools/reckless

@@ -21,7 +21,7 @@ from urllib.error import HTTPError
 import venv
 
 
-__VERSION__ = 'v26.06.2'
+__VERSION__ = 'v26.06.6'
 
 logging.basicConfig(
     level=logging.INFO,

tools/repro-build.sh

@@ -107,13 +107,12 @@ EOF
     Ubuntu-24.04)
 	cat > /tmp/SHASUMS <<EOF
 cc3f9f7a1e576173fb59c36652c0a67c6426feae752b352404ba92dfcb1b26c9  /var/cache/apt/archives/autoconf_2.71-3_all.deb
-5ae9a98e73545002cd891f028859941af2a3c760cb6190e635c7ef36953912de  /var/cache/apt/archives/automake_1%3a1.16.5-1.3ubuntu1_all.deb
 0e0bb8b25153ed1c44ab92bc219eed469fcb5820c5c0bc6454b2fd366a33d3ee  /var/cache/apt/archives/gcc_4%3a13.2.0-7ubuntu1_amd64.deb
-bd3e8cd6ab8cf731d8a8a15333831b9081a94ebefe22236fc8713975fe7a6d3a  /var/cache/apt/archives/libsodium-dev_1.0.18-1ubuntu0.24.04.1_amd64.deb
-5131ce3d7cdb7193bcef1b402741a0e0f436e25a50e65443fffcc7064e2cd780  /var/cache/apt/archives/libsqlite3-dev_3.45.1-1ubuntu2.5_amd64.deb
+f11b4d687a305dd7ee47a384d82a9bf04de913362df9efa67d2a029ae65051a9  /var/cache/apt/archives/libsodium-dev_1.0.18-1build3_amd64.deb
+d23577c43936fedd8c4fa1337a6e960a6e71e94ac164d7a15c46ea96bf21265d  /var/cache/apt/archives/libsqlite3-dev_3.45.1-1ubuntu2_amd64.deb
 9d1d707179675d38e024bb13613b1d99e0d33fa6c45e5f3bcba19340781781d3  /var/cache/apt/archives/libtool_2.4.7-7build1_all.deb
 1fe6a815b56c7b6e9ce4086a363f09444bbd0a0d30e230c453d0b78e44b57a99  /var/cache/apt/archives/make_4.3-4.1build2_amd64.deb
-023cbe9dbf0af87f10e54e342c67571874e412b9950d89c6cd7b010be2e67c3c  /var/cache/apt/archives/zlib1g-dev_1%3a1.3.dfsg-3.1ubuntu2.1_amd64.deb
+0b93d16d7498f092fa3070fbbad28cdbc6b3d640f1a7681b96fc37f20d1219f1  /var/cache/apt/archives/zlib1g_1%3a1.3.dfsg-3.1ubuntu2_amd64.deb
 EOF
 	;;
     Ubuntu-26.04)