Pin libnostr-c to v0.2.1

[kwsantiago]

libnostr-c cut v0.2.1, so the pin here is now eight commits behind a release rather than ahead of one. The scheduled drift job reports it:

FAIL privkeyio/libnostr-c is pinned to 205aaf5a but upstream's newest release is v0.2.1 (361a4917) [behind]

Moves all three locations together, which the agreement rule requires: Dockerfile.reproducible, ci.yml and release.yml.

No firmware release needed

src/nip17.c is the only shipped source that changed in that range, and this firmware does not use NIP-17. Everything else is CI, tests, docs and version manifests. v0.2.1 does carry a fail-closed fix for NIP-17 sealing on a failed RNG draw, which matters to library consumers but is not reachable from this image.

The two fixes that do matter here, the ESP32 RNG reporting failure and the FreeRTOS task-create fix, were already in the previous pin and shipped in v0.2.2.

dependencies.lock

components/libnostr-c is a component directory, so libnostr-c's own idf_component.yml is part of the manifest hash recorded in dependencies.lock. v0.2.1 bumped that manifest from 0.2.0 to 0.2.1, so the hash moves with the pin and the lock has to move with it. Only manifest_hash changes; no component version is re-resolved.

The first push omitted it and the lock guard from #152 caught exactly that, which is the behavior it was added for. The committed lock is byte-identical to what CI computed, so before and after now agree.

Verification

./scripts/check-dependency-pins.sh --strict passes after the change and failed before it. Built clean and flashed to an M5Stack CoreS3:

version: 0.2.2
rng_entropy_source: true
rng_healthy: true
rng_failed_checks: 0
self_test_passed: 4
self_test_failed: 0

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• dependencies.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e14f163d-6fb9-45fb-98b3-794cf29f4798

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The CI workflow, release workflow, and reproducible Docker build now use the pinned libnostr-c v0.2.1 commit instead of the previous reference.

Changes

libnostr-c checkout pin

Layer / File(s)	Summary
Update build checkout references .github/workflows/ci.yml, .github/workflows/release.yml, Dockerfile.reproducible	All three build paths now use commit 361a4917d8179370bbd2ffcf6dcfa573de4fb97d for libnostr-c.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• privkeyio/keep-esp32#101: Updates libnostr-c references in the CI and release workflows.
• privkeyio/keep-esp32#146: Updates libnostr-c references across the workflows and reproducible Docker build.
• privkeyio/keep-esp32#151: Updates the same libnostr-c pin in the reproducible Docker build.

Suggested reviewers: wksantiago

Poem

A rabbit pins the build just right,
With v0.2.1 shining bright.
CI hops, releases run,
Docker builds use the same one.
No drifting commits in sight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: pinning libnostr-c to version v0.2.1.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bump-libnostr-c-v0.2.1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}