cl: Use the reproducibly built release instead of the PPA

Also allows us to verify the integrity of the release :-)

code/docker/c-lightning/Dockerfile

@@ -1,14 +1,29 @@
 FROM lnbook/bitcoind AS c-lightning-base
 
 # Install software-properties-common to add apt repositories
-RUN apt update && apt install -yqq \
-	software-properties-common
+RUN apt-get update -qq && apt-get install -yqq \
+	wget gpg xz-utils libpq5 libsodium23
 
 # c-lightning
-ENV C_LIGHTNING_VER 0.9.3~20210120202101201901~ubuntu20.04.1
-RUN add-apt-repository -u ppa:lightningnetwork/ppa
-RUN apt-get install -yqq \
-	lightningd=${C_LIGHTNING_VER}
+ENV C_LIGHTNING_VER 0.10.1
+
+RUN cd /tmp && \
+    wget -q https://github.com/ElementsProject/lightning/releases/download/v${C_LIGHTNING_VER}/clightning-v${C_LIGHTNING_VER}-Ubuntu-20.04.tar.xz
+
+# Verify developer signatures. The `gpg --verify` command will print a
+# couple of warnings about the key not being trusted. That's ok. The
+# important part is that it doesn't error and reports "Good
+# signature".
+ADD devkeys.pem /tmp/devkeys.pem
+RUN gpg --import /tmp/devkeys.pem
+ADD https://github.com/ElementsProject/lightning/releases/download/v0.10.1/SHA256SUMS /tmp/SHA256SUMS
+ADD https://github.com/ElementsProject/lightning/releases/download/v0.10.1/SHA256SUMS.asc /tmp/SHA256SUMS.asc
+RUN cd /tmp && \
+    gpg -q --verify SHA256SUMS.asc SHA256SUMS && \
+    cat SHA256SUMS && \
+    sha256sum --ignore-missing -c SHA256SUMS
+
+RUN tar -xvf /tmp/clightning-v${C_LIGHTNING_VER}-Ubuntu-20.04.tar.xz -C /
 
 ADD https://raw.githubusercontent.com/ElementsProject/lightning/master/contrib/lightning-cli.bash-completion /usr/share/bash-completion/completions/lightning-cli