reproducible builds

[mixxxbot]

Reported by: Be-ing
Date: 2017-12-31T16:55:27Z
Status: New
Importance: Wishlist
Launchpad Issue: lp1740695

---

We distribute binaries that are downloaded millions of times. We should be able to be certain that the binaries have not been compromised. We can only be sure if our builds are 100% reproducible: https://reproducible-builds.org/

[mixxxbot]

Commented by: sblaisot
Date: 2017-12-31T17:37:50Z

---

100% bit-to-bit reproductible build under windows using MSVS seems an impossible goal because the executable itself contain (at least) the build date.

[mixxxbot]

Commented by: Be-ing
Date: 2017-12-31T17:50:52Z

---

Someone made tool to fix that: https://github.com/jasonwhite/ducible

[mixxxbot]

Commented by: sblaisot
Date: 2018-01-01T14:37:51Z

---

Here are the things I can think of :

• we will need to set buildtime=0 for scons to avoid including the build date/time in the executable
  https://github.com/mixxxdj/mixxx/blob/master/src/util/version.cpp#L152,L154

• We will need to fix that: https://github.com/mixxxdj/mixxx/blob/master/src/SConscript#L59

• We need to ensure that third-party code (like included libs, qt, etc...) all have reproducible builds (remember that at least windows builds are statically linked)

• This should be seen as reproductible executables, not reproductible packages, because packaging (under windows) necessarily add some random stuff like unique GUIDs that are based on the building machine id + date/time : https://github.com/mixxxdj/mixxx/blob/master/src/SConscript#L684,L692
  Uniqueness across builds is mandatory here to ensure proper upgrade path between versions.

[mixxxbot]

Commented by: rryan
Date: 2018-05-27T17:30:03Z

---

I'm all for reproducible builds, but this is feasible for 2.2? It's quite a big project -- particularly b/c our dependencies need to be reproducible and we have a lot of dependencies.