CKB System Scripts Automation and Security Requirements Epic

[doitian]

This is an Epic, please start new issue for each objective listed below.

Reproducible Docker Builder

• Provide a Dockerfile to show how we create the builder.

Security Requirements:

• The Dockerfile must verify the downloaded gcc package checksum.

Build using an existing Docker Builder image

• Ease building the scripts using a docker image.

Security Requirements:

• The build script must verify the checksum of the builder image

CI has already been setup in #15

Binary Build and Crate Publish via CI

• Do not store the binaries in the repository. Developer and CI must build the scripts into binaries by themselves.

Setup CI to automate the publishing workflow:

• Build binaries
• Run test
• Publish the Rust crate including the binaries.

Security Requirements:

• Publish the code hashes of each system scripts in the release.

[xxuejie]

The docker files are kept here: https://github.com/nervosnetwork/ckb-riscv-gnu-toolchain/tree/master/docker

And it actually uses a slightly different way: instead of downloading official gcc distribution, we are using the riscv gcc fork, which packs all the GNU toolchain in an easier way to build. For reproducible build, the docker files have some extra steps:

1. It ensures local repository does not have dirty changes.
2. It keeps a REVISION file containing the original commit from which gcc is built

This way IMO also ensures the built toolchain can be verified. Any thoughts @doitian ?