Verify that build is reproducible #21733

wendigo · 2024-04-27T13:18:49Z

No description provided.

hboutemy · 2024-04-28T07:41:51Z

great approach
notice that given the 2 builds happen on the exact same environment, you won't detect any impact of hostname, username, current directory: it should be easy and very valuable to do the second build from a renamed directory to detect if any current directory is used (that's what happens the most in real life)

wendigo · 2024-04-28T10:20:31Z

@hboutemy I agree. I happen to know that the build is not username/hostname/current directory sensitive, because I've tested that manually but I don't know how to test that in the CI in a reliable way without pushing artifacts somewhere for other runner node to pick it up. I could use github caching for that I guess.

hboutemy · 2024-04-29T05:46:07Z

yes, finding a reasonably simple setup is key: one way is to compare a local build against a local build done in a container

or just accept that CI won't absolutely check everything :)

.github/workflows/ci.yml

findepi · 2024-04-29T12:11:14Z

.github/workflows/ci.yml

+          cache: 'false'
+          cleanup-node: true
+      - name: First build to a local repository
+        # All dependencies are downloaded to and artifacts generated to build_1 directory, .m2 isn't used


.m2 -> ~/.m2/repository (in particular, i assume other files from ~/.m2 may still be used)

isn't used -> isn't used because ...

.github/workflows/ci.yml

findepi · 2024-04-29T12:11:48Z

.github/workflows/ci.yml

+          ref: |
+            ${{ github.event_name == 'repository_dispatch' &&
+                github.event.client_payload.pull_request.head.sha == github.event.client_payload.slash_command.args.named.sha &&
+                format('refs/pull/{0}/head', github.event.client_payload.pull_request.number) || '' }}


@nineinchnick review this

.github/workflows/ci.yml

findepi · 2024-04-29T12:13:35Z

.github/workflows/ci.yml

+          diff \
+              --exclude=maven-metadata-local.xml \
+              --exclude=_remote.repositories \
+              --exclude="*.lastUpdated" \


i think we should be comparing only the stuff produced by the build -- ie our binaries
we should not touch binaries downloaded from internet, or metadata files about such downloads

hence the diff on the io/trino

martint · 2024-04-29T14:46:52Z

How much time does this add to the build/CI?

wendigo · 2024-04-29T14:51:50Z

@martint around 12 17 minutes

wendigo · 2024-04-29T17:23:03Z

@martint we can run this only on master if we want to save some time.

electrum · 2024-05-02T23:01:51Z

.github/workflows/ci.yml

+      - name: Compare builds
+        run: |
+          diff \
+              `# Excluding maven metadata files - downloaded dependencies and generated artifacts should be exactly the same` \


Make this a YAML comment above the run command? Having it as a shells script comment looks weird to me

electrum · 2024-05-02T23:06:02Z

.github/workflows/ci.yml

+              --exclude=_remote.repositories \
+              --exclude="*.lastUpdated" \
+              --exclude="resolver-status.properties" \
+              -bur build_1/io/trino build_2/io/trino


Move the -bur above, so that it's easier to see what this command is during. I also prefer to make them separate args for readability:

diff -r -u -b \ --exclude ... \ build_1/io/trino build_2/io/trino

Could also remove the duplication

{build_1,build2}/io/trino

Why do we need the -b flag? What text files do we have, other than POMs? I assume the primary goal here is to compare the binary JAR files.

electrum · 2024-05-02T23:09:59Z

.github/workflows/ci.yml

+          cache: false # cache not used, dependencies will be downloaded to `maven.repo.local`
+          cleanup-node: true # not enough space to fetch dependencies and build twice
+      - name: First build to a local repository
+        # ~/.m2/repository isn't used because we are using `maven.repo.local` to store all downloaded dependencies and generated artifacts


How about moving this comment above, so that it's shared. We could also reword this to describe what we are doing here:

# Build twice, using `maven.repo.local` to specify a unique local repository for each build. # ~/.m2/repository is not used here, as the downloaded dependencies and generated artifacts use the specified repo. - name: First build to a local repository run: ... - name: Second build to a local repository run: ...

github-actions · 2024-05-24T17:02:46Z

This pull request has gone a while without any activity. Tagging the Trino developer relations team: @bitsondatadev @colebow @mosabua

hboutemy · 2024-05-25T09:26:35Z

I just added an independent rebuild comparison: https://github.com/jvm-repo-rebuild/reproducible-central/tree/master/content/io/trino (README will be generated tonight)
result is really good: only 1 different file = the rpm file, that at least contains the hostname of the machine creating it https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/io/trino/trino-root-448.diffoscope

wendigo · 2024-05-25T10:00:04Z

@hboutemy thanks for letting me know. I'll try to fix the rpm to be independent of the hostname

wendigo · 2024-05-25T10:04:37Z

@hboutemy this will fix the rpm: #22135

electrum · 2024-05-26T01:20:37Z

@hboutemy It is merged now and will be in the 449 release

wendigo · 2024-06-01T09:38:47Z

@hboutemy 449 is out. Can you try it?

wendigo · 2024-06-01T10:34:41Z

Oh, I can see that it was already updated: https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/io/trino/trino-root-449.buildcompare

hboutemy · 2024-06-01T21:33:49Z

@wendigo yes, batch is now over, result is visible in READMEhttps://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/io/trino/README.md
congrats, release 449 is confirmed fully reproducible! you can add your badge :)

wendigo · 2024-06-03T08:40:28Z

@hboutemy show me the badge :)

nineinchnick · 2024-06-03T08:45:11Z

https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/doc/TOOLS.md#4-add-reproducible-builds-badge-to-a-project-with-reproducible-releases

Which artifacts should we use, io.trino:trino-server?

This displays as:

[![Reproducible Builds](https://img.shields.io/badge/Reproducible_Builds-ok-success?labelColor=1e5b96)](https://github.com/jvm-repo-rebuild/reproducible-central#io.trino:trino-root)

hboutemy · 2024-06-05T04:36:24Z

IMHO, better link to https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/io/trino/README.md

wendigo · 2024-06-05T05:44:56Z

@hboutemy that's what I've added to readme :)

cla-bot bot added the cla-signed label Apr 27, 2024

wendigo requested review from nineinchnick, findepi and electrum April 27, 2024 13:38

findepi reviewed Apr 29, 2024

View reviewed changes

.github/workflows/ci.yml Outdated Show resolved Hide resolved

.github/workflows/ci.yml Outdated Show resolved Hide resolved

.github/workflows/ci.yml Outdated Show resolved Hide resolved

wendigo force-pushed the serafin/reproducible-build-test branch from b4b2317 to ea40fc0 Compare April 29, 2024 11:47

wendigo requested a review from findepi April 29, 2024 12:01

findepi reviewed Apr 29, 2024

View reviewed changes

wendigo force-pushed the serafin/reproducible-build-test branch from ea40fc0 to 67567b7 Compare April 29, 2024 12:25

Verify that build is reproducible

2d8c460

wendigo force-pushed the serafin/reproducible-build-test branch from 67567b7 to 2d8c460 Compare April 29, 2024 13:03

electrum approved these changes May 2, 2024

View reviewed changes

electrum reviewed May 2, 2024

View reviewed changes

github-actions bot added the stale label May 24, 2024

wendigo added the stale-ignore Use this label on PRs that should be ignored by the stale bot so they are not flagged or closed. label May 24, 2024

wendigo closed this Jun 21, 2024

wendigo deleted the serafin/reproducible-build-test branch June 27, 2024 12:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Verify that build is reproducible #21733

Verify that build is reproducible #21733

wendigo commented Apr 27, 2024

hboutemy commented Apr 28, 2024

wendigo commented Apr 28, 2024

hboutemy commented Apr 29, 2024

findepi Apr 29, 2024

findepi Apr 29, 2024

findepi Apr 29, 2024

wendigo Apr 29, 2024

martint commented Apr 29, 2024 •

edited

Loading

wendigo commented Apr 29, 2024 •

edited

Loading

wendigo commented Apr 29, 2024

electrum May 2, 2024

electrum May 2, 2024

electrum May 2, 2024

electrum May 2, 2024 •

edited

Loading

github-actions bot commented May 24, 2024

hboutemy commented May 25, 2024

wendigo commented May 25, 2024

wendigo commented May 25, 2024

electrum commented May 26, 2024

wendigo commented Jun 1, 2024

wendigo commented Jun 1, 2024

hboutemy commented Jun 1, 2024

wendigo commented Jun 3, 2024

nineinchnick commented Jun 3, 2024 •

edited by wendigo

Loading

hboutemy commented Jun 5, 2024

wendigo commented Jun 5, 2024

Verify that build is reproducible #21733

Verify that build is reproducible #21733

Conversation

wendigo commented Apr 27, 2024

hboutemy commented Apr 28, 2024

wendigo commented Apr 28, 2024

hboutemy commented Apr 29, 2024

findepi Apr 29, 2024

Choose a reason for hiding this comment

findepi Apr 29, 2024

Choose a reason for hiding this comment

findepi Apr 29, 2024

Choose a reason for hiding this comment

wendigo Apr 29, 2024

Choose a reason for hiding this comment

martint commented Apr 29, 2024 • edited Loading

wendigo commented Apr 29, 2024 • edited Loading

wendigo commented Apr 29, 2024

electrum May 2, 2024

Choose a reason for hiding this comment

electrum May 2, 2024

Choose a reason for hiding this comment

electrum May 2, 2024

Choose a reason for hiding this comment

electrum May 2, 2024 • edited Loading

Choose a reason for hiding this comment

github-actions bot commented May 24, 2024

hboutemy commented May 25, 2024

wendigo commented May 25, 2024

wendigo commented May 25, 2024

electrum commented May 26, 2024

wendigo commented Jun 1, 2024

wendigo commented Jun 1, 2024

hboutemy commented Jun 1, 2024

wendigo commented Jun 3, 2024

nineinchnick commented Jun 3, 2024 • edited by wendigo Loading

hboutemy commented Jun 5, 2024

wendigo commented Jun 5, 2024

martint commented Apr 29, 2024 •

edited

Loading

wendigo commented Apr 29, 2024 •

edited

Loading

electrum May 2, 2024 •

edited

Loading

nineinchnick commented Jun 3, 2024 •

edited by wendigo

Loading