Reproducible builds

[zenhack]

Per discussion in #3, I'd like to get a reproducible build process working and documented, so I can comfortably release binaries for users who don't want to build from source.

[zenhack]

I put together a Dockerfile and script that generate deterministic executables for MacOS and Linux; it's at the root of the repository:

https://github.com/zenhack/docker-spk/blob/master/Dockerfile

Before I actually upload releases I'd ideally like someone else to confirm that they can actually reproduce my results; I was able to get the same output with a few different hosts (though all using the same docker container...), but would be good to sanity check. The checksums for the binaries I got:

9c4847beba94a806897a5485bd7185f12cb5a57357d426ebd2d6f901fcfddb9a  darwin/amd64/docker-spk
213d1334adc06a5997c77e8615debafc7f70b54fd5f4224f6073b3c1a1ae70df  linux/amd64/docker-spk

[zenhack]

//cc @ocdtrekkie, @JamborJan

[JamborJan]

hey @zenhack, do you have any experience with Gitlab CI / CD? I just started looking into it to build stuff reproducible. But as I don't have any experience with go I was not able to do that super quickly. One error message was easy, as a Heroku image was used but the other error messages at the end are not so easy to solve for me. Maybe you can take a look and let me know if this makes sense at all or not. If it makes sense: I'm happy to help :-)

https://gitlab.com/JamborJan/docker-spk/-/jobs/105231441

[zenhack]

I made a comment on one of the diffs there. But if you've got docker set up locally, you should be able to just do `docker build .` in the root of the repository to build the same image I got; see the comments in the Dockerfile. Also, Gitlab CI lets you supply any docker image as a base; If you're going to try to build in Gitlab CI I'd recommend building off of the same golang image I'm using in the Dockerfile. I use Gitlab CI for my Haskell projects; you can see an example of one of the configs I use here: https://gitlab.com/isd/layout-dsl/blob/master/.gitlab-ci.yml Quoting JJ (2018-10-05 14:07:02)

…

hey ***@***.***, do you have any experience with Gitlab CI / CD? I just started looking into it to build stuff reproducible. But as I don't have any experience with go I was not able to do that super quickly. One error message was easy, as a Heroku image was used but the other error messages at the end are not so easy to solve for me. Maybe you can take a look and let me know if this makes sense at all or not. If it makes sense: I'm happy to help :-) [2]https://gitlab.com/JamborJan/docker-spk/-/jobs/105231441 -- You are receiving this because you were mentioned. Reply to this email directly, [3]view it on GitHub, or [4]mute the thread. Verweise 1. https://github.com/zenhack 2. https://gitlab.com/JamborJan/docker-spk/-/jobs/105231441 3. #5 (comment) 4. https://github.com/notifications/unsubscribe-auth/AA18PqF3JdFNxUjIm7mHOIVoXRtRZ5Ggks5uh5_GgaJpZM4XE6Ro

[JamborJan]

Thanks! I'll take a look at this. On Fri, Oct 5, 2018 at 8:37 PM +0200, "Ian Denhardt" <notifications@github.com<mailto:notifications@github.com>> wrote: I made a comment on one of the diffs there. But if you've got docker set up locally, you should be able to just do `docker build .` in the root of the repository to build the same image I got; see the comments in the Dockerfile. Also, Gitlab CI lets you supply any docker image as a base; If you're going to try to build in Gitlab CI I'd recommend building off of the same golang image I'm using in the Dockerfile. I use Gitlab CI for my Haskell projects; you can see an example of one of the configs I use here: https://gitlab.com/isd/layout-dsl/blob/master/.gitlab-ci.yml Quoting JJ (2018-10-05 14:07:02)

hey ***@***.***, do you have any experience with Gitlab CI / CD? I just started looking into it to build stuff reproducible. But as I don't have any experience with go I was not able to do that super quickly. One error message was easy, as a Heroku image was used but the other error messages at the end are not so easy to solve for me. Maybe you can take a look and let me know if this makes sense at all or not. If it makes sense: I'm happy to help :-) [2]https://gitlab.com/JamborJan/docker-spk/-/jobs/105231441 -- You are receiving this because you were mentioned. Reply to this email directly, [3]view it on GitHub, or [4]mute the thread. Verweise 1. https://github.com/zenhack 2. https://gitlab.com/JamborJan/docker-spk/-/jobs/105231441 3. #5 (comment) 4. https://github.com/notifications/unsubscribe-auth/AA18PqF3JdFNxUjIm7mHOIVoXRtRZ5Ggks5uh5_GgaJpZM4XE6Ro

- You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#5 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AHKT4CJXowXBI2qQI9FEH0IWi_9EjNXEks5uh6bjgaJpZM4XE6Ro>.

[zenhack]

No problem; let me know how it goes.

[zenhack]

I'm going to close this one for now; I've uploaded binaries for the v1.0 tag, and I had success reproducing the exact binaries using docker with several different hosts. Definitely open a bug if folks have problems reproducing, but I believe this is working.