reth
reth copied to clipboard
feat: Add reproducible build profile
Context: While trying to build reproducible confidential VMs with Reth, I noticed that the Reth binary does not build reproducible by design. Consequently, the VMs were not able to be built reproducible because of that.
In this PR, I was mainly trying to figure a way to compile the binary reproducibly by eliminating factors that might have impact on that. Those factors could be, timestamps, file path prefixes, metadata, etc... By adding those changes here, I was able to reproducibly build Reth binary twice with the same hash. It could also be inspected by diffoscope.
Steps to reproduce:
- run
make build-reproducible - copy out the binary
cp target/reproducible/reth reth-copy-1 - now clean and remove cargo cache to rebuild from scratch
make clean && cargo cache -a - run
make build-reproducibleagain and cope it outcp target/reproducible/reth reth-copy-2 - compare the two binaries: for example by comparing the output of
sha256sum reth-copy-1andsha256sum reth-copy-2or by running diffoscope on them
PS: I have tested this on the v1.0.5 and not the main branch
Edit:
I've added a Dockerfile that builds reth reproducibly on two different machines too.
you can run it like this:
docker --no-cache build --output=. .
It will build the binary and copy it out to the same directory