wasefire
wasefire copied to clipboard
Build reproducibility
Currently, most parts of the build are pinned to a given version using rust-toolchain.toml and Cargo.lock files. However some parts are not, essentially things installed globally, like apt-get install.
It's not great to force a version on the user, so a solution needs to be found to localize those global tools. Building in a chroot? Not enforcing the version but only measuring it? Getting rid of those global dependencies (like #607)?
EDIT: Made obsolete by #102 and following PRs.
Possible solution for cargo install:
- Use
--root=_/rootto install locally. It might be a good idea to put all generated and ignored content under_(e.g._/target,_/root,_/node_modules,_/applet.wasm, etc) to make it easier for tool that must ignore such content. - Use
cargo search $crate | sed -n '1s/^'$crate' = "\([0-9.]*\)".*$/\1/p'to search the latest version. - Need a solution to track the expected version (which is read by setup.sh and ci.sh and updated by upgrade.sh).
- Check current version by processing the output of
cargo install --root=_/root --list.