wasefire icon indicating copy to clipboard operation
wasefire copied to clipboard

Build reproducibility

Open ia0 opened this issue 2 years ago • 1 comments

Currently, most parts of the build are pinned to a given version using rust-toolchain.toml and Cargo.lock files. However some parts are not, essentially things installed globally, like apt-get install.

It's not great to force a version on the user, so a solution needs to be found to localize those global tools. Building in a chroot? Not enforcing the version but only measuring it? Getting rid of those global dependencies (like #607)?

ia0 avatar Mar 28 '23 11:03 ia0

EDIT: Made obsolete by #102 and following PRs.

Possible solution for cargo install:

  • Use --root=_/root to install locally. It might be a good idea to put all generated and ignored content under _ (e.g. _/target, _/root, _/node_modules, _/applet.wasm, etc) to make it easier for tool that must ignore such content.
  • Use cargo search $crate | sed -n '1s/^'$crate' = "\([0-9.]*\)".*$/\1/p' to search the latest version.
  • Need a solution to track the expected version (which is read by setup.sh and ci.sh and updated by upgrade.sh).
  • Check current version by processing the output of cargo install --root=_/root --list.

ia0 avatar Apr 06 '23 09:04 ia0