deterministic SHA for releases

hyperledger / besu

An enterprise-grade Java-based, Apache 2.0 licensed Ethereum client https://wiki.hyperledger.org/display/besu

https://www.hyperledger.org/projects/besu

Apache License 2.0

1.43k stars 756 forks source link

deterministic SHA for releases #6993

Open macfarla opened 2 months ago

macfarla commented 2 months ago

As a release manager, I want the SHA for the release artifacts to be deterministic (based on github commit), so that if we have to re-run a workflow using the same commit as input, the artifacts that result are verifiably identical.

Current hypothesis is that timestamp is also baked in and that's why the sha produced is not deterministic

shemnon commented 2 months ago

You will want these two options set in lots of places

preserveFileTimestamps = false
reproducibleFileOrder = true

It appears Gradle took away dirMode and fileMode settings, hopefully it's because they made it consistent. This old and incompatible plugin may have other useful insights - https://github.com/Johni0702/gradle-reproducible-builds-plugin?tab=readme-ov-file

macfarla commented 2 months ago

also maybe some context in #5785