[WASM] Reproducible WASM builds

[appetrosyan]

Feature request

We should find a way to make WASM builds reproducible.

Motivation

Peers need to be able to verify that WASM is the same across them.

Users need to be able to verify that the source code that they see corresponds to the WASM that they see in the blockchain.

Solutions

Ignore the reproducibility aspect

• Same as Parity Substrate
• 👍 Easy to implement: whatever binary was submitted is the sole source of truth
• 👎 Leads to black box scripting, where malicious actors could submit black boxes that work as normal, until being activated and wreak havoc on-chain.
• 👎 The users have to trust that the code does what it's supposed to do.

Direct code submission

• Solves the problem of DSL
• 👍 No separate code submission process. Compile and run locally, submit code
• 👍 Users don't need to trust anything
• 👎 Complex
• 👎 An async build can complicate the BFT aspect of Sumeragi.
• 👎 Rust is not the best candidate language, preferably use an interpreted language e.g. Python, Haskell.

Pinned dependency reproducible builds

• Same as CosmoSDK
• 👍 Users can verify if they need to.
• 👍 Can be integrated into a web form, where people input code and get base64-encoded WASM.
• 👎 Leads to version proliferation, each minor version bump leads to a new version in the blockchain
• 👎 Our dependencies need to be pinned in Cargo.toml not just Cargo.lock.
• 👎 Users encouraged to trust and not verify.

[appetrosyan]

Continuation of #3168

[mversic]

This might be of some help