search

monero-project / monero-gui

Monero: the secure, private, untraceable cryptocurrency
Other
1.76k stars 774 forks source link

How reproducible are the reproducible builds? #3480

Open bonevays opened 3 years ago

bonevays commented 3 years ago

I am quite happy to report I was able to follow the docker recipe on Windows and (re)produce monero-wallet-gui.exe with just a few warnings. However, the build runs some commands like "apt update" which are most definitely not deterministic. If you run them 6 months later you will get quite a different mix of Linux binaries and libraries, which does not really inspire confidence in building binaries with the same hash. In fact, my binary is a different size from the one I downloaded, and I am quite happy too as the downloaded binary never starts on my "tweaked" Windows, the thingy was spinning and spinning, despite me fetching all kinds of updates and libraries.

Just to harp on the same theme, doesn't "git clone master" also spoil the reproducibility of the builds, unless you "pin" released versions?

selsta commented 3 years ago

If you run them 6 months later you will get quite a different mix of Linux binaries and libraries

Yes, the CLI reproducible builds have the same issue. It should be reproducible if you build around the same time. We don't release the CLI before multiple users confirmed matching hashes, this can be seen here: https://github.com/monero-project/gitian.sigs

We don't do the same for the GUI because 1) we have less contributors here and 2) don't have reproducible Mac build yet.

and I am quite happy too as the downloaded binary never starts on my "tweaked" Windows, the thingy was spinning and spinning, despite me fetching all kinds of updates and libraries.

What do you mean here exactly?

Just to harp on the same theme, doesn't "git clone master" also spoil the reproducibility of the builds, unless you "pin" released versions?

Where do you see master getting cloned in the dockerfile?

bonevays commented 3 years ago

I had a casual look at the build process and saw some master clone, somewhere. I run Windows "nightly" and the official GUI does not start at all. Like I said, my build starts and works as expected.

selsta commented 3 years ago

We were able to reproduce the issue with hashes not matching and are looking into it.

I had a casual look at the build process and saw some master clone, somewhere.

I don't see master being used anywhere for release binaries.

Like I said, my build starts and works as expected.

That's due to a bug with multiple monitors unrelated to reproducible builds. It is fixed in v0.17.2.2.