ca2d1eea45
The latest release of appimagetool bundles a new enough version of mksquashfs. We had been building a fork of mksquashfs but all the relevant patches there had been upstreamed. Note: we still need a wrapper when calling mksquashfs, as appimagetool calls it with "-mkfs-time 0" and we have the SOURCE_DATE_EPOCH env var set; and these two would conflict. Two ways to fix: either unset SOURCE_DATE_EPOCH for that context, or build a wrapper that removes the "-mkfs-time 0". The former would be cleaner but for some reason I did not manage to build reproducibly that way. The latter seems to work. related: - https://github.com/AppImage/AppImageKit/issues/929#issuecomment-580769875 > Now official squashfs 4.4 makes reproducible images by default - https://github.com/AppImage/AppImageKit/pull/996
AppImage binary for Electrum
✓ This binary should be reproducible, meaning you should be able to generate binaries that match the official releases.
This assumes an Ubuntu host, but it should not be too hard to adapt to another similar system. The host architecture should be x86_64 (amd64).
We currently only build a single AppImage, for x86_64 architecture. Help to adapt these scripts to build for (some flavor of) ARM would be welcome, see issue #5159.
-
Install Docker
$ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add - $ sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" $ sudo apt-get update $ sudo apt-get install -y docker-ce -
Build binary
$ ./build.shIf you want reproducibility, try instead e.g.:
$ ELECBUILD_COMMIT=HEAD ELECBUILD_NOCACHE=1 ./build.sh -
The generated binary is in
./dist.
FAQ
How can I see what is included in the AppImage?
Execute the binary as follows: ./electrum*.AppImage --appimage-extract
How to investigate diff between binaries if reproducibility fails?
cd dist/
./electrum-*-x86_64.AppImage1 --appimage-extract
mv squashfs-root/ squashfs-root1/
./electrum-*-x86_64.AppImage2 --appimage-extract
mv squashfs-root/ squashfs-root2/
$(cd squashfs-root1; find -type f -exec sha256sum '{}' \; > ./../sha256sum1)
$(cd squashfs-root2; find -type f -exec sha256sum '{}' \; > ./../sha256sum2)
diff sha256sum1 sha256sum2 > d
cat d
For file metadata, e.g. timestamps:
rsync -n -a -i --delete squashfs-root1/ squashfs-root2/
Useful binary comparison tools:
- vbindiff
- diffoscope