c9b6a6c01e
- repro builds to use fixed uid=1000 inside the container
- in case the file permissions leak into the binaries, they are still reproducible
- chown 1000:1000 fresh_clone
- repro builds to create fresh_clone dir outside git clone
- otherwise the local dev build would still interact with the fresh_clone dir
- due to e.g. recursive "find -exec touch",
- and even the "docker build" cmd itself would try to stat/read it
- see https://github.com/docker/for-linux/issues/380
- and "rm -rf fresh_clone" needs sudo if the host uid is not 1000
- this way the local dev build does not need sudo
to recap:
- local dev builds use the host userid inside the container, directly operate on the project dir
- does not need sudo
- repro builds create a fresh git clone, chown it to 1000, and use userid=1000 inside the container
- if the host userid is 1000, does not need sudo
- otherwise, needs sudo
closes https://github.com/spesmilo/electrum/issues/8261
AppImage binary for Electrum
✓ This binary should be reproducible, meaning you should be able to generate binaries that match the official releases.
This assumes an Ubuntu host, but it should not be too hard to adapt to another similar system. The host architecture should be x86_64 (amd64).
We currently only build a single AppImage, for x86_64 architecture. Help to adapt these scripts to build for (some flavor of) ARM would be welcome, see issue #5159.
-
Install Docker
See
contrib/docker_notes.md. -
Build binary
$ ./build.shIf you want reproducibility, try instead e.g.:
$ ELECBUILD_COMMIT=HEAD ELECBUILD_NOCACHE=1 ./build.sh -
The generated binary is in
./dist.
FAQ
How can I see what is included in the AppImage?
Execute the binary as follows: ./electrum*.AppImage --appimage-extract
How to investigate diff between binaries if reproducibility fails?
cd dist/
./electrum-*-x86_64.AppImage1 --appimage-extract
mv squashfs-root/ squashfs-root1/
./electrum-*-x86_64.AppImage2 --appimage-extract
mv squashfs-root/ squashfs-root2/
$(cd squashfs-root1; find -type f -exec sha256sum '{}' \; > ./../sha256sum1)
$(cd squashfs-root2; find -type f -exec sha256sum '{}' \; > ./../sha256sum2)
diff sha256sum1 sha256sum2 > d
cat d
For file metadata, e.g. timestamps:
rsync -n -a -i --delete squashfs-root1/ squashfs-root2/
Useful binary comparison tools:
- vbindiff
- diffoscope