Skip to content

reproducible binaries w/ prebuilt support - #29

Open
slopbot9k wants to merge 8 commits into
cypherstack:mainfrom
slopbot9k:dnix
Open

slopbot9k wants to merge 8 commits into
cypherstack:mainfrom
slopbot9k:dnix

Conversation

@slopbot9k

Copy link
Copy Markdown
Contributor

No description provided.

…Nix otherwise

The build hook is dnix's. By default it downloads the library of the
release dnix.lock names and verifies its hash; in source mode it builds
the same library with Nix and verifies the same hash; in dev mode it
builds with Nix for work on the Rust code. dnix.json names the library,
the asset, the Rust workspace and crate, the Rust and Xcode versions, the
deployment floors, and the eleven targets; dnix.lock records what the
source builds to and names release native-be1f6b4538b2. The flake hands
dnix the configuration. The release profile sets debug, strip, and
incremental explicitly so the bytes do not depend on toolchain defaults.
Two-line tools update the lock and verify one platform against the
release.
…lock

dnix's reusable workflow builds the library on Linux x86_64, Linux
aarch64, macOS with Xcode 27.0, and Linux inside WSL2 on Windows,
rebuilds each sandboxed target, compares every host with every other and
with the committed lock, and on main publishes the release the lock
names if it does not exist yet. Runs on main are never cancelled, since
one may be publishing. The test workflow runs the Dart tests on every OS,
against the prebuilt library once its release exists and from source
before that, plus the Rust tests on Linux.
How the hook obtains the library and the three modes, how a change to
the Rust code becomes a lock entry and a release, how anyone rebuilds a
platform and compares, what keeps the bytes identical across hosts, and
what a Rust or dnix bump touches.
The Windows library changes bytes: dnix now compiles C for the MSVC
target in clang-cl driver mode (secp256k1 is C), and keeps the objects'
CodeView sections. Every other target builds the same bytes as before.
The lock names the new release.
dnix 7b9ef2d adds the Windows GNU and arm64 targets and stops zig adding
its debug-mode sanitizer to C compiled without an optimisation level.
Neither changes what this package builds to: every library hashes as
before, so dnix.lock and the release it names stay as they are.
Flutter 3.47 asks every native asset for iOS 13, whatever the
application's deployment target, and writes 13.0 into the framework it
wraps the library in. With the floor at 15, dnix's hook refused every iOS
build of an application using this package. Only the three iOS libraries
change bytes, so the lock names release native-780746010c71.
slopbot9k/dnix c6b2a9d, the stable-sort branch, not yet on cypherstack:
build-time dependencies resolved alike on every build host, rustc
sorting the same everywhere, bindgen given fixed headers, and only the
dynamic library kept. frostdart's libraries were already identical on
every host, so the lock is unchanged.
dnix 57efe93 sets the preload variable on rustc's command alone; with
c6b2a9d the sed in the rustc wrapper inherited it, and on the macOS
runners, where that sed is the system's arm64e one, dyld aborted it and
the Apple build failed. The lock is unchanged.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant