swarms/ideas/282-deterministic-builds.md

id	title	status	created	category	lead-contributor	contributors	exit-criteria	success-metrics	clear-roles	future-iterations	roles-needed
282-deterministic-builds	Deterministic Mobile App Builds	In Progress	2018-08-16	infra	jakubgs		yes	yes	yes	yes

Preamble

Idea: #282-deterministic-builds
Title: Deterministic Mobile App Builds
Status: In Progress
Created: 2018-08-16

The purpose of achieving deterministic builds is encuring security of Status software. Deterministic builds depend on ensuring stable inputs, ensuring stable outputs, and capturing as little of the build environment as possible.

In simple terms, deterministic builds mean the same commit generates exactly the same software package(s) regardless of where and when it is built. This is achieved by controlling all possible variables in a build, which includes controlling your build environment as well.

Objectives

• status-go builds are deterministic
• status-react builds are deterministic

Key Results

• Anyone can build a commit on their own machines and verify the result by comparing against our builds
• We can upload Android builds to F-Droid which requires deterministic builds

Timeline / Checkpoints

TODO: Not sure?

Exit Criteria

• All Status mobile and desktop app builds are deterministic

What exactly we going to do?

• Verify all of our dependencies are frozen and versioned (Gemfile.lock)
• Verify we depend on no resources pulled from internet during build
• Make sure we initialize all variables in an explicit way
• Verify the build output does not depend on build system time/locale/encoding
• Eliminate timestamp related changes (use SOURCE_DATE_EPOCH)
• Use gitan-builder or Nix to have a controlled build environment
• Configure deterministic builds to run on Jenkins