Bring back reproducible builds
- Dominant language
- C++
- Stars
- 2.5k
- Forks
- 173
- PR merge metrics
- No merged PRs in 30d
Description
As a security-conscious user, I need to be able to build lbrycrd from source and be confident that it matches the official release. This is critical to ensure that all nodes remain in consensus.
Requirements:
- must be able to create a byte-for-byte reproducible build of the lbrycrd binaries by running a single script
- instructions for this script must be in readme.md. it must be clear that this is the official way to build lbrycrd. other ways to build can be listed, but it must be clear that they are not for production use and cannot be guaranteed to remain in consensus.
- our CI must use this script to build our releases. it must do basically nothing else but run that script.
- the script should take care of dependency checking and installation, erroring if dependencies are not met, etc.
- its acceptable to use Docker, but not any pre-existing images. if an image is being used, creating that image should be part of the reproducible build script.
- for v1, must work on linux at least. for v2, must work on windows and mac as well.
Contributor guide
Research direction
Read readme.md and inspect the existing build and CI release entry points before defining the reproducible-build workflow. Done means a Linux build can run from one script, produce byte-for-byte matching lbrycrd binaries, validate dependencies, and have CI releases invoke that script with the official instructions documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- blockchain, build-system, ci-cd, release
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100