{"action":"created","issue":{"url":"https://api.github.com/repos/NebulousLabs/Sia/issues/2410","repository_url":"https://api.github.com/repos/NebulousLabs/Sia","labels_url":"https://api.github.com/repos/NebulousLabs/Sia/issues/2410/labels{/name}","comments_url":"https://api.github.com/repos/NebulousLabs/Sia/issues/2410/comments","events_url":"https://api.github.com/repos/NebulousLabs/Sia/issues/2410/events","html_url":"https://github.com/NebulousLabs/Sia/issues/2410","id":263647055,"number":2410,"title":"Write a script for bit-perfect deterministic build","user":{"login":"starius","id":920155,"avatar_url":"https://avatars0.githubusercontent.com/u/920155?v=4","gravatar_id":"","url":"https://api.github.com/users/starius","html_url":"https://github.com/starius","followers_url":"https://api.github.com/users/starius/followers","following_url":"https://api.github.com/users/starius/following{/other_user}","gists_url":"https://api.github.com/users/starius/gists{/gist_id}","starred_url":"https://api.github.com/users/starius/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/starius/subscriptions","organizations_url":"https://api.github.com/users/starius/orgs","repos_url":"https://api.github.com/users/starius/repos","events_url":"https://api.github.com/users/starius/events{/privacy}","received_events_url":"https://api.github.com/users/starius/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-10-07T14:58:26Z","updated_at":"2017-10-09T20:18:02Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Following on from https://github.com/NebulousLabs/Sia/issues/2388#issuecomment-334899832 I think we should provide a shell script producing the released binary from scratch: downloads and installs Go, downloads Sia and all its dependencies and buildes them. Then everybody can run the script and compare results bit-by-bit.\r\n\r\nThe script can use the following commands: standard (`cd grep cp ...`) and build (`make gcc wget git sha256sum`).\r\n\r\nI wrote a script to download and build Go of a particular version: https://github.com/starius/gohere\r\nIt is in Python and I am not sure if we want to have Python as a dependency. On the other hand Python is less fragile than shell (that is why I used it in my script)."},"comment":{"url":"https://api.github.com/repos/NebulousLabs/Sia/issues/comments/335273931","html_url":"https://github.com/NebulousLabs/Sia/issues/2410#issuecomment-335273931","issue_url":"https://api.github.com/repos/NebulousLabs/Sia/issues/2410","id":335273931,"user":{"login":"starius","id":920155,"avatar_url":"https://avatars0.githubusercontent.com/u/920155?v=4","gravatar_id":"","url":"https://api.github.com/users/starius","html_url":"https://github.com/starius","followers_url":"https://api.github.com/users/starius/followers","following_url":"https://api.github.com/users/starius/following{/other_user}","gists_url":"https://api.github.com/users/starius/gists{/gist_id}","starred_url":"https://api.github.com/users/starius/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/starius/subscriptions","organizations_url":"https://api.github.com/users/starius/orgs","repos_url":"https://api.github.com/users/starius/repos","events_url":"https://api.github.com/users/starius/events{/privacy}","received_events_url":"https://api.github.com/users/starius/received_events","type":"User","site_admin":false},"created_at":"2017-10-09T20:18:01Z","updated_at":"2017-10-09T20:18:01Z","author_association":"CONTRIBUTOR","body":"The idea of the script is to have minimal environmental dependencies (bash coreutils wget tar sed gcc make) and still build everything from source. It allows everybody who has these tools installed to run the script and compare the resulting binaries with the released ones. If anything goes wrong (e.g. checksum of a downloaded file mismatches), it stops (thanks to `set -xue`), no blind operation should follow. Also, the script will use only two inputs: Go and Sia sources. No other dependencies. (Sia's dependencies will be vendored by that time: https://github.com/NebulousLabs/Sia/issues/2388.) The script downloads and checks against checksums these two inputs.\r\n\r\nThere's no advantage of using prebuilt Go binaries or user-provided Sia sources.\r\n\r\nCan we update the script draft to be more doctor-like e.g. printing user friendly messages in case of download error?"}}
{"actor":{"display_login":"starius"}}