Release 1.0.6

- Make build reproducible

README.md

@@ -105,6 +105,8 @@ Release checklist
       * [ ] wiki
     * [ ] Changelog in README
     * [ ] Document fixed bugs in Bugs.md
+    * [ ] Update hashes of the binary
+    * [ ] Update signature of the binary
   * [ ] Signature
   * [ ] Branching Strategy
 
@@ -126,10 +128,36 @@ The full public keys can be found in `keys/` along with any revocation certifica
 
 ### Reproducible Builds
 
-Currently our project seems to build the same way on any given system, when compiled
-multiple times. However, at the moment we are unable to supply instructions
-for building our software reproducibly. Reproducible builds are planned for the
-near future.
+Cagebreak offers reproducible builds given the exact library versions specified
+in `meson.build`. Should a version mismatch occur, a warning will be emitted. We have
+decided on this compromise to allow flexibility and security. In general we will
+adapt the versions to the packages available under archlinux at the time of
+release.
+
+#### Reproducible Build Instructions
+
+All hashes and signatures are provided for the following build instructions.
+
+```
+meson build -Dxwayland=true --buildtype=release
+ninja -C build
+```
+
+#### Hashes for Builds
+
+For every release after 1.0.5, hashes will be provided.
+
+1.0.6
+
+  * sha 256: 712ae9a8f17a9e589e108f0d503da203cc5eaf1c4a6ca6efb5b4c83b432ce0b8
+  * sha 512: d574003023a00cfd6623aac986a5a7f397cfd0bc9114017629a8c72731b0df3977c4a31768502dfa8a6607be06930089b2ccf6ffca9b5bcd1096b7ca0aede226
+
+#### GPG Signatures
+
+For every release after 1.0.5, a GPG signature will be provided in `signatures`.
+
+The current signature is called `cagebreak.sig`, whereas all older signatures
+will be named after their release version.
 
 ### Fuzzing
 

meson.build

@@ -1,5 +1,5 @@
 project('cagebreak', 'c',
-  version: '1.0.5',
+  version: '1.0.6',
   license: 'MIT',
   default_options: [
     'c_std=c11',
@@ -64,6 +64,7 @@ xkbcommon      = dependency('xkbcommon')
 cairo          = dependency('cairo')
 pango          = dependency('pango')
 pangocairo     = dependency('pangocairo')
+fontconfig     = dependency('fontconfig')
 math           = cc.find_library('m')
 
 wl_protocol_dir = wayland_protos.get_pkgconfig_variable('pkgdatadir')
@@ -100,18 +101,10 @@ else
   have_xwayland = false
 endif
 
-version = '@0@'.format(meson.project_version())
-git = find_program('git', native: true, required: false)
-if git.found()
-  git_commit = run_command([git, 'rev-parse', '--short', 'HEAD'])
-  git_branch = run_command([git, 'rev-parse', '--abbrev-ref', 'HEAD'])
-  if git_commit.returncode() == 0 and git_branch.returncode() == 0
-    version = '@0@-@1@ (branch \'@2@\')'.format(
-      meson.project_version(),
-      git_commit.stdout().strip(),
-      git_branch.stdout().strip(),
-    )
-  endif
+if get_option('version_override') != ''
+  version = '@0@'.format(get_option('version_override'))
+else
+  version = '@0@'.format(meson.project_version())
 endif
 
 conf_data = configuration_data()
@@ -173,19 +166,49 @@ foreach header : cagebreak_header_strings
   cagebreak_headers += files(header)
 endforeach
 
-cagebreak_dependencies = [
-  server_protos,
-  wayland_server,
-  wayland_client,
-  wayland_cursor,
-  wlroots,
-  xkbcommon,
-  pixman,
-  math,
-  pango,
-  cairo,
-  pangocairo,
-]
+cagebreak_dependencies_dict = {
+  'server_protos': server_protos,
+  'wayland_server': wayland_server,
+  'wayland_client': wayland_client,
+  'wayland_cursor': wayland_cursor,
+  'wlroots': wlroots,
+  'xkbcommon': xkbcommon,
+  'fontconfig': fontconfig,
+  'pixman': pixman,
+  'pango': pango,
+  'cairo': cairo,
+  'pangocairo': pangocairo,
+  'math': math
+}
+
+reproducible_build_versions = { 
+  'server_protos': '1.0.6',
+  'wayland_server': '1.18.0',
+  'wayland_client': '1.18.0',
+  'wayland_cursor': '1.18.0',
+  'wlroots': '0.10.1',
+  'xkbcommon': '0.10.0',
+  'fontconfig': '2.13.91',
+  'pixman': '0.38.4',
+  'pango': '1.44.7',
+  'cairo': '1.17.3',
+  'pangocairo': '1.44.7',
+  'math': '-1'
+}
+
+cagebreak_dependencies = []
+
+foreach name, dep : cagebreak_dependencies_dict
+  cagebreak_dependencies += dep
+endforeach
+
+foreach name, dep : cagebreak_dependencies_dict
+  if reproducible_build_versions[name] != '-1' and reproducible_build_versions[name] != dep.version()
+    warning('The installed version of "' + name + '" on your machine (' + dep.version() + ') differs from the one used to generate the binary specified in the README section "Reproducible Builds" (' + reproducible_build_versions[name] + '). Cagebreak does not guarantee a reproducible build for this configuration.'
+    )
+	break
+  endif
+endforeach
 
 executable(
   meson.project_name(),

meson_options.txt

@@ -1,2 +1,3 @@
 option('xwayland', type: 'boolean', value: 'false', description: 'Enable support for X11 applications')
 option('fuzz', type: 'boolean', value: 'false', description: 'Enable building fuzzer targets')
+option('version_override', type: 'string', description: 'Set the project version to the string specified. Used for creating hashes for reproducible builds.')