From 78fc95e098d54501cab04be6d2ea97b5cd6af76f Mon Sep 17 00:00:00 2001
From: Cagebreak Signing Key 1 <cagebreak_signing_key_1@cagebreak>
Date: Sat, 28 Mar 2020 21:33:54 +0000
Subject: [PATCH] Prepare cagebreak 1.0.6 for review

- Make build reproducible accross commits
- Document reproducibility regimen
---
 README.md                |  36 ++++++++++++++++++++++++++++++++----
 cagebreak.c              |   2 +-
 meson.build              |   4 ++--
 signatures/cagebreak.sig | Bin 0 -> 566 bytes
 4 files changed, 35 insertions(+), 7 deletions(-)
 create mode 100644 signatures/cagebreak.sig

diff --git a/README.md b/README.md
index 2912c06..0e7093a 100644
--- a/README.md
+++ b/README.md
@@ -105,6 +105,8 @@ Release checklist
       * [ ] wiki
     * [ ] Changelog in README
     * [ ] Document fixed bugs in Bugs.md
+    * [ ] Update hashes of the binary
+    * [ ] Update signature of the binary
   * [ ] Signature
   * [ ] Branching Strategy
 
@@ -126,10 +128,36 @@ The full public keys can be found in `keys/` along with any revocation certifica
 
 ### Reproducible Builds
 
-Currently our project seems to build the same way on any given system, when compiled
-multiple times. However, at the moment we are unable to supply instructions
-for building our software reproducibly. Reproducible builds are planned for the
-near future.
+Cagebreak offers reproducible builds given the exact library versions specified
+in `meson.build`. Should the versions not match, a warning will be emitted. We have
+decided on this compromise to allow flexibility and security. In general we will
+adapt the versions to the packages available under archlinux at the time of
+release.
+
+#### Reproducible Build Instructions
+
+All hashes and signatures are provided for the following build instructions.
+
+```
+meson build -Dxwayland=true --buildtype=release
+ninja -C build
+```
+
+#### Hashes for Builds
+
+For every release after 1.0.5, hashes will be provided.
+
+1.0.6
+
+  * sha 256: 875d77ae0d1266ace899b143ca738e6adc514ea26b2dae58a0ce5989139149f2
+  * sha 512: 066829ed30b299a21ef74d5d9c7f3ff8021b877ac18a141a0aa77aae1acf880305743eedf546cba0aa06acc53d26750bf989b7fb029f0ea5ac01b3804288ab88
+
+#### GPG Signatures
+
+For every release after 1.0.5, a GPG signature will be provided in `signatures`.
+
+The current signature is called `cagebreak.sig`, whereas all older signatures
+will be named after their release version.
 
 ### Fuzzing
 
diff --git a/cagebreak.c b/cagebreak.c
index 4a71480..1adc5a1 100644
--- a/cagebreak.c
+++ b/cagebreak.c
@@ -160,7 +160,7 @@ parse_args(struct cg_server *server, int argc, char *argv[]) {
 			usage(stdout, argv[0]);
 			return false;
 		case 'v':
-			fprintf(stdout, "Cagebreak version " CG_VERSION "\n");
+			fprintf(stdout, "Cagebreak version 1.0.6\n");
 			exit(0);
 		default:
 			usage(stderr, argv[0]);
diff --git a/meson.build b/meson.build
index b4f6350..419e625 100644
--- a/meson.build
+++ b/meson.build
@@ -1,5 +1,5 @@
 project('cagebreak', 'c',
-  version: '1.0.5',
+  version: '1.0.6',
   license: 'MIT',
   default_options: [
     'c_std=c11',
@@ -212,7 +212,7 @@ endforeach
 
 foreach name, dep : cagebreak_dependencies_dict
   if reproducible_build_versions[name] != '-1' and reproducible_build_versions[name] != dep.version()
-    warning('The installed version of "' + name + '" on your machine (' + dep.version() + ') differs from the one used to generate the hash specified in the "Reproducible Build" section of the README (' + reproducible_build_versions[name] + '). There is therefore no guaranty that the hashes of the binaries match.'
+    warning('The installed version of "' + name + '" on your machine (' + dep.version() + ') differs from the one used to generate the binary specified in the README section "Reproducible Builds" (' + reproducible_build_versions[name] + '). Cagebreak does not guarantee a reproducible build for this configuration.'
     )
 	break
   endif
diff --git a/signatures/cagebreak.sig b/signatures/cagebreak.sig
new file mode 100644
index 0000000000000000000000000000000000000000..e742f265d2fbf6e489061218b890414e4e5037a9
GIT binary patch
literal 566
zcmV-60?GY}0y6{v0SEvc79j-ZpKYEIH7WG5|K!!g`E=I|>?~Ua0$zW>rT_{F5XAX(
z*9`0|TZdy10G}F0tA5dHph^EPvbU}7ZX$N|Vy>@UXujVCSDrGj9@HHZp+xZij|C^B
z_rB#LQ&^vSQJq=9{ih4&+?V{HIarH!^c>-6uig8NDrlOxseNzxrM^8v1;25mL!PYn
zOvkj;V^+nK!K|X1c$hpi2_y1)ttqMr!b06hm$)nGelp4iEis58Kfx{j-gHWs5e{YW
z*ogldyWE;DFk)+Po}<7S54vp-6s`4n&>paTU>E{<4l??ekA!!8bDaMa(SRt`KRmQJ
zI44N>DrL2zJ~ozhqpjZ7fqW0nI^^DWHY*0^=Go)$>XT#0%S>CyIFuc%MbEn}#k_xP
zb~Wws>IK5R$eia4zF?>#&b|XMc=i)_5(iT^13{fMkr+>9|A$yMgQKiUi2_sFo{Vqq
zWC7#i5$FM0+Rf*ws&XX&g%HmHKfxhb7T=xp$V@l3O+_)K9R#4ldB>Tde~W1w^Uti=
zNZ|;qFo4;y=}yBw&&1aA5tZt;#tb|I8<CmvpAcJ9w&~~UlvZAJWS74}G3m1d;PAX&
zl&Tj8@RaYk@h{K8r)=rf;X>{Aj6))Qe61SSYSv=*6r_fn8SdYGjb}0zdyJry<Hojw
z{%Q1b0hUYpfI-eW_FSp%Xi{ko>^-|rO|cqVJ;PlGW2hLon-@%$Tqn%|5?rV_0>XmN
E_hhge9{>OV

literal 0
HcmV?d00001