Merge branch 'reproducible_builds' into development

README.md

@@ -105,6 +105,8 @@ Release checklist
       * [ ] wiki
     * [ ] Changelog in README
     * [ ] Document fixed bugs in Bugs.md
+    * [ ] Update hashes of the binary
+    * [ ] Update signature of the binary
   * [ ] Signature
   * [ ] Branching Strategy
 
@@ -126,10 +128,36 @@ The full public keys can be found in `keys/` along with any revocation certifica
 
 ### Reproducible Builds
 
-Currently our project seems to build the same way on any given system, when compiled
-multiple times. However, at the moment we are unable to supply instructions
-for building our software reproducibly. Reproducible builds are planned for the
-near future.
+Cagebreak offers reproducible builds given the exact library versions specified
+in `meson.build`. Should the versions not match, a warning will be emitted. We have
+decided on this compromise to allow flexibility and security. In general we will
+adapt the versions to the packages available under archlinux at the time of
+release.
+
+#### Reproducible Build Instructions
+
+All hashes and signatures are provided for the following build instructions.
+
+```
+meson build -Dxwayland=true --buildtype=release
+ninja -C build
+```
+
+#### Hashes for Builds
+
+For every release after 1.0.5, hashes will be provided.
+
+1.0.6
+
+  * sha 256: 875d77ae0d1266ace899b143ca738e6adc514ea26b2dae58a0ce5989139149f2
+  * sha 512: 066829ed30b299a21ef74d5d9c7f3ff8021b877ac18a141a0aa77aae1acf880305743eedf546cba0aa06acc53d26750bf989b7fb029f0ea5ac01b3804288ab88
+
+#### GPG Signatures
+
+For every release after 1.0.5, a GPG signature will be provided in `signatures`.
+
+The current signature is called `cagebreak.sig`, whereas all older signatures
+will be named after their release version.
 
 ### Fuzzing
 

cagebreak.c

@@ -160,7 +160,7 @@ parse_args(struct cg_server *server, int argc, char *argv[]) {
 			usage(stdout, argv[0]);
 			return false;
 		case 'v':
-			fprintf(stdout, "Cagebreak version " CG_VERSION "\n");
+			fprintf(stdout, "Cagebreak version 1.0.6\n");
 			exit(0);
 		default:
 			usage(stderr, argv[0]);

meson.build

@@ -1,5 +1,5 @@
 project('cagebreak', 'c',
-  version: '1.0.5',
+  version: '1.0.6',
   license: 'MIT',
   default_options: [
     'c_std=c11',
@@ -64,6 +64,7 @@ xkbcommon      = dependency('xkbcommon')
 cairo          = dependency('cairo')
 pango          = dependency('pango')
 pangocairo     = dependency('pangocairo')
+fontconfig     = dependency('fontconfig')
 math           = cc.find_library('m')
 
 wl_protocol_dir = wayland_protos.get_pkgconfig_variable('pkgdatadir')
@@ -173,19 +174,49 @@ foreach header : cagebreak_header_strings
   cagebreak_headers += files(header)
 endforeach
 
-cagebreak_dependencies = [
-  server_protos,
-  wayland_server,
-  wayland_client,
-  wayland_cursor,
-  wlroots,
-  xkbcommon,
-  pixman,
-  math,
-  pango,
-  cairo,
-  pangocairo,
-]
+cagebreak_dependencies_dict = {
+  'server_protos': server_protos,
+  'wayland_server': wayland_server,
+  'wayland_client': wayland_client,
+  'wayland_cursor': wayland_cursor,
+  'wlroots': wlroots,
+  'xkbcommon': xkbcommon,
+  'fontconfig': fontconfig,
+  'pixman': pixman,
+  'pango': pango,
+  'cairo': cairo,
+  'pangocairo': pangocairo,
+  'math': math
+}
+
+reproducible_build_versions = { 
+  'server_protos': '1.0.5',
+  'wayland_server': '1.18.0',
+  'wayland_client': '1.18.0',
+  'wayland_cursor': '1.18.0',
+  'wlroots': '0.10.1',
+  'xkbcommon': '0.10.0',
+  'fontconfig': '2.13.91',
+  'pixman': '0.38.4',
+  'pango': '1.44.7',
+  'cairo': '1.17.3',
+  'pangocairo': '1.44.7',
+  'math': '-1'
+}
+
+cagebreak_dependencies = []
+
+foreach name, dep : cagebreak_dependencies_dict
+  cagebreak_dependencies += dep
+endforeach
+
+foreach name, dep : cagebreak_dependencies_dict
+  if reproducible_build_versions[name] != '-1' and reproducible_build_versions[name] != dep.version()
+    warning('The installed version of "' + name + '" on your machine (' + dep.version() + ') differs from the one used to generate the binary specified in the README section "Reproducible Builds" (' + reproducible_build_versions[name] + '). Cagebreak does not guarantee a reproducible build for this configuration.'
+    )
+	break
+  endif
+endforeach
 
 executable(
   meson.project_name(),