diff --git a/README.md b/README.md index 2912c06..0e7093a 100644 --- a/README.md +++ b/README.md @@ -105,6 +105,8 @@ Release checklist * [ ] wiki * [ ] Changelog in README * [ ] Document fixed bugs in Bugs.md + * [ ] Update hashes of the binary + * [ ] Update signature of the binary * [ ] Signature * [ ] Branching Strategy @@ -126,10 +128,36 @@ The full public keys can be found in `keys/` along with any revocation certifica ### Reproducible Builds -Currently our project seems to build the same way on any given system, when compiled -multiple times. However, at the moment we are unable to supply instructions -for building our software reproducibly. Reproducible builds are planned for the -near future. +Cagebreak offers reproducible builds given the exact library versions specified +in `meson.build`. Should the versions not match, a warning will be emitted. We have +decided on this compromise to allow flexibility and security. In general we will +adapt the versions to the packages available under archlinux at the time of +release. + +#### Reproducible Build Instructions + +All hashes and signatures are provided for the following build instructions. + +``` +meson build -Dxwayland=true --buildtype=release +ninja -C build +``` + +#### Hashes for Builds + +For every release after 1.0.5, hashes will be provided. + +1.0.6 + + * sha 256: 875d77ae0d1266ace899b143ca738e6adc514ea26b2dae58a0ce5989139149f2 + * sha 512: 066829ed30b299a21ef74d5d9c7f3ff8021b877ac18a141a0aa77aae1acf880305743eedf546cba0aa06acc53d26750bf989b7fb029f0ea5ac01b3804288ab88 + +#### GPG Signatures + +For every release after 1.0.5, a GPG signature will be provided in `signatures`. + +The current signature is called `cagebreak.sig`, whereas all older signatures +will be named after their release version. ### Fuzzing diff --git a/cagebreak.c b/cagebreak.c index 4a71480..1adc5a1 100644 --- a/cagebreak.c +++ b/cagebreak.c @@ -160,7 +160,7 @@ parse_args(struct cg_server *server, int argc, char *argv[]) { usage(stdout, argv[0]); return false; case 'v': - fprintf(stdout, "Cagebreak version " CG_VERSION "\n"); + fprintf(stdout, "Cagebreak version 1.0.6\n"); exit(0); default: usage(stderr, argv[0]); diff --git a/meson.build b/meson.build index 46f2547..419e625 100644 --- a/meson.build +++ b/meson.build @@ -1,5 +1,5 @@ project('cagebreak', 'c', - version: '1.0.5', + version: '1.0.6', license: 'MIT', default_options: [ 'c_std=c11', @@ -64,6 +64,7 @@ xkbcommon = dependency('xkbcommon') cairo = dependency('cairo') pango = dependency('pango') pangocairo = dependency('pangocairo') +fontconfig = dependency('fontconfig') math = cc.find_library('m') wl_protocol_dir = wayland_protos.get_pkgconfig_variable('pkgdatadir') @@ -173,19 +174,49 @@ foreach header : cagebreak_header_strings cagebreak_headers += files(header) endforeach -cagebreak_dependencies = [ - server_protos, - wayland_server, - wayland_client, - wayland_cursor, - wlroots, - xkbcommon, - pixman, - math, - pango, - cairo, - pangocairo, -] +cagebreak_dependencies_dict = { + 'server_protos': server_protos, + 'wayland_server': wayland_server, + 'wayland_client': wayland_client, + 'wayland_cursor': wayland_cursor, + 'wlroots': wlroots, + 'xkbcommon': xkbcommon, + 'fontconfig': fontconfig, + 'pixman': pixman, + 'pango': pango, + 'cairo': cairo, + 'pangocairo': pangocairo, + 'math': math +} + +reproducible_build_versions = { + 'server_protos': '1.0.5', + 'wayland_server': '1.18.0', + 'wayland_client': '1.18.0', + 'wayland_cursor': '1.18.0', + 'wlroots': '0.10.1', + 'xkbcommon': '0.10.0', + 'fontconfig': '2.13.91', + 'pixman': '0.38.4', + 'pango': '1.44.7', + 'cairo': '1.17.3', + 'pangocairo': '1.44.7', + 'math': '-1' +} + +cagebreak_dependencies = [] + +foreach name, dep : cagebreak_dependencies_dict + cagebreak_dependencies += dep +endforeach + +foreach name, dep : cagebreak_dependencies_dict + if reproducible_build_versions[name] != '-1' and reproducible_build_versions[name] != dep.version() + warning('The installed version of "' + name + '" on your machine (' + dep.version() + ') differs from the one used to generate the binary specified in the README section "Reproducible Builds" (' + reproducible_build_versions[name] + '). Cagebreak does not guarantee a reproducible build for this configuration.' + ) + break + endif +endforeach executable( meson.project_name(), diff --git a/signatures/cagebreak.sig b/signatures/cagebreak.sig new file mode 100644 index 0000000..e742f26 Binary files /dev/null and b/signatures/cagebreak.sig differ