From 0566029eeb99244b30550cb735d218e1c8520266 Mon Sep 17 00:00:00 2001 From: Cagebreak Signing Key 1 Date: Sun, 29 Mar 2020 09:50:21 +0000 Subject: [PATCH] Release 1.0.6 - Make build reproducible --- README.md | 36 ++++++++++++++++--- meson.build | 75 +++++++++++++++++++++++++-------------- meson_options.txt | 1 + signatures/cagebreak.sig | Bin 0 -> 566 bytes 4 files changed, 82 insertions(+), 30 deletions(-) create mode 100644 signatures/cagebreak.sig diff --git a/README.md b/README.md index 2912c06..c793ac0 100644 --- a/README.md +++ b/README.md @@ -105,6 +105,8 @@ Release checklist * [ ] wiki * [ ] Changelog in README * [ ] Document fixed bugs in Bugs.md + * [ ] Update hashes of the binary + * [ ] Update signature of the binary * [ ] Signature * [ ] Branching Strategy @@ -126,10 +128,36 @@ The full public keys can be found in `keys/` along with any revocation certifica ### Reproducible Builds -Currently our project seems to build the same way on any given system, when compiled -multiple times. However, at the moment we are unable to supply instructions -for building our software reproducibly. Reproducible builds are planned for the -near future. +Cagebreak offers reproducible builds given the exact library versions specified +in `meson.build`. Should a version mismatch occur, a warning will be emitted. We have +decided on this compromise to allow flexibility and security. In general we will +adapt the versions to the packages available under archlinux at the time of +release. + +#### Reproducible Build Instructions + +All hashes and signatures are provided for the following build instructions. + +``` +meson build -Dxwayland=true --buildtype=release +ninja -C build +``` + +#### Hashes for Builds + +For every release after 1.0.5, hashes will be provided. + +1.0.6 + + * sha 256: 712ae9a8f17a9e589e108f0d503da203cc5eaf1c4a6ca6efb5b4c83b432ce0b8 + * sha 512: d574003023a00cfd6623aac986a5a7f397cfd0bc9114017629a8c72731b0df3977c4a31768502dfa8a6607be06930089b2ccf6ffca9b5bcd1096b7ca0aede226 + +#### GPG Signatures + +For every release after 1.0.5, a GPG signature will be provided in `signatures`. + +The current signature is called `cagebreak.sig`, whereas all older signatures +will be named after their release version. ### Fuzzing diff --git a/meson.build b/meson.build index 46f2547..6b2e509 100644 --- a/meson.build +++ b/meson.build @@ -1,5 +1,5 @@ project('cagebreak', 'c', - version: '1.0.5', + version: '1.0.6', license: 'MIT', default_options: [ 'c_std=c11', @@ -64,6 +64,7 @@ xkbcommon = dependency('xkbcommon') cairo = dependency('cairo') pango = dependency('pango') pangocairo = dependency('pangocairo') +fontconfig = dependency('fontconfig') math = cc.find_library('m') wl_protocol_dir = wayland_protos.get_pkgconfig_variable('pkgdatadir') @@ -100,18 +101,10 @@ else have_xwayland = false endif -version = '@0@'.format(meson.project_version()) -git = find_program('git', native: true, required: false) -if git.found() - git_commit = run_command([git, 'rev-parse', '--short', 'HEAD']) - git_branch = run_command([git, 'rev-parse', '--abbrev-ref', 'HEAD']) - if git_commit.returncode() == 0 and git_branch.returncode() == 0 - version = '@0@-@1@ (branch \'@2@\')'.format( - meson.project_version(), - git_commit.stdout().strip(), - git_branch.stdout().strip(), - ) - endif +if get_option('version_override') != '' + version = '@0@'.format(get_option('version_override')) +else + version = '@0@'.format(meson.project_version()) endif conf_data = configuration_data() @@ -173,19 +166,49 @@ foreach header : cagebreak_header_strings cagebreak_headers += files(header) endforeach -cagebreak_dependencies = [ - server_protos, - wayland_server, - wayland_client, - wayland_cursor, - wlroots, - xkbcommon, - pixman, - math, - pango, - cairo, - pangocairo, -] +cagebreak_dependencies_dict = { + 'server_protos': server_protos, + 'wayland_server': wayland_server, + 'wayland_client': wayland_client, + 'wayland_cursor': wayland_cursor, + 'wlroots': wlroots, + 'xkbcommon': xkbcommon, + 'fontconfig': fontconfig, + 'pixman': pixman, + 'pango': pango, + 'cairo': cairo, + 'pangocairo': pangocairo, + 'math': math +} + +reproducible_build_versions = { + 'server_protos': '1.0.6', + 'wayland_server': '1.18.0', + 'wayland_client': '1.18.0', + 'wayland_cursor': '1.18.0', + 'wlroots': '0.10.1', + 'xkbcommon': '0.10.0', + 'fontconfig': '2.13.91', + 'pixman': '0.38.4', + 'pango': '1.44.7', + 'cairo': '1.17.3', + 'pangocairo': '1.44.7', + 'math': '-1' +} + +cagebreak_dependencies = [] + +foreach name, dep : cagebreak_dependencies_dict + cagebreak_dependencies += dep +endforeach + +foreach name, dep : cagebreak_dependencies_dict + if reproducible_build_versions[name] != '-1' and reproducible_build_versions[name] != dep.version() + warning('The installed version of "' + name + '" on your machine (' + dep.version() + ') differs from the one used to generate the binary specified in the README section "Reproducible Builds" (' + reproducible_build_versions[name] + '). Cagebreak does not guarantee a reproducible build for this configuration.' + ) + break + endif +endforeach executable( meson.project_name(), diff --git a/meson_options.txt b/meson_options.txt index 5982c3d..bb96c4f 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -1,2 +1,3 @@ option('xwayland', type: 'boolean', value: 'false', description: 'Enable support for X11 applications') option('fuzz', type: 'boolean', value: 'false', description: 'Enable building fuzzer targets') +option('version_override', type: 'string', description: 'Set the project version to the string specified. Used for creating hashes for reproducible builds.') diff --git a/signatures/cagebreak.sig b/signatures/cagebreak.sig new file mode 100644 index 0000000000000000000000000000000000000000..3a641bee171da79f5d93fc627d5230d0786eb715 GIT binary patch literal 566 zcmV-60?GY}0y6{v0SEvc79j-ZpKYEIH7WG5|K!!g`E=I|>?~Ua0$zY^*8mC$5XAX( z*9`0|Tc$z}|64$gG`MHKZ=AWaCuyalWsk4kO22O@Vk;D@>@jJuMc1+zpA&G+@{_qV zY9~dDUAwMOK2VHMa&iLO!uOvyglM zhBjpy;1P1#FHLT#7v>lpVVi6Z)1C)>q}@RqNpe^BE8D&&DY2=Mik-G~dS%Sl z0UXfHXw_6n^tAebKouvI4 z_=BR(cP)Ly>xoA^o*f2+Q=qp@z(YPty4N-AOu~Yv{8k&L$Lf7F?L)YbTwZlvADEF0 E$r~dTVE_OC literal 0 HcmV?d00001