feat: verifiable production builds (reproducible-build pipeline)#959
Open
EightRice wants to merge 3 commits into
Open
feat: verifiable production builds (reproducible-build pipeline)#959EightRice wants to merge 3 commits into
EightRice wants to merge 3 commits into
Conversation
… artifact) distribution/ provides a reproducible build pipeline as the first phase of decentralized distribution — parallel to, not replacing, the existing Netlify deployment: - Dockerfile.build: builder pinned by image digest (node 22.12.0 per .nvmrc), SOURCE_DATE_EPOCH from the commit, canonical public env baked from env.build, deterministic tar + sha256 fingerprint (BUILDHASH) - build.sh: builds ONLY committed code (git archive as docker context) - verify.sh: rebuilds a ref and compares against a published hash - env.build: the canonical PUBLIC production env (no secrets by design)
Tagged releases build in the pinned environment, rebuild from scratch, fail unless both fingerprints match, then publish the artifact, BUILDHASH.txt, and per-file manifest on the GitHub Release.
✅ Deploy Preview for tezos-homebase ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
First executed phase of the decentralized-distribution direction — running in parallel with the Netlify deployment, which is unchanged.
distribution/Dockerfile.build— builder pinned by image digest (node 22.12.0 per .nvmrc);SOURCE_DATE_EPOCHfrom the commit; canonical public env; deterministic tar + sha256 fingerprintdistribution/build.sh— builds only committed code (git archiveis the docker context)distribution/verify.sh— rebuilds any ref and compares against a published hashdistribution/env.build— canonical PUBLIC production env (values extracted from the live bundle; no secrets by design).github/workflows/reproducible-build.yml— onv*tags: build, rebuild from scratch, fail unless fingerprints match, publish artifact + hash + manifest on the GitHub ReleaseVerified
Two builds (warm cache, then
--no-cachecold rebuild) produced identical fingerprints:Why
Users run the served bundle, not the source. Reproducibility makes "the deployed app matches the public source" independently checkable — the foundation for content-addressed mirrors and an on-chain release registry (next phases).