New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CI: release: enable reproducible builds #403

Merged

giuseppe merged 1 commit into containers:main from AkihiroSuda:repro

Sep 14, 2023

+96 −88

Commits on Sep 13, 2023

CI: release: enable reproducible builds

The binaries are now bit-for-bit reproducible (<https://reproducible-builds.org/>):
```bash
docker buildx build \
   -o /tmp/fuse-overlayfs-builds \
   --build-arg SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) \
   --platform=amd64,arm64,arm,s390x,ppc64le,riscv64 \
   -f Containerfile.cross .
```

This ensures that the binaries are not built from any unpublished source.

- Implementation is similar to <rootless-containers/slirp4netns@v1.2.1...v1.2.2>
- `/etc/apt/sources.list` is modified to use <http://snapshot.ubuntu.com> using
  <https://github.com/reproducible-containers/repro-sources-list.sh>.
- As <http://snapshot.ubuntu.com> is slow, `/var/cache/apt` is cached on GHA using
  <https://github.com/reproducible-containers/buildkit-cache-dance>.
- For testing sake, `.github/workflows/release.yaml` is now executed for every push events.
  The release artifacts are published only on a push event with a `v*` tag.

Signed-off-by: Akihiro Suda <[email protected]>

AkihiroSuda committed Sep 13, 2023