How to Check Deterministic Builds

Started by qvqc, Sep 10, 2020, 02:58 PM

Previous topic - Next topic

qvqc

Wownero uses gitian build process for building the CLI executables.  It provides a way to be reasonably sure that the executables are really built from the git source. It also makes sure that the same, tested dependencies are used and statically built into the executable.

This means you can help by building wow locally and checking the produced fingerprints against those provided by wownero.org.  You will need 2+ CPUs, 8gb of ram, and 30gb disk space. Follow along for details..

**Install Ubuntu 18.04**
For everyone to get similar results we use an identical build system.  This script is based on Ubuntu 18.04.  Install the base system, login with default user.  If you have enough resources this works fine in a virtual machine.

**Update Ubuntu**
`sudo apt update && sudo apt upgrade`

**Install docker**
`sudo apt-get install git make curl docker.io`

**Add yourself to the docker group**
`sudo usermod -aG docker ${USER}`

**Update group permissions(re-login)**
`su - ${USER}`


**Clone Wownero**
`git clone https://git.wownero.com/wownero/wownero`

**Setup Gitian (replace qvqc with ur git user)**
`cp wownero/contrib/gitian/gitian-build.py .`
`./gitian-build.py --setup --docker qvqc v0.9.0.2`

**Get OSX SDK**
`wget https://bitcoincore.org/depends-sources/sdks/MacOSX10.11.sdk.tar.gz -P builder/inputs/`

**Run Builds (replace qvqc with ur git user)**
`./gitian-build.py --os lfwm --detach-sign --jobs 2 --memory 7000 --no-commit --docker --build qvqc v0.9.0.2`

**Success?!**
If your build finishes with out fail you will be provided with sha256 output along the lines of:
```
6a1c4cfa312d29f854dae623f9246e92fc27c006a22d7d54a889002c2df10171  wownero-aarch64-linux-gnu-v0.9.0.2.tar.bz2
00fb02b356cb5f9d5143d8ea11da68daa0ab24ee91471e2b564a1dbaffe73756  wownero-arm-linux-gnueabihf-v0.9.0.2.tar.bz2
499ba7a3e1f75f23ea7f7a03e75ef801541698a3045d728daf41b71d4fd65a38  wownero-x86_64-linux-gnu-v0.9.0.2.tar.bz2
613983af763d7f14a4e910a20f90add2a168edf797c38348cf6ad92ee569f9d6  wownero-x86_64-unknown-freebsd-v0.9.0.2.tar.bz2
e8b3c39686de0f0cc3b03bb57a1c5ce3835fcd00896d2740f2a0595a5736e5f8  wownero-x86_64-w64-mingw32-v0.9.0.2.zip
d13fabc83dabe5ebbdb712f5e87f434f4149a5c17ec0e0be63097c1f3d5d56f0  wownero-x86_64-apple-darwin11-v0.9.0.2.tar.bz2
```

**Checking Results**
Take the fingerprints you received in log,  post them in the forum, and compare them to the fingerprints of releases posted here https://git.wownero.com/wownero/wownero/releases .  

You can check releases locally by downloading it to your machine and running shasum on each release file:
`sha256sum wownero-x86_64-linux-gnu-v0.9.0.2.tar.bz2`
 
You are helping ensure a uniform cross platform release process!   Wow!

wowario

(post withdrawn by author, will be automatically deleted in 24 hours unless flagged)

lza_menace

Leaving this here for myself:
```
export GIT_USER=lza_menace
export WOW_TAG=v0.9.1.0

sudo apt update && sudo apt upgrade
sudo apt-get install git make curl docker.io
sudo usermod -aG docker ${USER}
su - ${USER}
git clone https://git.wownero.com/wownero/wownero
cp wownero/contrib/gitian/gitian-build.py .
./gitian-build.py --setup --docker ${GIT_USER} ${WOW_TAG}
wget https://bitcoincore.org/depends-sources/sdks/MacOSX10.11.sdk.tar.gz -P builder/inputs/
./gitian-build.py --os lfwm --detach-sign --jobs 2 --memory 7000 --no-commit --docker --build ${GIT_USER} ${WOW_TAG}
```