How to Check Deterministic Builds

Wownero uses gitian build process for building the CLI executables. It provides a way to be reasonably sure that the executables are really built from the git source. It also makes sure that the same, tested dependencies are used and statically built into the executable.

This means you can help by building wow locally and checking the produced fingerprints against those provided by wownero.org. You will need 2+ CPUs, 8gb of ram, and 30gb disk space. Follow along for details…

Install Ubuntu 18.04
For everyone to get similar results we use an identical build system. This script is based on Ubuntu 18.04. Install the base system, login with default user. If you have enough resources this works fine in a virtual machine.

Install docker
sudo apt-get install git make curl docker.io

Add yourself to the docker group.
( Note that this will give docker root access to your system.)
sudo usermod -aG docker $USER

Clone Wownero
git clone https://git.wownero.com/wownero/wownero

Setup Gitian
cp wownero/contrib/gitian/gitian-build.py .
./gitian-build.py --setup --docker $YOURGITUSER $VERSION

Run Builds
./gitian-build.py --os lfwm --detach-sign --jobs 2 --memory 7000 --no-commit --docker --build $YOURGITUSER $VERSION

Success?!
If your build finishes with out fail you will be provided with sha256 output along the lines of:

f6056e45d57471ad1f9b1b47dbd4932763d65fe33ab17596f5036d2d059194c4  wownero-aarch64-linux-gnu-45142e0ec.tar.bz2
a1071d1ceed7d614d4e7551c31e8f3a669c033b176467bde1541bdce24d38b22  wownero-arm-linux-gnueabihf-45142e0ec.tar.bz2
635953df82140d1da8169e1c61fd1d0533cbd02a5a6f42168eaf7ea1cda91e4c  wownero-x86_64-linux-gnu-45142e0ec.tar.bz2
961c23f4a28c1de37abe9d86ab31a055e80c41ecfc33ab50899d18df94853d10  wownero-x86_64-unknown-freebsd-45142e0ec.tar.bz2
2bb557abac58aac33b791dac3e732b794fc6bc307094869837d57a2c342690c2  wownero-x86_64-w64-mingw32-45142e0ec.zip
0d244540aa2395b409d71fe2198b9e612444e951222671e66aea4bdb73d05603  wownero-x86_64-apple-darwin11-45142e0ec.tar.bz2

Checking Results
Take the fingerprints you received in log, post them in the forum, and compare them to the fingerprints of releases posted here https://git.wownero.com/wownero/wownero/releases .

You can check releases locally by downloading it to your machine and running shasum on each release file:
sha256sum wownero-x86_64-linux-gnu-v0.8.0.2.tar.bz2

You are helping ensure a uniform cross platform release process! Wow!

1 Like