Repository navigation
Build the Windows binaries on a tag, as a second witness - #35
Merged
Merged
Conversation
This project has only ever built on one machine. The binaries users download are connected to the source by one thing: a SHA256SUMS file signed with the maintainer's key. That is the same trust model Electrum uses -- except that upstream has several people building the same tag and comparing hashes, which is what makes a deterministic build worth anything. The pieces for that are already here and have never been exercised: the builder image pins its base by digest and its packages to a dated Debian snapshot, every timestamp in the tree is set to 2000-11-11 before and after the build, and pyinstaller runs from deterministic.spec. Two independent builds should produce byte-identical binaries. So this builds the tag on a runner and prints the hashes. It deliberately attaches nothing to the release: what ships is still built locally and signed locally. What this adds is the ability to say the two agree -- or to find out that they do not, which would be worth knowing. Triggered by a dc* tag, and by hand for a ref, so it is not tied to the order in which a tag and this file arrive. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Answers a question worth asking: the Windows binaries have only ever been built on one machine.
The exes users download are connected to the source by exactly one thing — a
SHA256SUMSfile signed with the maintainer's key. That is the same trust model Electrum uses, with one part missing: upstream has several people building the same tag and comparing hashes. That comparison is what makes a deterministic build worth anything.The pieces are already here, unexercised
debian:trixie@sha256:13f29b68…, pinned by digest20260227T144551Z2000-11-11T11:11:11Z, before and after the builddeterministic.specTwo independent builds should therefore produce byte-identical binaries. Nobody has ever checked.
What this does
Builds the tag on a runner, uploads the artifacts, and prints the hashes into the log — a log line needs no download to compare.
It deliberately attaches nothing to the release. What ships is still built locally and signed locally; the trust model does not change. What this adds is the ability to say the two builds agree, or to discover that they do not.
Triggered by a
dc*tag and byworkflow_dispatchfor an arbitrary ref, so it does not depend on whether the tag or this file lands first.One detail that shaped the workflow:
build-electrum-git.shtakes its version fromgit describe --tags, so the checkout usesfetch-depth: 0— a shallow clone would name the binaries after the previous tag.Not included
macOS, Android, AppImage and the tarball. The old Travis file described all of them; macOS was already disabled there (
if: false, "travis started to always time out").🤖 Generated with Claude Code