[NiKrause]

The build now runs (run 35370252482 got past git describe and produced all three binaries). The step after it did not:

-rwxr-xr-x 1 root root 39260904 electrum-doi-dc4.1.7-portable.exe
-rwxr-xr-x 1 root root 29169608 electrum-doi-dc4.1.7-setup.exe
-rwxr-xr-x 1 root root 39259320 electrum-doi-dc4.1.7.exe
tee: SHA256SUMS: Permission denied

The container writes dist/ as root. The runner user can read the binaries — sha256sum printed all three — but cannot add a file beside them. One chown, and the artifact upload that follows gets its SHA256SUMS.

The run was worth having anyway

Those three hashes do not match the local build, and the sizes differ by a consistent amount:

	local	runner	difference
.exe	39,312,632	39,259,320	53,312 B
-portable.exe	39,314,216	39,260,904	53,312 B
-setup.exe	29,198,432	29,169,608	28,824 B

Same number twice is not noise. deterministic.spec bundles the plugin directory wholesale:

(home+'electrum/plugins', 'electrum/plugins'),

and my working tree had 16 __pycache__ directories with 25 .pyc files in there, ~180 KB uncompressed. Their suffix says where they came from: cpython-39. The Windows build runs Python 3.8 (python38.dll) — these are from my own test runs against that tree, not from the build.

So the first comparison this project has ever run found contamination in the local build, which is exactly the sort of thing it exists to find. A rebuild from a pristine clone of the tag is running now; if it matches the runner, the build is reproducible and the released binaries come from the clean tree.

Worth noting for later: nothing stops this happening again, and the 4.1.6 binaries were built in the same tree. A git clean -xdf (or building from a fresh clone) before a release build would make it impossible — probably belongs in build.sh rather than in a habit.

🤖 Generated with Claude Code