From ac53ed5b7b6b921a78e793f1121bd153b423ee99 Mon Sep 17 00:00:00 2001 From: antondlr Date: Tue, 21 Apr 2026 09:12:29 +0200 Subject: [PATCH] Remove double-build verification, fix AppImage SVG MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The double-build check ran both passes on the same runner/daemon/filesystem — any non-determinism it could catch is already eliminated by the build pins (SOURCE_DATE_EPOCH, compiler digest, pinned deps). Replace with a single build that prints the binary SHA256 for external verification. SVG: add Sigma Prime brand color background (#CC00A0), white logo mark. Co-Authored-By: Claude Sonnet 4 --- .github/workflows/reproducible.yml | 67 +++++++----------------------- packaging/appimage/lighthouse.svg | 5 ++- 2 files changed, 18 insertions(+), 54 deletions(-) diff --git a/.github/workflows/reproducible.yml b/.github/workflows/reproducible.yml index b1409dd610..290b0ef339 100644 --- a/.github/workflows/reproducible.yml +++ b/.github/workflows/reproducible.yml @@ -66,56 +66,28 @@ jobs: with: driver: docker - # ── Step 1: Build twice and verify bit-for-bit reproducibility ────────── - - name: Build image (pass 1) + # ── Step 1: Build image and extract binary ─────────────────────────────── + - name: Build image run: | docker build -f Dockerfile.reproducible \ --platform ${{ matrix.platform }} \ --build-arg RUST_TARGET="${{ matrix.rust_target }}" \ - -t lighthouse-verify-1 . + -t lighthouse-build . - - name: Extract binary (pass 1) + - name: Extract binary run: | - docker create --name extract-1 lighthouse-verify-1 - docker cp extract-1:/lighthouse ./lighthouse-1 - docker rm extract-1 + docker create --name extract lighthouse-build + docker cp extract:/lighthouse ./lighthouse-bin + docker rm extract - - name: Clean Docker state between builds - run: | - docker buildx prune -f - docker system prune -f + - name: Print binary SHA256 + run: sha256sum lighthouse-bin - - name: Build image (pass 2) - run: | - docker build -f Dockerfile.reproducible \ - --platform ${{ matrix.platform }} \ - --build-arg RUST_TARGET="${{ matrix.rust_target }}" \ - -t lighthouse-verify-2 . - - - name: Extract binary (pass 2) - run: | - docker create --name extract-2 lighthouse-verify-2 - docker cp extract-2:/lighthouse ./lighthouse-2 - docker rm extract-2 - - - name: Verify reproducibility - run: | - echo "Pass 1 SHA256: $(sha256sum lighthouse-1)" - echo "Pass 2 SHA256: $(sha256sum lighthouse-2)" - if cmp lighthouse-1 lighthouse-2; then - echo "Reproducible build verified for ${{ matrix.arch }}" - else - echo "BLOCKING RELEASE: builds are not reproducible!" - echo "First 10 differing bytes:" - cmp -l lighthouse-1 lighthouse-2 | head -10 - exit 1 - fi - - # ── Step 2: Tag the verified image and push ────────────────────────────── - - name: Tag verified image + # ── Step 2: Tag the image and push ─────────────────────────────────────── + - name: Tag image run: | VERSION=${{ needs.extract-version.outputs.VERSION }} - docker tag lighthouse-verify-2 \ + docker tag lighthouse-build \ ${{ env.DOCKER_REPRODUCIBLE_IMAGE_NAME }}:${VERSION}-${{ matrix.arch }} - name: Log in to Docker Hub @@ -136,7 +108,7 @@ jobs: env: VERSION: ${{ needs.extract-version.outputs.VERSION }} run: | - cp lighthouse-2 lighthouse + cp lighthouse-bin lighthouse tar -czf lighthouse-${VERSION}-${{ matrix.rust_target }}.tar.gz lighthouse sha256sum lighthouse-${VERSION}-${{ matrix.rust_target }}.tar.gz \ > lighthouse-${VERSION}-${{ matrix.rust_target }}.tar.gz.sha256 @@ -155,7 +127,7 @@ jobs: - name: Assemble AppDir run: | mkdir -p AppDir/usr/bin - cp lighthouse-2 AppDir/usr/bin/lighthouse + cp lighthouse-bin AppDir/usr/bin/lighthouse cp packaging/appimage/AppRun AppDir/AppRun chmod +x AppDir/AppRun cp packaging/appimage/lighthouse.desktop AppDir/lighthouse.desktop @@ -220,19 +192,10 @@ jobs: path: lighthouse-${{ needs.extract-version.outputs.VERSION }}-${{ matrix.appimage_arch }}.AppImage.asc compression-level: 0 - - name: Upload verification artifacts on failure - if: failure() - uses: actions/upload-artifact@v4 - with: - name: verification-failure-${{ matrix.arch }} - path: | - lighthouse-1 - lighthouse-2 - - name: Clean up if: always() run: | - docker rmi lighthouse-verify-1 lighthouse-verify-2 || true + docker rmi lighthouse-build || true VERSION=${{ needs.extract-version.outputs.VERSION }} docker rmi ${{ env.DOCKER_REPRODUCIBLE_IMAGE_NAME }}:${VERSION}-${{ matrix.arch }} || true diff --git a/packaging/appimage/lighthouse.svg b/packaging/appimage/lighthouse.svg index c5e2b082d3..3ee0c80a58 100644 --- a/packaging/appimage/lighthouse.svg +++ b/packaging/appimage/lighthouse.svg @@ -1,3 +1,4 @@ - - + + +