Reproducable Build

[Stebalien]

Given that the built-in actors will be a critical part of the Filecoin infrastructure, and given that everyone will have to use the same pre-built actors, we really need to consider reproducible builds.

Proposal:

Provide a Dockerfile that:

1. (Optionally) Bootstraps rust.
2. Deterministically builds the actors.

[Kubuxu]

Agreed, I have it in my notes as well as one of the high impact items of importance.
Reproducible Builds are essential to make actor code auditable end-to-end, otherwise without specialised tooling or auditing the wasm code it is impossible to guarantee that the rust code exactly corresponds to whatever is running on-chain.

[Stebalien]

https://github.com/warpfork/warpforge

[lemmih]

A dockerized build environment isn't enough to get reproducible builds. A virtual machine might do the trick but it's a cumbersome and inherently fragile solution.

It might be worthwhile to track down the root causes for the differences and fix them directly (in the crates we're using or in rustc). What are your thoughts on this, @jennijuju / @Stebalien?

[Stebalien]

It might be worthwhile to track down the root causes for the differences and fix them directly (in the crates we're using or in rustc).

Yeah, I think we need to do that. We can probably compile in two different containers, then compare the target directories to figure out what went wrong.

I assume you:

• Picked a specific rustc version.
• Built with cargo --locked.

[Stebalien]

Take a look at https://github.com/CosmWasm/rust-optimizer? Especially https://github.com/CosmWasm/rust-optimizer/blob/main/optimize.sh.

[lemmih]

Hmm, if we're okay with aarch64 and x86-64 giving different results then we might have reproducible results already. I added a bundle-mainnet-repro rule to the Makefile in my latest branch. It should be nearly as robust as CosmWasm.

[Kubuxu]

It is the WASM build we are primarily concerned about.

Also this might be of use although I'm not sure: https://github.com/cbeuw/lotus

[jennijuju]

@lemmih any updates on this?