v0.2.0: reproducible bass

[vito]

This is the first reproducible release of Bass!

Try downloading one of the attached .json files and running the following:

cat bass.linux-amd64.json | bass --export | tar -xf -
sha256sum bass.linux-amd64.tgz

Compare the output to the attached sha256sums.txt - it should match!

This feat is accomplished through two major changes.

First: Bass now sets all file timestamps in thunk output directories to October 26, 1985 @ 1:15AM PST (continuing the trend from npm). This means hermetic thunks now produce the same results no matter when they run, which is crucial for reproducible builds.

Second: I've switched to using Nix to build the images for the thunks that build Bass itself. This is supported by a new feature: thunks can now use OCI archive images, built by whatever tool you want! Nix provides the largest, most up-to-date software repository making it great for building up-to-date, reproducible container images.

Following that, a promise: Nix will be never required knowledge for using Bass. From Bass's perspective, Nix is just another CLI that it can run, and I happen to want to use it as the project maintainer. Bass and Nix share a lot of goals, but if I rely on it too much it'll become a crutch, preventing valuable improvements to Bass itself and increasing the implied "stuff to learn" for Bass's users, which is an anti-goal.

Anyway - there are a few other features and fixes, so read on for more!

What's Changed

Breaking Changes ⚠️

• (cd) is sticky, propagates to sub-thunks by @vito in (cd) is sticky, propagates to sub-thunks #110

New Features ✨

• using OCI image tarballs as thunk images by @vito in using OCI image tarballs as thunk images #87
• use base64-encoded sha256 instead of sha1 by @vito in use base64-encoded sha256 instead of sha1 #91
• only call (main) for run/read, not (load) by @vito in only call (main) for run/read, not (load) #94
• support remounting thunk output dir by @vito in support remounting thunk output dir #98
• set file mtimes in thunk outputs to 1985-10-26T08:15:00Z by @vito in set file mtimes in thunk outputs to 1985-10-26T08:15:00Z #100

Fixed Bugs 🐛

• fix building Bass for Windows by @vito in fix building Bass for Windows #97
• fix inconsistent hashing of thunks with HTML chars by @vito in fix inconsistent hashing of thunks with HTML chars #102

Documentation 📖

• add CONTRIBUTING.md by @vito in add CONTRIBUTING.md #85
• link to contributing docs, slight docs tweaks by @vito in link to contributing docs, slight docs tweaks #86
• v0.2.0 notes + docs by @vito in v0.2.0 notes + docs #111

Other Changes

• optimize shim memory usage by @vito in optimize shim memory usage #92
• use Nix for building Bass's base images by @vito in use Nix for building Bass's base images #95
• bump to Go 1.18, simpler make-based building by @vito in bump to Go 1.18, simpler make-based building #99
• make shims separately for better caching by @vito in make shims separately for better caching #103
• shipit: publish windows binary, fix zipping by @vito in shipit: publish windows binary, fix zipping #106

Full Changelog: v0.1.1...v0.2.0

---

This discussion was created from the release v0.2.0: reproducible bass.