Merge #244: Restructure the reproducible builds folders

ffbe2f71d36ac1125e749efcaf7882a6f2c46c33 guix update Miniscript branch in cargo config (Antoine Poinsot)
b7e349459d7cadf227d2bd13fa970ed230103e41 guix: create the cargo config in the repo directory, not home (Antoine Poinsot)
b0ade5993745951b113f2c8aff26cf0b4b53aa16 README: mention reproducible builds (Antoine Poinsot)
01481ba7d7d3fd1c9b42ddafb22e5fdcb9f08976 contrib: move the docker and guix folders under a single 'reproducible' (Antoine Poinsot)

Pull request description:

  Better to have those under a single, more meaningful, folder.

ACKs for top commit:
  darosior:
    self-ACK ffbe2f71d36ac1125e749efcaf7882a6f2c46c33

Tree-SHA512: 2f1763a952f51046ec9e8d9ea545680452aa5716fd30973bc3f4096d40e21f8b5f8479f492a3b9d02f1fff21b57835cbf0cf3044e8211501cf5077b553b454fe

.dockerignore

@@ -1,4 +1,4 @@
 *
 !Cargo.*
 !gui/Cargo.*
-!contrib/docker/cargo_config.toml
+!contrib/reproducible/docker/cargo_config.toml

README.md

@@ -44,6 +44,8 @@ build the project from source, see [`doc/BUILD.md`](doc/BUILD.md).
 
 TODO: instructions for downloading a release and verifying the signatures.
 
+Releases of Liana are reproducibly built. See [`contrib/reproducible`](contrib/reproducible) for
+details and instructions if you want to check a release.
 
 ### Setting up a wallet
 

contrib/reproducible/README.md

@@ -0,0 +1,17 @@
+# Liana reproducible builds
+
+Releases of Liana are built in a reproducible manner, providing an assurance the binary a user is
+going to run corresponds to the sources published. It enables the possibility for the user, or a
+third party, to audit the code being ran.
+
+For Linux binaries (and hopefully soon for all hosts) we go further and provide bootstrappable
+builds, where the toolchain used to compile the source code reproducibly is itself built
+reproducibly from source.
+
+Learn more about reproducible builds [here](https://reproducible-builds.org/), and bootstrappable
+builds [here](https://bootstrappable.org/).
+
+For instructions on bootstrappable builds of Linux releases, see the [`guix`](./guix) folder.
+
+For instructions on reproducible builds of Windows and MacOS releases, see the [`docker`](./docker)
+folder.

contrib/reproducible/docker/README.md

@@ -29,5 +29,5 @@ path to the script by setting the `XCODE_PATH` env var).
 
 Finally, run the script from the root of the repository:
 ```
-./contrib/docker/docker-build.sh
+./contrib/reproducible/docker/docker-build.sh
 ```

contrib/reproducible/docker/docker-build.sh

@@ -7,10 +7,10 @@ TARGET_DIR="${TARGET_DIR:-"$PWD/deter_build_target"}"
 XCODE_PATH="${XCODE_PATH:-"$PWD/Xcode_12.2.xip"}"
 
 # Build (only) the Liana GUI on Windows.
-docker build . -t liana_cross_win -f contrib/docker/windows.Dockerfile
+docker build . -t liana_cross_win -f contrib/reproducible/docker/windows.Dockerfile
 docker run --rm -ti \
     -v "$TARGET_DIR/gui":/liana/target \
-    -v "$PWD/contrib/docker":/liana/docker \
+    -v "$PWD/contrib/reproducible/docker":/liana/docker \
     -v "$PWD/gui/src":/liana/src \
     -v "$PWD/gui/static":/liana/static \
     liana_cross_win
@@ -22,11 +22,11 @@ if ! $(echo "28d352f8c14a43d9b8a082ac6338dc173cb153f964c6e8fb6ba389e5be528bd0 $(
 fi
 
 # Build both the Liana daemon and GUI on MacOS.
-docker build . -t liana_cross_mac -f contrib/docker/macos.Dockerfile
+docker build . -t liana_cross_mac -f contrib/reproducible/docker/macos.Dockerfile
 docker run --rm -ti \
     -v "$TARGET_DIR":/liana/target \
     -v "$TARGET_DIR/gui":/liana/gui/target \
-    -v "$PWD/contrib/docker":/liana/docker \
+    -v "$PWD/contrib/reproducible/docker":/liana/docker \
     -v "$PWD/src":/liana/src \
     -v "$PWD/gui/src":/liana/gui/src \
     -v "$PWD/gui/static":/liana/gui/static \

contrib/reproducible/docker/macos.Dockerfile

@@ -46,8 +46,8 @@ RUN /liana/rust-1.65.0-x86_64-unknown-linux-gnu/cargo/bin/cargo vendor && \
     cd ..
 
 # Cargo configuration for using the vendored dependencies during the builds.
-COPY contrib/docker/cargo_config.toml /liana/.cargo/cargo_config.toml
-COPY contrib/docker/cargo_config.toml /liana/gui/.cargo/cargo_config.toml
+COPY contrib/reproducible/docker/cargo_config.toml /liana/.cargo/cargo_config.toml
+COPY contrib/reproducible/docker/cargo_config.toml /liana/gui/.cargo/cargo_config.toml
 
 # For some reason, we can't just set the RUSTFLAGS environment variable to add `-L` for compiling dependencies.
 # This doesn't work: RUSTFLAGS="-L/liana/rust-1.65.0-x86_64-apple-darwin/rust-std-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/"

contrib/reproducible/docker/windows.Dockerfile

@@ -28,7 +28,7 @@ COPY gui/Cargo.toml gui/Cargo.lock /liana/
 RUN /liana/rust-1.65.0-x86_64-unknown-linux-gnu/cargo/bin/cargo vendor
 
 # Cargo configuration for using the vendored dependencies during the build.
-COPY contrib/docker/cargo_config.toml /liana/.cargo/cargo_config.toml
+COPY contrib/reproducible/docker/cargo_config.toml /liana/.cargo/cargo_config.toml
 
 # For some reason, we can't just set the RUSTFLAGS environment variable to add `-L` for compiling dependencies.
 # This doesn't work: RUSTFLAGS="-L /liana/rust-1.65.0-x86_64-pc-windows-gnu/rust-std-x86_64-pc-windows-gnu/lib/rustlib/x86_64-pc-windows-gnu/lib/ -L /liana/rust-1.65.0-x86_64-unknown-linux-gnu/rust-std-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/lib/"

contrib/reproducible/guix/README.md

@@ -119,7 +119,7 @@ Override the default list of substitute servers by passing the
 guix <cmd> --substitute-urls='https://guix.carldong.io https://ci.guix.gnu.org'
 ```
 
-For scripts under `./contrib/guix`, set the `SUBSTITUTE_URLS` environment
+For scripts under `./contrib/reproducible/guix`, set the `SUBSTITUTE_URLS` environment
 variable:
 
 ```sh
@@ -159,7 +159,7 @@ the `build.sh` script that will take care of building the dependencies and the p
 
 To start a build, simply run the `guix-build.sh` script from the root of the repository:
 ```
-$ ./contrib/guix/guix-build.sh
+$ ./contrib/reproducible/guix/guix-build.sh
 ```
 
 The script shouldn't contain any bash-ism, so it should work with other shells as well.

contrib/reproducible/guix/build.sh

@@ -5,8 +5,8 @@
 set -ex
 
 # Instruct cargo to use our vendored sources
-mkdir -p ~/.cargo
-cat <<EOF >~/.cargo/config.toml
+mkdir -p .cargo
+cat <<EOF >.cargo/config.toml
 [source.vendored_sources]
 directory = "/vendor"
 
@@ -15,7 +15,7 @@ replace-with = "vendored_sources"
 
 [source."https://github.com/darosior/rust-miniscript"]
 git = "https://github.com/darosior/rust-miniscript"
-branch = "multipath_descriptors_on_8.0"
+branch = "multipath_descriptors_on_9.0"
 replace-with = "vendored_sources"
 
 [source."https://github.com/revault/liana"]

contrib/reproducible/guix/guix-build.sh

@@ -60,7 +60,7 @@ for project_folder in "" "gui"; do
     PROJECT_ROOT="$PWD/$project_folder"
     PROJECT_VENDOR_DIR="$VENDOR_DIR/$project_folder"
     PROJECT_OUT_DIR="$OUT_DIR/$project_folder"
-    PROJECT_PATCHES_ROOT="$PWD/contrib/guix/patches/$project_folder"
+    PROJECT_PATCHES_ROOT="$PWD/contrib/reproducible/guix/patches/$project_folder"
 
     project_needs_patches() {
         test $(ls -A1q "$PROJECT_PATCHES_ROOT" |grep patch)
@@ -122,7 +122,7 @@ for project_folder in "" "gui"; do
                --expose="$PWD/gui/static=/liana/static" \
                --expose="$PROJECT_ROOT/Cargo.toml=/liana/Cargo.toml" \
                --expose="$BUILD_ROOT/Cargo.lock=/liana/Cargo.lock" \
-               --expose="$PWD/contrib/guix/build.sh=/liana/build.sh" \
+               --expose="$PWD/contrib/reproducible/guix/build.sh=/liana/build.sh" \
                --expose="$PROJECT_VENDOR_DIR=/vendor" \
                --share="$PROJECT_OUT_DIR=/out" \
                --cores="$JOBS" \
@@ -130,7 +130,7 @@ for project_folder in "" "gui"; do
                --pure \
                --fallback \
                --rebuild-cache \
-               -m $PWD/contrib/guix/manifest.scm \
+               -m $PWD/contrib/reproducible/guix/manifest.scm \
                -- env CC=gcc VENDOR_DIR="$PROJECT_VENDOR_DIR" TARGET_DIR="$PROJECT_OUT_DIR" BINARY_NAME="$BINARY_NAME" JOBS="$JOBS" \
                   /bin/sh -c "cd /liana && ./build.sh"
 done