Walletwasabi: Deterministic build fails

[molnard]

@nopara73 merged https://github.com/zkSNACKs/WalletWasabi/pull/3872 so with the package.lock file the exact version of every dependency can be controlled.
A couple of issues raised by this and unfortunately it did not solve the original problem, that the deterministic build is not working.

However, after running the packager on windows the lock files grown so I added the changes:

https://github.com/zkSNACKs/WalletWasabi/pull/4075
https://github.com/zkSNACKs/WalletWasabi/pull/4074

• Seemingly if you run publish on different platforms, more and more dependency hashes added.
• If you add /p:RestoreLockedMode=true here it will fail as "hash inconsistency". When I was running the Packager as it is now in the source, without locked mode, I saw that the package.lock files were modified meanwhile the build and only at the end were the same like in the current master. So donet publish is manipulating the lock file according to the runtime platform.

I uploaded some files here to compare the differences

AfterRunningPackager.zip -> the first phase of the packager basically just publish the files and get them ready for packing and signing.

WithOnlyBinaries.zip -> Just ran onlybinaries right after creating the zip above.

Here are the files: https://github.com/molnard/WalletWasabi/releases/tag/v1.1.12rc3

commit b7608c3ef366cc6200e93cca6f74d0497cf37083

[molnard]

The result of two onlybinaries after each other

There is a difference in the windows binaries.
Also as I said before the lock files are modified meanwhile but in the end it will generate what it was at the beginning.

[kiminuo]

Okay, so there are several problems here. Let's solve one at a time:

Issue number 1

The result of two onlybinaries after each other
There is a difference in the windows binaries.

https://github.com/zkSNACKs/WalletWasabi/pull/4083 - This is my attempt to solve that.

Issue number 2

Changing of package.lock.json files during packaging. I have a PR for this: https://github.com/zkSNACKs/WalletWasabi/pull/4086

[kiminuo]

@molnard Could you somehow summarize what's current status after those two PRs? What is the next issue?

[molnard]

@kiminuo so far so good. onlybinaries test works well with current master

Results are only warnings:

PS C:\work\WalletWasabi> git diff --no-index .\WalletWasabi.Gui\bin\dist .\WalletWasabi.Gui\bin\dist1
warning: LF will be replaced by CRLF in .\WalletWasabi.Gui\bin\dist/linux-x64/SOS_README.md.
The file will have its original line endings in your working directory
warning: LF will be replaced by CRLF in .\WalletWasabi.Gui\bin\dist1/linux-x64/SOS_README.md.
The file will have its original line endings in your working directory
warning: LF will be replaced by CRLF in .\WalletWasabi.Gui\bin\dist/osx-x64/SOS_README.md.
The file will have its original line endings in your working directory
warning: LF will be replaced by CRLF in .\WalletWasabi.Gui\bin\dist1/osx-x64/SOS_README.md.
The file will have its original line endings in your working directory

Testing the whole packaging...

[molnard]

Did the whole packing and uploaded the results here https://github.com/molnard/WalletWasabi/releases/tag/v1.1.12rc3

Investigating the deterministic.

[molnard]

On windows I got this:

[kiminuo]

On windows I got this:

Could you share how to reproduce it?

[kiminuo]

What about Linux & macOS?

[molnard]

Interesting finding...

I ran only binaries on my pc win10x64 and on the other PC where I do the releases, win10x64

.NET version 3.1.302
same commit

compare the two results and there are differences.

[kiminuo]

Can you share those two different WalletWasabi.dll files with me?

[molnard]

[yahiheb]

@kiminuo so far so good. onlybinaries test works well with current master

Results are only warnings:

PS C:\work\WalletWasabi> git diff --no-index .\WalletWasabi.Gui\bin\dist .\WalletWasabi.Gui\bin\dist1
warning: LF will be replaced by CRLF in .\WalletWasabi.Gui\bin\dist/linux-x64/SOS_README.md.
The file will have its original line endings in your working directory
warning: LF will be replaced by CRLF in .\WalletWasabi.Gui\bin\dist1/linux-x64/SOS_README.md.
The file will have its original line endings in your working directory
warning: LF will be replaced by CRLF in .\WalletWasabi.Gui\bin\dist/osx-x64/SOS_README.md.
The file will have its original line endings in your working directory
warning: LF will be replaced by CRLF in .\WalletWasabi.Gui\bin\dist1/osx-x64/SOS_README.md.
The file will have its original line endings in your working directory

Testing the whole packaging...

Those warnings are because of end_of_line=lf in the editorconfig which was changed in #3799

[kiminuo]

Those warnings are because of end_of_line=lf in the editorconfig which was changed in #3799

I think it's more like thanks to git setting: core.autocrlf (https://www.git-scm.com/book/en/v2/Customizing-Git-Git-Configuration).

[molnard]

Last status report today. Did the only binaries on both pc.

Disassembled the DLL

I saw only changes that were added by the Disassembler, I guess.

Uploaded the two dll here:
https://github.com/molnard/WalletWasabi/releases/tag/v1.1.12rc3

[molnard]

Status report

I followed this guide: https://github.com/zkSNACKs/WalletWasabi/blob/master/WalletWasabi.Documentation/Guides/DeterministicBuildGuide.md

By fixing this https://github.com/zkSNACKs/WalletWasabi/issues/4090 the situation improved a lot.

Windows

Zero difference

Linux

Zero difference, just line endings in SOS_README.TXT

macOS

Many differences in the binaries. According to Apple documentation, the signature that is used to ensure the integrity of the software is added into the binary itself.

If the code is universal, the object code for each slice (architecture) is signed separately. This signature is stored within the binary file itself.

Source

According to this, it is impossible to have a deterministic build and code signature on macOS.