Add reproducible Windows shim build + CI verification - #154
Closed
bigfootjon wants to merge 2 commits into
Closed
Conversation
Make the Windows shim build byte-for-byte reproducible and add a CI job that rebuilds it and fails if the checked-in binaries are stale. - release.py now links with the toolchain-bundled rust-lld (no MSVC "Rich" header) and passes /Brepro for content-hashed timestamps, so the output depends only on the pinned toolchain. It also accepts an optional target triple so CI can build one architecture per native runner. - Pin rust-toolchain.toml to a dated nightly so the reproducible output is stable over time. - Add the verify-windows-shim workflow: builds x86_64 on windows-latest and aarch64 on windows-11-arm, uploads each rebuilt .exe as an artifact, then fails on `git diff` if the committed binary differs. The artifact-before- check ordering lets contributors without a Windows machine download the correct binaries from the run and commit them. - Update windows_shim/README.md and website/docs/windows.md accordingly. Note: the checked-in .exe files still need to be regenerated (via CI artifacts or `py release.py`) to match the new reproducible build.
Contributor
|
This pull request has been imported. If you are a Meta employee, you can view this in D114251821. (Because this pull request was imported automatically, there will not be any future comments.) |
Contributor
|
@bigfootjon merged this pull request in ba6b861. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make the Windows shim build byte-for-byte reproducible and add a CI job that rebuilds it and fails if the checked-in binaries are stale.
git diffif the committed binary differs. The artifact-before- check ordering lets contributors without a Windows machine download the correct binaries from the run and commit them.Note: the checked-in .exe files still need to be regenerated (via CI artifacts or
py release.py) to match the new reproducible build.