feat: add reproducible build (#24)

Makefile

@@ -61,13 +61,13 @@ LDFLAGS += -Ldeps/compiler-rt-builtins-riscv/build -lcompiler-rt
 all: out build/ckb-js-vm
 
 out:
-	mkdir -p build
-	mkdir -p build/bytecode
-	mkdir -p build/ckb-c-stdlib
-	mkdir -p build/libc
-	mkdir -p build/nncp
-	mkdir -p build/src
-	mkdir -p build/quickjs
+	@mkdir -p build
+	@mkdir -p build/bytecode
+	@mkdir -p build/ckb-c-stdlib
+	@mkdir -p build/libc
+	@mkdir -p build/nncp
+	@mkdir -p build/src
+	@mkdir -p build/quickjs
 
 deps/compiler-rt-builtins-riscv/build/libcompiler-rt.a:
 	cd deps/compiler-rt-builtins-riscv && make
@@ -146,6 +146,9 @@ fmt:
 		libc/sys/*.h \
 		src/*
 
+checksum: all
+	shasum -a 256 build/ckb-js-vm > checksums.txt
+
 install:
 	wget 'https://github.com/nervosnetwork/ckb-standalone-debugger/releases/download/v0.119.0/ckb-debugger-linux-x64.tar.gz'
 	tar zxvf ckb-debugger-linux-x64.tar.gz

checksums.txt

@@ -0,0 +1 @@
+4ac7f135b75e178074bbfd0574c0f6dc4ab93f727e016810bb8fdc8bf080bc7a  build/ckb-js-vm

reproducible_build.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+#
+# An utility script helping with reproducible script builds via docker.
+# Note that this utility serves only as one example, docker is not
+# necessarily THE way to do reproducible build, nor is it the best way
+# to do reproducible build.
+set -e
+
+cleanup() {
+    exit_code=$?
+    if [ $exit_code -ne 0 ]; then
+        echo "Script exited with error code $exit_code"
+    fi
+}
+
+trap cleanup EXIT
+
+DOCKER="${DOCKER:-docker}"
+# docker pull docker.io/cryptape/llvm-n-rust:20240630
+DOCKER_IMAGE="${DOCKER_IMAGE:-docker.io/cryptape/llvm-n-rust@sha256:bafaf76d4f342a69b8691c08e77a330b7740631f3d1d9c9bee4ead521b29ee55}"
+CHECKSUM_FILE_PATH="${CHECKSUM_FILE_PATH:-checksums.txt}"
+
+# We are parsing command line arguments based on tips from:
+# https://stackoverflow.com/a/14203146
+
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    -p|--proxy)
+      PROXY="$2"
+      shift # past argument
+      shift # past value
+      ;;
+    -u|--update)
+      UPDATE="yes"
+      shift # past argument
+      ;;
+    --no-clean)
+      NOCLEAN="yes"
+      shift # past argument
+      ;;
+    -*|--*)
+      echo "Unknown option $1"
+      exit 1
+      ;;
+    *)
+      echo "Unknown argument $1"
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -n "${PROXY}" ]]; then
+  DOCKER_RUN_ARGS="-e ALL_PROXY=${PROXY} -e HTTPS_PROXY=${PROXY} -e HTTP_PROXY=${PROXY} ${DOCKER_RUN_ARGS}"
+fi
+
+TASKS=""
+if [[ "${NOCLEAN}" != "yes" ]]; then
+  TASKS+=" clean "
+fi
+
+if [[ "${UPDATE}" = "yes" ]]; then
+  TASKS+=" checksum"
+else
+  TASKS+=" all "
+fi
+
+$DOCKER run --rm $DOCKER_RUN_ARGS -e UID=`id -u` -e GID=`id -g` -v `pwd`:/code $DOCKER_IMAGE make $TASKS
+# Reset file ownerships for all files docker might touch
+$DOCKER run --rm $DOCKER_RUN_ARGS -e UID=`id -u` -e GID=`id -g` -v `pwd`:/code $DOCKER_IMAGE bash -c 'chown -R -f $UID:$GID build'
+
+if [[ "${UPDATE}" = "yes" ]]; then
+    echo "${CHECKSUM_FILE_PATH} file is updated with latest binary hashes!"
+else
+    echo "checking checksums..."
+    shasum -a 256 -c ${CHECKSUM_FILE_PATH}
+fi