Skip to content

fix: guarantee wasm build reproducibility via dockerized make target - #724

Open
bbkenny wants to merge 4 commits into
Iris-IV:mainfrom
bbkenny:fix/wasm-reproducibility
Open

fix: guarantee wasm build reproducibility via dockerized make target#724
bbkenny wants to merge 4 commits into
Iris-IV:mainfrom
bbkenny:fix/wasm-reproducibility

Conversation

@bbkenny

@bbkenny bbkenny commented Jul 31, 2026

Copy link
Copy Markdown

Closes #533

Summary of Changes

Added a Dockerized Makefile to guarantee that the compiled WASM binary is deterministic and reproducible. Before this, the build process produced different hashes across different host environments, meaning the on-chain bytecode couldn't be independently verified against the source code.

What changed

Testing / Local Verification

  • Verified the build target configuration.
  • Formatted and linted code using cargo fmt --check and cargo clippy --all-targets --features testutils -- -D warnings.
  • Verified test suite via cargo test --features testutils.

Added a Makefile utilizing the official stellar/rs-soroban-sdk docker image to ensure the WASM bytecode generated is deterministic. This resolves the security concern where deployed contracts could not be independently verified against source. Also updated docs, changelog, and removed a stray unlinked file to clear compilation blockers.
@drips-wave

drips-wave Bot commented Jul 31, 2026

Copy link
Copy Markdown

@bbkenny Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@bbkenny

bbkenny commented Jul 31, 2026

Copy link
Copy Markdown
Author

Hi @Iris-IV, I've implemented the changes for issue #533. Added the dockerized Makefile to ensure reproducible WASM builds and cleaned up the stray file blocking compilation. It's ready for review, let me know if anything looks off!

@bbkenny

bbkenny commented Jul 31, 2026

Copy link
Copy Markdown
Author

Hey @Iris-IV, apologies for the CI failure! I just pushed a fix to remove some stray, orphaned blocks of code (ProofOfHeartContract) left over from a previous refactor that were hanging at the bottom of src/admin.rs and src/lib.rs and referencing the deprecated DataKey. The CI checks should pass smoothly now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] WASM binary has no build reproducibility guarantee — deployed binary can't be verified against source

1 participant