fix: guarantee wasm build reproducibility via dockerized make target - #724
fix: guarantee wasm build reproducibility via dockerized make target#724bbkenny wants to merge 4 commits into
Conversation
Added a Makefile utilizing the official stellar/rs-soroban-sdk docker image to ensure the WASM bytecode generated is deterministic. This resolves the security concern where deployed contracts could not be independently verified against source. Also updated docs, changelog, and removed a stray unlinked file to clear compilation blockers.
|
@bbkenny Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
|
Hey @Iris-IV, apologies for the CI failure! I just pushed a fix to remove some stray, orphaned blocks of code ( |
davidmaronio
left a comment
davidmaronio
left a comment
There was a problem hiding this comment.
thanks for tackling reproducible builds, and the makefile itself is clean and minimal. removing the orphaned duplicate-contract blocks in admin.rs/lib.rs/campaigns.rs that were breaking compilation is also a genuinely useful cleanup. a few asks though:
- Makefile:9 - the image
stellar/rs-soroban-sdk:20.1.0is the sdk build image, and i don't think it ships thestellarcli binary, sostellar contract buildinside it will likely fail. can you confirm you actually ranmake build-dockerend to end and paste the resulting wasm hash? if the cli isn't in that image, pinstellar/stellar-cli(or the soroban-dev image) at a specific digest instead. pinning by digest rather than tag is also what actually gives you reproducibility. - Makefile:9 -
$(PWD)should be quoted (-v "$(PWD)":/workspace) or the mount breaks on paths with spaces. - Makefile:9 - consider mounting a cargo cache volume (
-v cargo-cache:/usr/local/cargo/registry) so repeat builds aren't cold every time. not blocking, just a nicety. - src/tests/test_campaign_update.rs:59 - the event payload assertions changing from a 2-tuple to a 4-tuple (old title/desc + new title/desc) isn't mentioned in the pr description and isn't related to docker builds. if this is fixing drift against main's event shape, say so in the description; otherwise it should live in its own pr.
- the pr title says "fix" but half the diff is deleting broken orphan code. worth splitting the description into "build reproducibility" and "compile fixes" sections so reviewers of the changelog can follow what happened.
gate: this branch has merge conflicts with main (DIRTY), so please resolve conflicts and rebase on latest main before this can go in.
2 participants
Closes #533
Summary of Changes
Added a Dockerized Makefile to guarantee that the compiled WASM binary is deterministic and reproducible. Before this, the build process produced different hashes across different host environments, meaning the on-chain bytecode couldn't be independently verified against the source code.
What changed
Makefilewith abuild-dockertarget that mounts the repository into the officialstellar/rs-soroban-sdk:20.1.0image.README.mdandCONTRIBUTING.mdto split local development builds from the reproducible production builds.src/campaigns.rsfile that was orphaned in the repo and failing compilation.Testing / Local Verification
cargo fmt --checkandcargo clippy --all-targets --features testutils -- -D warnings.cargo test --features testutils.