Skip to content

Commit 4ea159b

Browse files
eserileveserilev
committed
Resolve merge conflicts
2 parents 0d8160f + 90dd5bb commit 4ea159b

File tree

46 files changed

+860
-903
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+860
-903
lines changed

‎.github/workflows/docker-reproducible.yml‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
name: docker-reproducible
2+
3+
on:
4+
push:
5+
branches:
6+
- unstable
7+
- stable
8+
tags:
9+
- v*
10+
workflow_dispatch: # allows manual triggering for testing purposes and skips publishing an image
11+
12+
env:
13+
DOCKER_REPRODUCIBLE_IMAGE_NAME: >-
14+
${{ github.repository_owner }}/lighthouse-reproducible
15+
DOCKER_PASSWORD: ${{ secrets.DH_KEY }}
16+
DOCKER_USERNAME: ${{ secrets.DH_ORG }}
17+
18+
jobs:
19+
extract-version:
20+
name: extract version
21+
runs-on: ubuntu-22.04
22+
steps:
23+
- name: Extract version
24+
run: |
25+
if [[ "${{ github.ref }}" == refs/tags/* ]]; then
26+
# It's a tag (e.g., v1.2.3)
27+
VERSION="${GITHUB_REF#refs/tags/}"
28+
elif [[ "${{ github.ref }}" == refs/heads/stable ]]; then
29+
# stable branch -> latest
30+
VERSION="latest"
31+
elif [[ "${{ github.ref }}" == refs/heads/unstable ]]; then
32+
# unstable branch -> latest-unstable
33+
VERSION="latest-unstable"
34+
else
35+
# For manual triggers from other branches and will not publish any image
36+
VERSION="test-build"
37+
fi
38+
echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
39+
id: extract_version
40+
outputs:
41+
VERSION: ${{ steps.extract_version.outputs.VERSION }}
42+
43+
verify-and-build:
44+
name: verify reproducibility and build
45+
needs: extract-version
46+
strategy:
47+
matrix:
48+
arch: [amd64, arm64]
49+
include:
50+
- arch: amd64
51+
rust_target: x86_64-unknown-linux-gnu
52+
rust_image: >-
53+
rust:1.88-bullseye@sha256:8e3c421122bf4cd3b2a866af41a4dd52d87ad9e315fd2cb5100e87a7187a9816
54+
platform: linux/amd64
55+
runner: ubuntu-22.04
56+
- arch: arm64
57+
rust_target: aarch64-unknown-linux-gnu
58+
rust_image: >-
59+
rust:1.88-bullseye@sha256:8b22455a7ce2adb1355067638284ee99d21cc516fab63a96c4514beaf370aa94
60+
platform: linux/arm64
61+
runner: ubuntu-22.04-arm
62+
runs-on: ${{ matrix.runner }}
63+
steps:
64+
- uses: actions/checkout@v4
65+
66+
- name: Set up Docker Buildx
67+
uses: docker/setup-buildx-action@v3
68+
with:
69+
driver: docker
70+
71+
- name: Verify reproducible builds (${{ matrix.arch }})
72+
run: |
73+
# Build first image
74+
docker build -f Dockerfile.reproducible \
75+
--platform ${{ matrix.platform }} \
76+
--build-arg RUST_TARGET="${{ matrix.rust_target }}" \
77+
--build-arg RUST_IMAGE="${{ matrix.rust_image }}" \
78+
-t lighthouse-verify-1-${{ matrix.arch }} .
79+
80+
# Extract binary from first build
81+
docker create --name extract-1-${{ matrix.arch }} lighthouse-verify-1-${{ matrix.arch }}
82+
docker cp extract-1-${{ matrix.arch }}:/lighthouse ./lighthouse-1-${{ matrix.arch }}
83+
docker rm extract-1-${{ matrix.arch }}
84+
85+
# Clean state for second build
86+
docker buildx prune -f
87+
docker system prune -f
88+
89+
# Build second image
90+
docker build -f Dockerfile.reproducible \
91+
--platform ${{ matrix.platform }} \
92+
--build-arg RUST_TARGET="${{ matrix.rust_target }}" \
93+
--build-arg RUST_IMAGE="${{ matrix.rust_image }}" \
94+
-t lighthouse-verify-2-${{ matrix.arch }} .
95+
96+
# Extract binary from second build
97+
docker create --name extract-2-${{ matrix.arch }} lighthouse-verify-2-${{ matrix.arch }}
98+
docker cp extract-2-${{ matrix.arch }}:/lighthouse ./lighthouse-2-${{ matrix.arch }}
99+
docker rm extract-2-${{ matrix.arch }}
100+
101+
# Compare binaries
102+
echo "=== Comparing binaries ==="
103+
echo "Build 1 SHA256: $(sha256sum lighthouse-1-${{ matrix.arch }})"
104+
echo "Build 2 SHA256: $(sha256sum lighthouse-2-${{ matrix.arch }})"
105+
106+
if cmp lighthouse-1-${{ matrix.arch }} lighthouse-2-${{ matrix.arch }}; then
107+
echo "Reproducible build verified for ${{ matrix.arch }}"
108+
else
109+
echo "Reproducible build FAILED for ${{ matrix.arch }}"
110+
echo "BLOCKING RELEASE: Builds are not reproducible!"
111+
echo "First 10 differences:"
112+
cmp -l lighthouse-1-${{ matrix.arch }} lighthouse-2-${{ matrix.arch }} | head -10
113+
exit 1
114+
fi
115+
116+
# Clean up verification artifacts but keep one image for publishing
117+
rm -f lighthouse-*-${{ matrix.arch }}
118+
docker rmi lighthouse-verify-1-${{ matrix.arch }} || true
119+
120+
# Re-tag the second image for publishing (we verified it's identical to first)
121+
VERSION=${{ needs.extract-version.outputs.VERSION }}
122+
FINAL_TAG="${{ env.DOCKER_REPRODUCIBLE_IMAGE_NAME }}:${VERSION}-${{ matrix.arch }}"
123+
docker tag lighthouse-verify-2-${{ matrix.arch }} "$FINAL_TAG"
124+
125+
- name: Log in to Docker Hub
126+
if: ${{ github.event_name != 'workflow_dispatch' }}
127+
uses: docker/login-action@v3
128+
with:
129+
username: ${{ env.DOCKER_USERNAME }}
130+
password: ${{ env.DOCKER_PASSWORD }}
131+
132+
- name: Push verified image (${{ matrix.arch }})
133+
if: ${{ github.event_name != 'workflow_dispatch' }}
134+
run: |
135+
VERSION=${{ needs.extract-version.outputs.VERSION }}
136+
IMAGE_TAG="${{ env.DOCKER_REPRODUCIBLE_IMAGE_NAME }}:${VERSION}-${{ matrix.arch }}"
137+
docker push "$IMAGE_TAG"
138+
139+
- name: Clean up local images
140+
run: |
141+
docker rmi lighthouse-verify-2-${{ matrix.arch }} || true
142+
VERSION=${{ needs.extract-version.outputs.VERSION }}
143+
docker rmi "${{ env.DOCKER_REPRODUCIBLE_IMAGE_NAME }}:${VERSION}-${{ matrix.arch }}" || true
144+
145+
- name: Upload verification artifacts (on failure)
146+
if: failure()
147+
uses: actions/upload-artifact@v4
148+
with:
149+
name: verification-failure-${{ matrix.arch }}
150+
path: |
151+
lighthouse-*-${{ matrix.arch }}
152+
153+
create-manifest:
154+
name: create multi-arch manifest
155+
runs-on: ubuntu-22.04
156+
needs: [extract-version, verify-and-build]
157+
if: ${{ github.event_name != 'workflow_dispatch' }}
158+
steps:
159+
- name: Log in to Docker Hub
160+
uses: docker/login-action@v3
161+
with:
162+
username: ${{ env.DOCKER_USERNAME }}
163+
password: ${{ env.DOCKER_PASSWORD }}
164+
165+
- name: Create and push multi-arch manifest
166+
run: |
167+
IMAGE_NAME=${{ env.DOCKER_REPRODUCIBLE_IMAGE_NAME }}
168+
VERSION=${{ needs.extract-version.outputs.VERSION }}
169+
170+
# Create manifest for the version tag
171+
docker manifest create \
172+
${IMAGE_NAME}:${VERSION} \
173+
${IMAGE_NAME}:${VERSION}-amd64 \
174+
${IMAGE_NAME}:${VERSION}-arm64
175+
176+
docker manifest push ${IMAGE_NAME}:${VERSION}

‎.vscode/settings.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"rust-analyzer.cargo.cfgs": [
3+
"!debug_assertions"
4+
]
5+
}

‎Cargo.lock‎

Lines changed: 26 additions & 58 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)