Gramine Reproducible Builds

[flashbots]

Gramine Reproducible Builds

[fnerdman]

@lonerapier For the next step you could split the dockerfile in such way that gramine is built only one time on Machine A, then you copy the resulting image to Machine B, and there you use the copied image as Source image to complete the rest of the execution of the Dockerfile, i.e. build Gramine another time and diffoscope the result.

[lonerapier]

Updates:

1.1 Replicability

• Create a containerized build environment for gramine based on the official debian docker image
• Build gramine within this image and export all the runtime dependencies (meson install --no-rebuild --destdir/ ...)
• create two consecutive builds from scratch and compare the destdirs with diffoscope
• try this on different hardware

We have successfully built gramine twice and compared destdirs on same machine.

The experiment was done in two parts:

1. Same distro (ubuntu:20.04)
2. Different distro (ubuntu:20.04, ubuntu:22.04)

It included running a bash script that builds a docker image containing different builds for gramine and checking it with diffoscope container.

File result can be found here.

Note: --exclude-directory-metadata flag is used to ignore timestamp diffs.

Next steps are to build gramine on different machines.

[fnerdman]

Next tasks:

• present your findings in the gramine ticket gramineproject/gramine#153
• ask for details about the set up and config of the builder machine responsible for the published binaries - possibly some info can be found in https://github.com/gramineproject/gramine/tree/master/.ci
  and https://github.com/gramineproject/gramine/tree/master/.github