The script previously assumed libtor.a and libi2pd*.a were already
present, but on a fresh checkout they only exist after running
src/tor/build-libtor.sh and src/i2p/build-libi2pd.sh. CI does this
in build-all.yml but local verification didn't, which bit me during
the v6.1.5 release.
Detect missing static libs and invoke the build scripts (passing
/usr paths for native Linux, matching what CI does). On a fresh
checkout this adds ~8 min to first-run verification; subsequent
runs skip the build step.
Logs go to /tmp/triangles-build-lib{tor,i2pd}.log for debugging.
Exit code 5 distinguishes build-prep failures from cmake/build
failures (3) and binary-compare failures (1/4).
Adds the infrastructure for verifiable Triangles releases:
- Reproducible builds (default-on): -ffile-prefix-map strips absolute
source paths from binaries; SOURCE_DATE_EPOCH pinned to commit
timestamp if env var not set. Two builds of the same commit with the
same flags now produce byte-identical binaries.
- scripts/verify-reproducible-build.sh: builds the daemon twice into
separate build dirs and compares SHA256. Pass/fail printed clearly.
- scripts/sign-release.sh: generates SHA256SUMS, writes detached .asc
signatures over each release artifact and over SHA256SUMS itself.
Supports --verify for independent third-party verification.
- release-process.md: canonical release pipeline documentation --
reproducibility properties, signing-key setup, distribution
requirements, failure-mode recovery, and the release checklist.
- scripts/README.md: updated to catalog the full scripts/ directory
(was previously scoped only to bump-version.sh).
Verified end-to-end on this branch:
- scripts/verify-reproducible-build.sh: exit 0, both builds SHA256
7a86d9659b7150f69dc53eb31cc4c7eb8df296b55fa889af5c5a1b310223c894.
- scripts/sign-release.sh: signs Release-built artifact, --verify
returns exit 0 (all sigs + checksums valid).
- ctest: 4/4 suites still pass with the new compile flags.
- Tamper test: modifying an artifact after signing causes --verify
to fail with '1 checksum(s) FAILED' (exit 1).
Existing signing key in the local keyring is used:
523A81833EB7201573E1EFE1DCF2579968107984
(Krystie Triangles Release <krystie-triangles-release@dns2.sami.tailnet>)
CI integration (separate PR): add a 'sign' job to build-all.yml that
imports GPG_PRIVATE_KEY from secrets and runs scripts/sign-release.sh
against the assembled release directory. Documented in release-process.md.
Sami Ahmed