Files

T

Krystie 59b2ff8e63 infra: reproducible build + signed release pipeline

Adds the infrastructure for verifiable Triangles releases:
- Reproducible builds (default-on): -ffile-prefix-map strips absolute
  source paths from binaries; SOURCE_DATE_EPOCH pinned to commit
  timestamp if env var not set. Two builds of the same commit with the
  same flags now produce byte-identical binaries.
- scripts/verify-reproducible-build.sh: builds the daemon twice into
  separate build dirs and compares SHA256. Pass/fail printed clearly.
- scripts/sign-release.sh: generates SHA256SUMS, writes detached .asc
  signatures over each release artifact and over SHA256SUMS itself.
  Supports --verify for independent third-party verification.
- release-process.md: canonical release pipeline documentation --
  reproducibility properties, signing-key setup, distribution
  requirements, failure-mode recovery, and the release checklist.
- scripts/README.md: updated to catalog the full scripts/ directory
  (was previously scoped only to bump-version.sh).

Verified end-to-end on this branch:
- scripts/verify-reproducible-build.sh: exit 0, both builds SHA256
  7a86d9659b7150f69dc53eb31cc4c7eb8df296b55fa889af5c5a1b310223c894.
- scripts/sign-release.sh: signs Release-built artifact, --verify
  returns exit 0 (all sigs + checksums valid).
- ctest: 4/4 suites still pass with the new compile flags.
- Tamper test: modifying an artifact after signing causes --verify
  to fail with '1 checksum(s) FAILED' (exit 1).

Existing signing key in the local keyring is used:
  523A81833EB7201573E1EFE1DCF2579968107984
  (Krystie Triangles Release <krystie-triangles-release@dns2.sami.tailnet>)

CI integration (separate PR): add a 'sign' job to build-all.yml that
imports GPG_PRIVATE_KEY from secrets and runs scripts/sign-release.sh
against the assembled release directory. Documented in release-process.md.

2026-07-07 13:33:11 -07:00

1.6 KiB

Raw Blame History

Scripts

Operational scripts for the Triangles project. See also release-process.md at the repo root for the canonical release pipeline documentation.

Build verification

verify-reproducible-build.sh — builds the daemon (or another target) twice from the same source tree and verifies the SHA256 hashes match. Catches accidental introduction of non-determinism (e.g. __DATE__/__TIME__ regressions, dirty git state, PIE base-address drift).

Release signing

sign-release.sh — generates SHA256SUMS, writes detached PGP signatures (.asc) over each release artifact and over SHA256SUMS. Supports --verify for independent third-party verification. Uses TRIANGLES_RELEASE_KEY env var (defaults to sami@cryptographic-triangles.org).

Existing infrastructure

bump-version.sh — sync version numbers across all manifests from src/clientversion.h.
sign-snapshot.sh — sign a UTXO snapshot file with the wallet's signing address (not a PGP key; this is a chain-level signature, not a release signature).
validate_onion_seeds.py — validate every .onion address in triangles.conf against the v3 hidden-service checksum.
ibd-smoke-test.sh — fresh-datadir IBD smoke test for catching the classic "stalls early / loops around 570" failure mode.
ci/build-rocksdb.sh — build and install a pinned RocksDB version for CI.
ci/package-linux-daemon.sh — Linux packaging step (.deb).
ci/package-windows-daemon.sh — Windows packaging step.
tri/ — operator-facing CLI for node administration.

1.6 KiB Raw Blame History

Scripts

Build verification

Release signing

Existing infrastructure

1.6 KiB

Raw Blame History