address review comments

sha256: 7f190568fa05f71ad356dc56a7a9725a4be18e5e40d6880f469e22981a18edd7

.gitignore

@@ -2,6 +2,7 @@
 /target/
 /*/target/
 /*/fuzz/target/
+/Cargo.lock
 *~
 .#*
 \#*\#

maint/docker_reproducible_build.sh

 #!/bin/sh
-exec docker run --rm -i -v $(git rev-parse --show-toplevel):/builds/arti -w /builds/arti --shm-size=512m rust:1.54.0-alpine3.14 ./maint/reproducible_build.sh
+## use a fixed image to not suffer from image retaging when newer rustc or
+## alpine emerges. Increase shm size for the reasons described in
+## reproducible_build.sh
+exec docker run --rm -i -v "$(git rev-parse --show-toplevel)":/builds/arti \
+		-w /builds/arti --shm-size=512m rust:1.54.0-alpine3.14 \
+		./maint/reproducible_build.sh

maint/reproducible_build.sh

 #!/bin/sh
-set -x
+set -xeu
 if [ ! -f /.dockerenv ]; then
     echo Not running inside Docker, build will probably not be reproducible
 	echo Use docker_reproducible_build.sh instead to get the right environment
 fi
-here=`pwd`
+here=$(pwd)
 
+## fix the target architecture to get reproducible builds
+## the architecture was choosen as old enought that it should cover most usage
+## while still supporting usefull features like AES-NI. Older architectures
+## won't be able to execute the resulting binary.
 export CFLAGS="-march=westmere"
 export RUSTFLAGS="-C target-cpu=westmere"
 
-## force build to run in a fixed directory
-cp -a $here /arti
+## force build to run in a fixed location. Ncessesary because the build path
+## is somehow captured when compiling.
+cp -a "$here" /arti
 cd /arti
 
-## use tmpfs 
-## TODO make /dev/shm bigger to not depend on a docker bug
-#mkdir -p /dev/shm/registry /usr/local/cargo/registry
-#ln -s /dev/shm/registry /usr/local/cargo/registry/src
-mkdir -p /sys/fs/cgroup/registry /usr/local/cargo/registry
-ln -s /sys/fs/cgroup/registry /usr/local/cargo/registry/src
+## use tmpfs to store dependancies sources. It has been observed that what
+## filesystem these files reside on has an impact on the resulting binary.
+## We put these in a tmpfs as a way to stabilize the result.
+# TODO CI /dev/shm is too small to store sources, at the moment we rely on
+# a but in docker that gives a bigger than intended tmpfs in an effort to hide
+# the cgroup control fs. This does not actually interact with cgroups, but
+# should be removed as soon as /dev/shm get increased
+if mount | grep '/sys/fs/cgroup type tmpfs' > /dev/null; then
+		mkdir -p /sys/fs/cgroup/registry /usr/local/cargo/registry
+		ln -s /sys/fs/cgroup/registry /usr/local/cargo/registry/src
+else
+		mkdir -p /dev/shm/registry /usr/local/cargo/registry
+		ln -s /dev/shm/registry /usr/local/cargo/registry/src
+fi
 
 ## add missing dependancies
-apk add --no-cache musl-dev perl make
+apk add --no-cache musl-dev perl make git
+
+## bring back the Cargo.lock where dependancies version are strictly defined
+mv misc/Cargo.lock Cargo.lock
 
+## Build targeting x86_64-unknown-linux-musl to get a static binary
+## feature "static" enable compiling some C dependancies instead of linking
+## to system libraries. It is required to get a well behaving result.
 cargo build -p arti --target x86_64-unknown-linux-musl --release --features static
-sha256sum target/x86_64-unknown-linux-musl/release/arti
+
+set +x
+echo branch: "$(git rev-parse --abbrev-ref HEAD)"
+echo commit: "$(git rev-parse HEAD)"
+echo build hash: "$(sha256sum target/x86_64-unknown-linux-musl/release/arti | cut -d " " -f 1)"
 
 mv /arti/target/x86_64-unknown-linux-musl/release/arti "$here"/arti-bin

maint/reproducible_update_cargolock.sh

+#!/bin/sh
+set -e
+cd "$(git rev-parse --show-toplevel)"
+mv Cargo.lock Cargo.lock.back 2> /dev/null || true
+cargo update
+mv Cargo.lock misc/
+mv Cargo.lock.back Cargo.lock 2> /dev/null || true

Cargo.lock → misc/Cargo.lock

@@ -438,9 +438,9 @@ checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
 
 [[package]]
 name = "bytes"
-version = "1.0.1"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b700ce4376041dcd0a327fd0097c41095743c4c8af8887265942faf1100bd040"
+checksum = "c4872d67bab6358e59559027aa3b9157c53d9358c51423c17554809a8858e0f8"
 
 [[package]]
 name = "cache-padded"
@@ -1284,9 +1284,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.100"
+version = "0.2.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1fa8cddc8fbbee11227ef194b5317ed014b8acbf15139bd716a18ad3fe99ec5"
+checksum = "3cb00336871be5ed2c8ed44b60ae9959dc5b9f08539422ed43f09e34ecaeba21"
 
 [[package]]
 name = "libm"
@@ -1460,6 +1460,20 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "num"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43db66d1170d347f9a065114077f7dccb00c1b9478c89384490a3425279a4606"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.4.0"
@@ -1489,6 +1503,15 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "num-complex"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26873667bbbb7c5182d4a37c1add32cdf09f841af72da53318fdb81543c15085"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "num-integer"
 version = "0.1.44"
@@ -1510,6 +1533,18 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-rational"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d41702bd167c2df5520b384281bc111a4b5efcf7fbc4c9c222c815b07e0a6a6a"
+dependencies = [
+ "autocfg 1.0.1",
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.14"
@@ -2006,22 +2041,23 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "2.3.1"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23a2ac85147a3a11d77ecf1bc7166ec0b92febfa4461c37944e180f319ece467"
+checksum = "5b9bd29cdffb8875b04f71c51058f940cf4e390bbfd2ce669c4f22cd70b492a5"
 dependencies = [
  "bitflags",
  "core-foundation",
  "core-foundation-sys",
  "libc",
+ "num",
  "security-framework-sys",
 ]
 
 [[package]]
 name = "security-framework-sys"
-version = "2.3.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e4effb91b4b8b6fb7732e670b6cee160278ff8e6bf485c7805d9e319d76e284"
+checksum = "19133a286e494cc3311c165c4676ccb1fd47bed45b55f9d71fbd784ad4cea6f8"
 dependencies = [
  "core-foundation-sys",
  "libc",