The webrtc build downloads and runs a cipd program
While doing a build of Tor Browser, I noticed this in logs/webrtc-linux-x86_64.log:
Starting build: Sat Mar 24 00:04:29 2018
Bootstrapping cipd client for linux-amd64 from https://chrome-infra-packages.appspot.com/client?platform=linux-amd64&version=git_revision:ae28364c740acff97ae118adcb2808b6cb5129c5...
[0:02:35] Still working on:
[0:02:35] src/third_party/icuBootstrapping cipd client comes from the cipd program in depot_tools. I suppose it is being run somehow through gclient sync. It downloads a program and then runs it with a selfupdate argument. "cipd" seems to refer to "Chrome infra packages (?)".
I'm not sure what cipd is doing, but if it's downloading software at build time, it could potentially break reproducibility. We are already setting DEPOT_TOOLS_UPDATE=0.
I saw the message in logs/webrtc-linux-i686.log and logs/webrtc-linux-x86_64.log. I did not see it in logs/webrtc-osx-x86_64.log.
I haven't looked very deeply into this. I'm also experimenting with some changes to the webrtc build, but none that should affect this. As a first check, does anyone else have the Bootstrapping cipd client message in logs/webrtc-linux-x86_64.log?