Documentation
¶
Overview ¶
Package reprobuild verifies that the release wasm build is reproducible: two independent builds of the same commit must produce byte-identical artifacts (the provenance attestation implicitly promises this). The `-trimpath` flag the release profile sets is what makes the output path-independent and thus deterministic.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BuildWasmSHA ¶
BuildWasmSHA builds parsePackage for js/wasm with the RELEASE profile flags and returns the lowercase hex SHA-256 of the resulting artifact. The flags MUST match the actual release build (tools/gwc release_build.go "release" profile: Trimpath, Ldflags "-s -w", BuildVCS "false", Tags "production") — otherwise this gate verifies the reproducibility of an artifact that is NOT what ships. In particular -tags production selects the production code paths (a different binary than the default/dev build) and -buildvcs=false strips VCS stamping (a nondeterminism source the release deliberately removes); omitting either meant the check passed on the wrong artifact.
func SHAMatches ¶
SHAMatches reports whether two artifact digests are identical. It is the comparison the reproducibility check uses; a single differing byte (for example an embedded build timestamp) yields different digests and a false result, so nondeterminism is caught rather than silently accepted.
Types ¶
This section is empty.
Source Files