Reproducible Build

Gradle building

Setup instructions for gradle build in docker container.

This is a deterministic build process used to build RSK node JAR file. It provides a way to be reasonable sure that the JAR is built from GitHub RskJ repository. It also makes sure that the same tested dependencies are used and statically built into the executable.

It's strongly suggested to follow the steps by yourself to avoid any kind of contamination in the process.

Table of Contents

• Install Docker
• Build the environment docker container
• Run Build
• Check Results

Install Docker

Depending on your OS, you can install Docker following the official Docker guide:

• Mac
• Windows
• Ubuntu
• CentOS
• Fedora
• Debian
• Others

Build Container

Create a Dockerfile to setup the build environment

FROM ubuntu:16.04

RUN apt-get update -y && \
    apt-get install -y git curl gnupg-curl openjdk-8-jdk && \
    rm -rf /var/lib/apt/lists/* && \
    apt-get autoremove -y && \
    apt-get clean

RUN gpg --keyserver https://secchannel.rsk.co/release.asc --recv-keys 1A92D8942171AFA951A857365DECF4415E3B8FA4
RUN gpg --finger 1A92D8942171AFA951A857365DECF4415E3B8FA4

RUN git clone --single-branch --depth 1 --branch ORCHID-0.6.2 https://github.com/rsksmart/rskj.git /code/rskj

WORKDIR /code/rskj

RUN gpg --verify SHA256SUMS.asc
RUN sha256sum --check SHA256SUMS.asc
RUN ./configure.sh
RUN ./gradlew clean build -x test

If you are not familiar with Docker or the Dockerfile format: what this does is use the Ubuntu 16.04 base image and install git, curl, gnupg-curl and openjdk-8-jdk, required for building RSK node.

Run build

To create a reproducible build, run:

sudo docker build -t rskj-orchid-0.6.2-reproducible .

This may take several minutes to complete. What is done is:

• Place in the RskJ repository root because we need Gradle and the project.
• Runs the secure chain verification process.
• Compile a reproducible RskJ node.
• ./gradlew clean build -x test builds without running tests.

To obtain SHA-256 checksums, run the following command:

sudo docker run --rm rskj-orchid-0.6.2-reproducible sha256sum /code/rskj/rskj-core/build/libs/rskj-core-0.6.2-ORCHID-all.jar /code/rskj/rskj-core/build/libs/rskj-core-0.6.2-ORCHID-sources.jar /code/rskj/rskj-core/build/libs/rskj-core-0.6.2-ORCHID.jar /code/rskj/rskj-core/build/libs/rskj-core-0.6.2-ORCHID.pom

Check Results

After running the build process, a JAR file will be created in /code/rskj-core/build/libs/, into the docker container.

You can check the SHA256 sum of the result file and compare it to the one published by RSK for that version.

90d8c45a044fd505b8c551b74376adb102b4bbd50f5e529337b71218198a535b  /code/rskj/rskj-core/build/libs/rskj-core-0.6.2-ORCHID-all.jar
b6240946b1603c37bfc5b0826cd2393d941acf7a23fb1c57d618db5e49f211c2  /code/rskj/rskj-core/build/libs/rskj-core-0.6.2-ORCHID-sources.jar
0d67d6e8b04676a260e5b1e3fc774bef2fe751270d4f552d643fe67d7c5e1340  /code/rskj/rskj-core/build/libs/rskj-core-0.6.2-ORCHID.jar
7477060f0728a74a01024cb591dd8eb4baa35662a56700fbfe6b6ed4d4df3d9b  /code/rskj/rskj-core/build/libs/rskj-core-0.6.2-ORCHID.pom

For SHA256 sum of older versions check the releases page.

If you check inside the JAR file, you will find that the dates of the files are the same as the version commit you are using.