fix reproducible dpkg-deb

wizardsardine · Dec 13, 2024 · 44574c3 · 44574c3
1 parent 2f662ad
commit 44574c3
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 6 deletions.
diff --git a/contrib/release/release.sh b/contrib/release/release.sh
@@ -23,10 +23,21 @@ create_dir() {
     mkdir "$1"
 }
 
+
+
 # Determine the reference time used for determinism (overridable by environment)
-export SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(git -c log.showSignature=false log --format=%at -1)}"
+export SOURCE_DATE_EPOCH="$(git -c log.showsignature=false log --format=%at -1)"
+export TZ=UTC
 export TAR_OPTIONS="--owner=0 --group=0 --numeric-owner --sort=name"
 
+zip_archive () {
+    local archive="$1"
+    shift
+    # Any suitable timestamp can be used here.
+    touch -d "@$SOURCE_DATE_EPOCH" "$@"
+     zip -r -oX - "$@" > "$archive"
+}
+
 # We'll use a folder for the builds output and another one for the final assets.
 RELEASE_DIR="$PWD/release_assets"
 BUILD_DIR="$PWD/release_build"
@@ -51,7 +62,7 @@ NIX_BUILD_DIR="$(nix path-info .#release)"
     cp "$BUILD_DIR/x86_64-unknown-linux-gnu/release/lianad" "$BUILD_DIR/x86_64-unknown-linux-gnu/release/liana-cli" "$BUILD_DIR/x86_64-unknown-linux-gnu/release/liana-gui" ../README.md ./package/usr/bin/
     DIRNAME="liana_$VERSION-1_amd64"
     mv ./package "$DIRNAME"
-    dpkg-deb -Zxz --build "$DIRNAME"
+    dpkg-deb -Zxz --build --root-owner-group "$DIRNAME"
     mv "$DIRNAME.deb" "$RELEASE_DIR"
 )
 
@@ -60,7 +71,7 @@ NIX_BUILD_DIR="$(nix path-info .#release)"
     cd "$BUILD_DIR"
     create_dir "$WINDOWS_DIR_NAME"
     cp "$NIX_BUILD_DIR/x86_64-pc-windows-gnu/liana-gui.exe" ../README.md "$WINDOWS_DIR_NAME"
-    zip -r "$WINDOWS_ARCHIVE" "$WINDOWS_DIR_NAME"
+    zip_archive "$WINDOWS_ARCHIVE" "$WINDOWS_DIR_NAME"
     mv "$WINDOWS_ARCHIVE" "$RELEASE_DIR"
     cp "$NIX_BUILD_DIR/x86_64-pc-windows-gnu/liana-gui.exe" "$RELEASE_DIR/$LIANA_PREFIX.exe"
 )
@@ -77,10 +88,10 @@ NIX_BUILD_DIR="$(nix path-info .#release)"
     sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" ./Liana.app/Contents/Info.plist
     cp "$NIX_BUILD_DIR/x86_64-apple-darwin/liana-gui" ./Liana.app/Contents/MacOS/Liana
     chmod u+w ./Liana.app/Contents/MacOS/Liana
-    zip -ry "Liana-$VERSION-noncodesigned.zip" Liana.app
+    zip_archive "Liana-$VERSION-noncodesigned.zip" Liana.app
     mv "Liana-$VERSION-noncodesigned.zip" "$RELEASE_DIR/"
 )
 
-find "$RELEASE_DIR" -type f -exec sha256sum {} + | tee "$RELEASE_DIR/shasums.txt"
+find "$RELEASE_DIR" -type f ! -name "shasums.txt" -exec sha256sum {} + | tee "$RELEASE_DIR/shasums.txt"
 
 set +ex
diff --git a/contrib/release/sign.sh b/contrib/release/sign.sh
@@ -26,6 +26,20 @@ absolute_path() {
     fi
 }
 
+# Determine the reference time used for determinism (overridable by environment)
+export SOURCE_DATE_EPOCH="$(git -c log.showsignature=false log --format=%at -1)"
+export TZ=UTC
+
+zip_archive () {
+    local archive="$1"
+    shift
+    # Any suitable timestamp can be used here.
+    touch -d "@$SOURCE_DATE_EPOCH" "$@"
+     zip -r -oX - "$@" > "$archive"
+}
+
+
+
 # Function to perform rcodesign signing
 sign_with_rcodesign() {
     # Ensure the correct number of arguments are provided
@@ -68,8 +82,9 @@ sign_with_rcodesign() {
         --api-key-path "$NOTARY_API_CREDS_FILE" \
         --staple Liana.app
 
-    zip -ry "Liana-$VERSION.zip" Liana.app
+    zip_archive "Liana-$VERSION.zip" Liana.app
     mv "Liana-$VERSION.zip" "$RELEASE_DIR/"
+    sha256sum "$RELEASE_DIR/Liana-$VERSION.zip" | tee -a "$RELEASE_DIR/shasums.txt"
 }
 
 if [ "$#" -lt 1 ]; then