Bounty for reproducible cross-compilation of rust libraries for Android, Linux, Ios and Macos targets - 0.03 BTC ($2000)

[BullishNode]

This bounty is for bdk-flutter but will also be used for lwk-dart and boltz-dart

All builds are currently functional but not reproducible/verifiable.

Requirements:

Android & Linux: A build environment using bash scripts, makefile and Docker, that builds on Linux & Mac hosts
iOS & MacOS: A build environment using bash scripts and makefile, that builds on Mac hosts
Reproducibility: A bash (and python?) script that can verify github releases against local builds.

The library developers will be publishing binaries as github releases. We require a validation script that compares the libary's github release and compare them against local builds. Reference: https://github.com/signalapp/Signal-Android/blob/main/reproducible-builds%2FREADME.md

Skills:

You do not need to write or debug any rust. All the library code works and compiles fine natively. The challenge here is in cross-compilation and creating reproducible builds.
You are free to use your toolchain of choice (zig?) as long as it is reproducible.

Bounty:
0.03 BTC ($2000)

Funding: BULLBITCOIN.COM

Your work will be enabling the ethos of "Dont trust, verify" for critical bitcoin infrastructure.

To claim the bounty, submit a pull request to this repository. Pull requests will be evaluated on a first-come first-serve basis. The bounty will be allocated after review and confirmation that code quality is sufficient and functional.

[i5hi]

Scripts that work for the most part can be found here:

https://github.com/SatoshiPortal/bdk-flutter/tree/22e0a276dcfe121df382a863a6fe616de79a61a5/rust

[hkarani]

Hello @BullishNode and @i5hi. I'd like to make a contribution. Is this bounty still alive?

[i5hi]

Hey @hkarani. Sorry, someone has already started work on this :/

@BullishNode I'm closing this!

[hkarani]

@i5hi

I had actually COMPLETED all the work. Took around 3 weeks. It's all here.

My bad, I had the expectation that if it was open it'd be free for anyone to submit a bounty.

The code there works. It does a byte by byte binary check of the binaries to check for reproducibility.

The contributor can use the code if they find it useful in their submission.

[i5hi]

okay! great! i will review this over the week and keep you in the loop. we will work something out ;)

[i5hi]

when you said - 'I'd like to make a contribution'; I thought you meant, you would like to give it a shot! :P

Looks like you have something very complete here! Definately more work has gone into this than the current contributor who we just proposed to take it up last week.

I'm running a quick test right now for android, will test and review everything over the coming week. I will also try this against lwk and boltz, and if anything additional is needed for that I will let you know.

Considering that you've already put so much work into it, I will ask the other dev to stop working on it and we will build on what you have.

[i5hi]

./verifier.sh: line 64: [: missing `]'
Files match in size
./verifier.sh: line 94: [: missing `]'
✅ Success! The binaries are byte by byte identical✅.

[hkarani]

I think I can fix this by adding Shellcheck github action for POSIX compliance and running some more test.

[BullishNode]

thank you for the PR!

[hkarani]

@i5hi Closing these issues will polish what currently exists.

[hkarani]

@i5hi Pinged you on Telegram.