reproducible builds

[Be]

We distribute binaries that are downloaded millions of times. We should be able to be certain that the binaries have not been compromised. We can only be sure if our builds are 100% reproducible: https://reproducible-builds.org/

[Sébastien BLAISOT (sblaisot)]

100% bit-to-bit reproductible build under windows using MSVS seems an impossible goal because the executable itself contain (at least) the build date.

[Be (be.ing)]

Someone made tool to fix that: https://github.com/jasonwhite/ducible

[Sébastien BLAISOT (sblaisot)]

Here are the things I can think of :

* we will need to set buildtime=0 for scons to avoid including the build date/time in the executable
https://github.com/mixxxdj/mixxx/blob/master/src/util/version.cpp#L152,L154

* We will need to fix that: https://github.com/mixxxdj/mixxx/blob/master/src/SConscript#L59

* We need to ensure that third-party code (like included libs, qt, etc...) all have reproducible builds (remember that at least windows builds are statically linked)

* This should be seen as reproductible executables, not reproductible packages, because packaging (under windows) necessarily add some random stuff like unique GUIDs that are based on the building machine id + date/time : https://github.com/mixxxdj/mixxx/blob/master/src/SConscript#L684,L692
Uniqueness across builds is mandatory here to ensure proper upgrade path between versions.

[RJ Skerry-Ryan (rryan)]

I'm all for reproducible builds, but this is feasible for 2.2? It's quite a big project -- particularly b/c our dependencies need to be reproducible and we have a lot of dependencies.

[Swiftb0y (swiftb0y)]

Mixxx now uses GitHub for bug tracking. This bug has been migrated to:
https://github.com/mixxxdj/mixxx/issues/9039