[OTR-dev] Reproducible builds of pidgin-otr for Windows

[Jurre van Bergen]

On 03/20/2016 10:25 PM, Ian Goldberg wrote:
> On Sun, Mar 20, 2016 at 05:20:08PM -0400, Ian Goldberg wrote:
>> Ah, I went ahead and made the changes.  It's actually better than I
>> thought.  We don't need to run zip under faketime if we use the -o
>> option (which sets the timestamp for the archive itself to equal the
>> oldest timestamp of a file in the archive).  We also add the -X option,
>> which removes Unix uid/gids and extended timestamps from the zip file
>> entirely.  We also use chmod -R u=rwX,go=rX to canonicalize the
>> permissions on the files.
>>
>> I've updated the source tarball in place:
>>
>> https://cs.uwaterloo.ca/~iang/pidgin-otr-4.0.2-repro.tar.gz
>>
>> Unpack it, and just run INSTALL.mingw against a clean Ubuntu 14.04.  (It
>> now installs all the packages you suggested.)
>>
>> I'm building it now myself.  Let's compare hashes in a few minutes.  ;-)
> OK, built.  The above tarball, whose hash is itself:
>
> 22c6a6c250ca277e36ffed1ff1bd6d366209664471c80c3c507f8811ba5c28da  pidgin-otr-4.0.2-repro.tar.gz
>
> generates these files for me:
>
> 19f315c8317105a89d5b6fde6c2caa63ffa2e150df5fb0d67ee20ac985b0b191  pidgin-otr-4.0.2.exe
> 7e9dc2175591d7aabc9f96e737817fa917f3e4441b62727bb9730e516c47822e  pidgin-otr-4.0.2.zip
>
> How about yoU?
>
>    - Ian
>

Woohoo!

root at 5036add14019:~/pidgin-otr-4.0.2# sha256sum pidgin-otr-4.0.2.*

19f315c8317105a89d5b6fde6c2caa63ffa2e150df5fb0d67ee20ac985b0b191 
pidgin-otr-4.0.2.exe
7e9dc2175591d7aabc9f96e737817fa917f3e4441b62727bb9730e516c47822e 
pidgin-otr-4.0.2.zip

Seems we got a full matching build!

I did the following change:

sudo apt-get install mingw32 nsis faketime bison zip unzip tar \
        wget diffutils findutils build-essential automake patch \
        perl-base coreutils libtool -y

sudo apt-get install gettext -y

First we install bison so we're sure it can configure gettext and be safe.

Yay! :)

Best,
Jurre