Merge pull request #4221 from guggero/move-release
build: move release script and README to more appropriate locations
This commit is contained in:
4 files changed
+2
-2
No files matched your search
@@ -1,70 +0,0 @@
|
||||
# `lnd`'s Reproducible Build System
|
||||
|
||||
This package contains the build script that the `lnd` project uses in order to
|
||||
build binaries for each new release. As of `go1.13`, with some new build flags,
|
||||
binaries are now reproducible, allowing developers to build the binary on
|
||||
distinct machines, and end up with a byte-for-byte identical binary. However,
|
||||
this wasn't _fully_ solved in `go1.13`, as the build system still includes the
|
||||
directory the binary is built into the binary itself. As a result, our scripts
|
||||
utilize a work around needed until `go1.13.2`.
|
||||
|
||||
## Building a New Release
|
||||
|
||||
### macOS/Linux/Windows (WSL)
|
||||
|
||||
No prior set up is needed on Linux or macOS is required in order to build the
|
||||
release binaries. However, on Windows, the only way to build the release
|
||||
binaries at the moment is by using the Windows Subsystem Linux. One can build
|
||||
the release binaries following these steps:
|
||||
|
||||
1. `git clone https://github.com/lightningnetwork/lnd.git`
|
||||
2. `cd lnd`
|
||||
3. `make release tag=<TAG> # <TAG> is the name of the next release/tag`
|
||||
|
||||
This will then create a directory of the form `lnd-<TAG>` containing archives
|
||||
of the release binaries for each supported operating system and architecture,
|
||||
and a manifest file containing the hash of each archive.
|
||||
|
||||
## Verifying a Release
|
||||
|
||||
With `go1.13`, it's now possible for third parties to verify release binaries.
|
||||
Before this version of `go`, one had to trust the release manager(s) to build the
|
||||
proper binary. With this new system, third parties can now _independently_ run
|
||||
the release process, and verify that all the hashes of the release binaries
|
||||
match exactly that of the release binaries produced by said third parties.
|
||||
|
||||
To verify a release, one must obtain the following tools (many of these come
|
||||
installed by default in most Unix systems): `gpg`/`gpg2`, `shashum`, and
|
||||
`tar`/`unzip`.
|
||||
|
||||
Once done, verifiers can proceed with the following steps:
|
||||
|
||||
1. Acquire the archive containing the release binaries for one's specific
|
||||
operating system and architecture, and the manifest file along with its
|
||||
signature.
|
||||
2. Verify the signature of the manifest file with `gpg --verify
|
||||
manifest-<TAG>.txt.sig`. This will require obtaining the PGP keys which
|
||||
signed the manifest file, which are included in the release notes.
|
||||
3. Recompute the `SHA256` hash of the archive with `shasum -a 256 <filename>`,
|
||||
locate the corresponding one in the manifest file, and ensure they match
|
||||
__exactly__.
|
||||
|
||||
At this point, verifiers can use the release binaries acquired if they trust
|
||||
the integrity of the release manager(s). Otherwise, one can proceed with the
|
||||
guide to verify the release binaries were built properly by obtaining `shasum`
|
||||
and `go` (matching the same version used in the release):
|
||||
|
||||
4. Extract the release binaries contained within the archive, compute their
|
||||
hashes as done above, and note them down.
|
||||
5. Ensure `go` is installed, matching the same version as noted in the release
|
||||
notes.
|
||||
6. Obtain a copy of `lnd`'s source code with `git clone
|
||||
https://github.com/lightningnetwork/lnd` and checkout the source code of the
|
||||
release with `git checkout <TAG>`.
|
||||
7. Proceed to verify the tag with `git verify-tag <TAG>` and compile the
|
||||
binaries from source for the intended operating system and architecture with
|
||||
`make release sys=OS-ARCH tag=<TAG>`.
|
||||
8. Extract the archive found in the `lnd-<TAG>` directory created by the
|
||||
release script and recompute the `SHA256` hash of the release binaries (lnd
|
||||
and lncli) with `shasum -a 256 <filename>`. These should match __exactly__
|
||||
as the ones noted above.
|
||||
@@ -1,160 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Simple bash script to build basic lnd tools for all the platforms
|
||||
# we support with the golang cross-compiler.
|
||||
#
|
||||
# Copyright (c) 2016 Company 0, LLC.
|
||||
# Use of this source code is governed by the ISC
|
||||
# license.
|
||||
|
||||
set -e
|
||||
|
||||
LND_VERSION_REGEX="lnd version (.+) commit"
|
||||
PKG="github.com/lightningnetwork/lnd"
|
||||
PACKAGE=lnd
|
||||
|
||||
# green prints one line of green text (if the terminal supports it).
|
||||
function green() {
|
||||
echo -e "\e[0;32m${1}\e[0m"
|
||||
}
|
||||
|
||||
# red prints one line of red text (if the terminal supports it).
|
||||
function red() {
|
||||
echo -e "\e[0;31m${1}\e[0m"
|
||||
}
|
||||
|
||||
# check_tag_correct makes sure the given git tag is checked out and the git tree
|
||||
# is not dirty.
|
||||
# arguments: <version-tag>
|
||||
function check_tag_correct() {
|
||||
local tag=$1
|
||||
|
||||
# If a tag is specified, ensure that that tag is present and checked out.
|
||||
if [[ $tag != $(git describe) ]]; then
|
||||
red "tag $tag not checked out"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Build lnd to extract version.
|
||||
go build ${PKG}/cmd/lnd
|
||||
|
||||
# Extract version command output.
|
||||
lnd_version_output=$(./lnd --version)
|
||||
|
||||
# Use a regex to isolate the version string.
|
||||
if [[ $lnd_version_output =~ $LND_VERSION_REGEX ]]; then
|
||||
# Prepend 'v' to match git tag naming scheme.
|
||||
lnd_version="v${BASH_REMATCH[1]}"
|
||||
green "version: $lnd_version"
|
||||
|
||||
# If tag contains a release candidate suffix, append this suffix to the
|
||||
# lnd reported version before we compare.
|
||||
RC_REGEX="-rc[0-9]+$"
|
||||
if [[ $tag =~ $RC_REGEX ]]; then
|
||||
lnd_version+=${BASH_REMATCH[0]}
|
||||
fi
|
||||
|
||||
# Match git tag with lnd version.
|
||||
if [[ $tag != "${lnd_version}" ]]; then
|
||||
red "lnd version $lnd_version does not match tag $tag"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
red "malformed lnd version output"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# build_release builds the actual release binaries.
|
||||
# arguments: <version-tag> <build-system(s)> <build-tags> <ldflags>
|
||||
function build_release() {
|
||||
local tag=$1
|
||||
local sys=$2
|
||||
local buildtags=$3
|
||||
local ldflags=$4
|
||||
|
||||
green " - Packaging vendor"
|
||||
go mod vendor
|
||||
tar -czf vendor.tar.gz vendor
|
||||
|
||||
maindir=$PACKAGE-$tag
|
||||
mkdir -p $maindir
|
||||
|
||||
cp vendor.tar.gz $maindir/
|
||||
rm vendor.tar.gz
|
||||
rm -r vendor
|
||||
|
||||
package_source="${maindir}/${PACKAGE}-source-${tag}.tar"
|
||||
git archive -o "${package_source}" HEAD
|
||||
gzip -f "${package_source}" >"${package_source}.gz"
|
||||
|
||||
cd "${maindir}"
|
||||
|
||||
for i in $sys; do
|
||||
os=$(echo $i | cut -f1 -d-)
|
||||
arch=$(echo $i | cut -f2 -d-)
|
||||
arm=
|
||||
|
||||
if [[ $arch == "armv6" ]]; then
|
||||
arch=arm
|
||||
arm=6
|
||||
elif [[ $arch == "armv7" ]]; then
|
||||
arch=arm
|
||||
arm=7
|
||||
fi
|
||||
|
||||
dir="${PACKAGE}-${i}-${tag}"
|
||||
mkdir "${dir}"
|
||||
pushd "${dir}"
|
||||
|
||||
green " - Building: ${os} ${arch} ${arm} with build tags '${buildtags}'"
|
||||
env CGO_ENABLED=0 GOOS=$os GOARCH=$arch GOARM=$arm go build -v -trimpath -ldflags="${ldflags}" -tags="${buildtags}" ${PKG}/cmd/lnd
|
||||
env CGO_ENABLED=0 GOOS=$os GOARCH=$arch GOARM=$arm go build -v -trimpath -ldflags="${ldflags}" -tags="${buildtags}" ${PKG}/cmd/lncli
|
||||
popd
|
||||
|
||||
if [[ $os == "windows" ]]; then
|
||||
zip -r "${dir}.zip" "${dir}"
|
||||
else
|
||||
tar -cvzf "${dir}.tar.gz" "${dir}"
|
||||
fi
|
||||
|
||||
rm -r "${dir}"
|
||||
done
|
||||
|
||||
shasum -a 256 * >manifest-$tag.txt
|
||||
}
|
||||
|
||||
# usage prints the usage of the whole script.
|
||||
function usage() {
|
||||
red "Usage: "
|
||||
red "release.sh check-tag <version-tag>"
|
||||
red "release.sh build-release <version-tag> <build-system(s)> <build-tags> <ldflags>"
|
||||
}
|
||||
|
||||
# Whatever sub command is passed in, we need at least 2 arguments.
|
||||
if [ "$#" -lt 2 ]; then
|
||||
usage
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Extract the sub command and remove it from the list of parameters by shifting
|
||||
# them to the left.
|
||||
SUBCOMMAND=$1
|
||||
shift
|
||||
|
||||
# Call the function corresponding to the specified sub command or print the
|
||||
# usage if the sub command was not found.
|
||||
case $SUBCOMMAND in
|
||||
check-tag)
|
||||
green "Checking if version tag exists"
|
||||
check_tag_correct "$@"
|
||||
;;
|
||||
build-release)
|
||||
green "Building release"
|
||||
build_release "$@"
|
||||
;;
|
||||
*)
|
||||
usage
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
Reference in new issue
Block a user