oasis-node binaries made with GoReleaser via GitHub Actions are not reproducible

[tjanez]

SUMMARY

When testing the release tooling I noticed that oasis-node builds are not reproducible, i.e. rebuilding the same git tag checkout does not produce the same oasis-node binary.

ISSUE TYPE

• Bug Report

OS / ENVIRONMENT

Go 1.13 on Ubuntu 18.04 LTS as provided by GitHub Actions.

ACTUAL RESULTS

[tadej@toronto The Quest]$ sha256sum oasis-node_20.1_linux_amd64*/oasis-node
db51791fa2c825e5d43ab87d6ff8bcc743368aeea4a016ea1d3fb851a10bc499  oasis-node_20.1_linux_amd64/oasis-node
c3ae733d5ae34d4959989b4535a98d9ba85bb9b9c29fb40a8a36fc548e1325f0  oasis-node_20.1_linux_amd64-REBUILD/oasis-node

EXPECTED RESULTS

Sha256sum of the rebuild of oasis-node from the same source tree should be equal to the released version.

[Yawning]

60641ce

arnhem :: /tmp % go tool buildid 20.1-release/oasis-node                       
qOH-_QEY3BGJ2Nn2bgJR/ws-c3GqZK-Cb5aG31TtO/JhNprcHDCpo5ywjw6DuT/mDmAV6jC5_nBoKuCiw3v
arnhem :: /tmp % go tool buildid 20.1-rebuild/oasis-node                       
RYljewfRd32AQmsKfEF5/TAwmr_XeZFaW2u3Jlf8P/JhNprcHDCpo5ywjw6DuT/x35OqgqT5Ht9ZHkApth1

[kostko]

Wasn't that included in latest Go (e.g., 1.13.6)?

[Yawning]

As far as I can tell the only differences in the binary are:

• .note.go.buildid
• .note.gnu.build-id

20.1-release/oasis-node:     file format elf64-x86-64

Contents of section .note.go.buildid:
 4002ac 04000000 53000000 04000000 476f0000  ....S.......Go..
 4002bc 714f482d 5f514559 3342474a 324e6e32  qOH-_QEY3BGJ2Nn2
 4002cc 62674a52 2f77732d 63334771 5a4b2d43  bgJR/ws-c3GqZK-C
 4002dc 62356147 33315474 4f2f4a68 4e707263  b5aG31TtO/JhNprc
 4002ec 48444370 6f357977 6a773644 75542f6d  HDCpo5ywjw6DuT/m
 4002fc 446d4156 366a4335 5f6e426f 4b754369  DmAV6jC5_nBoKuCi
 40030c 77337600                             w3v.            
Contents of section .note.gnu.build-id:
 400310 04000000 14000000 03000000 474e5500  ............GNU.
 400320 4ea3bb00 c578cf3a dd2c1b1b 9a8ebd0d  N....x.:.,......
 400330 5b09e724               

20.1-rebuild/oasis-node:     file format elf64-x86-64

Contents of section .note.go.buildid:
 4002ac 04000000 53000000 04000000 476f0000  ....S.......Go..
 4002bc 52596c6a 65776652 64333241 516d734b  RYljewfRd32AQmsK
 4002cc 66454635 2f544177 6d725f58 655a4661  fEF5/TAwmr_XeZFa
 4002dc 57327533 4a6c6638 502f4a68 4e707263  W2u3Jlf8P/JhNprc
 4002ec 48444370 6f357977 6a773644 75542f78  HDCpo5ywjw6DuT/x
 4002fc 33354f71 67715435 4874395a 486b4170  35OqgqT5Ht9ZHkAp
 40030c 74683100                             th1.            
Contents of section .note.gnu.build-id:
 400310 04000000 14000000 03000000 474e5500  ............GNU.
 400320 a9631e0e ff10a572 11cd1db5 b73ae45c  .c.....r.....:.\
 400330 b050f12d  

44,49c44,49
< 000002b0  53 00 00 00 04 00 00 00  47 6f 00 00 52 59 6c 6a  |S.......Go..RYlj|
< 000002c0  65 77 66 52 64 33 32 41  51 6d 73 4b 66 45 46 35  |ewfRd32AQmsKfEF5|
< 000002d0  2f 54 41 77 6d 72 5f 58  65 5a 46 61 57 32 75 33  |/TAwmr_XeZFaW2u3|
< 000002e0  4a 6c 66 38 50 2f 4a 68  4e 70 72 63 48 44 43 70  |Jlf8P/JhNprcHDCp|
< 000002f0  6f 35 79 77 6a 77 36 44  75 54 2f 78 33 35 4f 71  |o5ywjw6DuT/x35Oq|
< 00000300  67 71 54 35 48 74 39 5a  48 6b 41 70 74 68 31 00  |gqT5Ht9ZHkApth1.|
---
> 000002b0  53 00 00 00 04 00 00 00  47 6f 00 00 71 4f 48 2d  |S.......Go..qOH-|
> 000002c0  5f 51 45 59 33 42 47 4a  32 4e 6e 32 62 67 4a 52  |_QEY3BGJ2Nn2bgJR|
> 000002d0  2f 77 73 2d 63 33 47 71  5a 4b 2d 43 62 35 61 47  |/ws-c3GqZK-Cb5aG|
> 000002e0  33 31 54 74 4f 2f 4a 68  4e 70 72 63 48 44 43 70  |31TtO/JhNprcHDCp|
> 000002f0  6f 35 79 77 6a 77 36 44  75 54 2f 6d 44 6d 41 56  |o5ywjw6DuT/mDmAV|
> 00000300  36 6a 43 35 5f 6e 42 6f  4b 75 43 69 77 33 76 00  |6jC5_nBoKuCiw3v.|
51,52c51,52
< 00000320  a9 63 1e 0e ff 10 a5 72  11 cd 1d b5 b7 3a e4 5c  |.c.....r.....:.\|
< 00000330  b0 50 f1 2d 00 00 00 00  09 02 00 00 8a 00 00 00  |.P.-............|
---
> 00000320  4e a3 bb 00 c5 78 cf 3a  dd 2c 1b 1b 9a 8e bd 0d  |N....x.:.,......|
> 00000330  5b 09 e7 24 00 00 00 00  09 02 00 00 8a 00 00 00  |[..$............|
arnhem :: /tmp %

[tjanez]

It turned out this is a specific issue when performing builds via GoReleaser and using different git paths.
The ordinary cd go && make oasis-node builds are not affected.

Filled https://github.com/oasislabs/goreleaser/issues/1 and implemented a work-around in #2590.