Small reproducibility issue with the 0.15.0 release

[ruuda]

Thanks for fixing the static build in #123! I just tried to see if I could reproduce it, so I can safely download the binary from GitHub and confirm the shasum for my downstream use case, instead of having to build it from source. However, I don’t get exactly the same binary as the one on the release page.

Differences

0960ab3f51abb71e4129c5fe0541e3dad4c2ae5428d51b757f2f3cf5c9ff4758  result/bin/vaultenv
30273ff1511baef0ac2eb5606f2c54b4d4ec46965344f56a3b1088ce535d6d90  ~/downloads/vaultenv-0.15.0-linux-musl

I am building commit 3b55e17, better known as v0.15.0, with nix-build nix/release.nix -A vaultenvStatic.

Diffoscope shows very few differences (this is good, it means the discrepancy is hopefully easy to resolve), all caused by a single different store path which ends up in various places in the binary.

• /nix/store/y9p11057zpc5r9cqnfy2sgfgjymwv59m-vaultenv-static-x86_64-unknown-linux-musl-0.15.0 is what’s in the published release.
• /nix/store/kkb4w0i0qvhj60kdnxpasldq79glnmvg-vaultenv-static-x86_64-unknown-linux-musl-0.15.0 is what I get in my local build.

Diffoscope output

--- ~/downloads/vaultenv-0.15.0-linux-musl
+++ result/bin/vaultenv
├── strings --all --bytes=8 {}
│ @@ -931,25 +931,25 @@
│  ath component
│  hitespace
│  vaultenv-real-0.15.0-BVsC6AJuNM75bSImrOaUmP:SecretsFile.IOErr
│  vaultenv-real-0.15.0-BVsC6AJuNM75bSImrOaUmP:SecretsFile.ParseErr
│  vaultenv-real-0.15.0-BVsC6AJuNM75bSImrOaUmP:SecretsFile.V1
│  vaultenv-real-0.15.0-BVsC6AJuNM75bSImrOaUmP:SecretsFile.V2
│  vaultenv-real-0.15.0-BVsC6AJuNM75bSImrOaUmP:SecretsFile.Secret
│ -/nix/store/y9p11057zpc5r9cqnfy2sgfgjymwv59m-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/etc
│ +/nix/store/kkb4w0i0qvhj60kdnxpasldq79glnmvg-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/etc
│  vaultenv_real_sysconfdir
│ -/nix/store/y9p11057zpc5r9cqnfy2sgfgjymwv59m-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/libexec/x86_64-linux-ghc-9.0.2/vaultenv-real-0.15.0
│ +/nix/store/kkb4w0i0qvhj60kdnxpasldq79glnmvg-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/libexec/x86_64-linux-ghc-9.0.2/vaultenv-real-0.15.0
│  vaultenv_real_libexecdir
│ -/nix/store/y9p11057zpc5r9cqnfy2sgfgjymwv59m-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/share/x86_64-linux-ghc-9.0.2/vaultenv-real-0.15.0
│ +/nix/store/kkb4w0i0qvhj60kdnxpasldq79glnmvg-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/share/x86_64-linux-ghc-9.0.2/vaultenv-real-0.15.0
│  vaultenv_real_datadir
│ -/nix/store/y9p11057zpc5r9cqnfy2sgfgjymwv59m-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/lib/ghc-9.0.2/x86_64-linux-ghc-9.0.2
│ +/nix/store/kkb4w0i0qvhj60kdnxpasldq79glnmvg-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/lib/ghc-9.0.2/x86_64-linux-ghc-9.0.2
│  vaultenv_real_dynlibdir
│ -/nix/store/y9p11057zpc5r9cqnfy2sgfgjymwv59m-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/lib/ghc-9.0.2/x86_64-linux-ghc-9.0.2/vaultenv-real-0.15.0-BVsC6AJuNM75bSImrOaUmP
│ +/nix/store/kkb4w0i0qvhj60kdnxpasldq79glnmvg-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/lib/ghc-9.0.2/x86_64-linux-ghc-9.0.2/vaultenv-real-0.15.0-BVsC6AJuNM75bSImrOaUmP
│  vaultenv_real_libdir
│ -/nix/store/y9p11057zpc5r9cqnfy2sgfgjymwv59m-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/bin
│ +/nix/store/kkb4w0i0qvhj60kdnxpasldq79glnmvg-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/bin
│  vaultenv_real_bindir
│  Paths_vaultenv_real
│  Total cumulative delay would be: 
│  Negative exponent
│  src/Control/Retry.hs
│  ConsultPolicyOverrideDelay 
│  rsPreviousDelay =
├── readelf --wide --decompress --hex-dump=.rodata {}
│ @@ -530,67 +530,67 @@
│    0x0194f0f0 31352e30 2d425673 4336414a 754e4d37 15.0-BVsC6AJuNM7
│    0x0194f100 35625349 6d724f61 556d503a 53656372 5bSImrOaUmP:Secr
│    0x0194f110 65747346 696c652e 56320076 61756c74 etsFile.V2.vault
│    0x0194f120 656e762d 7265616c 2d302e31 352e302d env-real-0.15.0-
│    0x0194f130 42567343 36414a75 4e4d3735 6253496d BVsC6AJuNM75bSIm
│    0x0194f140 724f6155 6d503a53 65637265 74734669 rOaUmP:SecretsFi
│    0x0194f150 6c652e53 65637265 74002f6e 69782f73 le.Secret./nix/s
│ -  0x0194f160 746f7265 2f793970 31313035 377a7063 tore/y9p11057zpc
│ -  0x0194f170 35723963 716e6679 32736766 676a796d 5r9cqnfy2sgfgjym
│ -  0x0194f180 77763539 6d2d7661 756c7465 6e762d73 wv59m-vaultenv-s
│ +  0x0194f160 746f7265 2f6b6b62 34773069 30717668 tore/kkb4w0i0qvh
│ +  0x0194f170 6a36306b 646e7870 61736c64 71373967 j60kdnxpasldq79g
│ +  0x0194f180 6c6e6d76 672d7661 756c7465 6e762d73 lnmvg-vaultenv-s
│    0x0194f190 74617469 632d7838 365f3634 2d756e6b tatic-x86_64-unk
│    0x0194f1a0 6e6f776e 2d6c696e 75782d6d 75736c2d nown-linux-musl-
│    0x0194f1b0 302e3135 2e302f65 74630076 61756c74 0.15.0/etc.vault
│    0x0194f1c0 656e765f 7265616c 5f737973 636f6e66 env_real_sysconf
│ -  0x0194f1d0 64697200 2f6e6978 2f73746f 72652f79 dir./nix/store/y
│ -  0x0194f1e0 39703131 3035377a 70633572 3963716e 9p11057zpc5r9cqn
│ -  0x0194f1f0 66793273 6766676a 796d7776 35396d2d fy2sgfgjymwv59m-
│ +  0x0194f1d0 64697200 2f6e6978 2f73746f 72652f6b dir./nix/store/k
│ +  0x0194f1e0 6b623477 30693071 76686a36 306b646e kb4w0i0qvhj60kdn
│ +  0x0194f1f0 78706173 6c647137 39676c6e 6d76672d xpasldq79glnmvg-
│    0x0194f200 7661756c 74656e76 2d737461 7469632d vaultenv-static-
│    0x0194f210 7838365f 36342d75 6e6b6e6f 776e2d6c x86_64-unknown-l
│    0x0194f220 696e7578 2d6d7573 6c2d302e 31352e30 inux-musl-0.15.0
│    0x0194f230 2f6c6962 65786563 2f783836 5f36342d /libexec/x86_64-
│    0x0194f240 6c696e75 782d6768 632d392e 302e322f linux-ghc-9.0.2/
│    0x0194f250 7661756c 74656e76 2d726561 6c2d302e vaultenv-real-0.
│    0x0194f260 31352e30 00766175 6c74656e 765f7265 15.0.vaultenv_re
│    0x0194f270 616c5f6c 69626578 65636469 72002f6e al_libexecdir./n
│ -  0x0194f280 69782f73 746f7265 2f793970 31313035 ix/store/y9p1105
│ -  0x0194f290 377a7063 35723963 716e6679 32736766 7zpc5r9cqnfy2sgf
│ -  0x0194f2a0 676a796d 77763539 6d2d7661 756c7465 gjymwv59m-vaulte
│ +  0x0194f280 69782f73 746f7265 2f6b6b62 34773069 ix/store/kkb4w0i
│ +  0x0194f290 30717668 6a36306b 646e7870 61736c64 0qvhj60kdnxpasld
│ +  0x0194f2a0 71373967 6c6e6d76 672d7661 756c7465 q79glnmvg-vaulte
│    0x0194f2b0 6e762d73 74617469 632d7838 365f3634 nv-static-x86_64
│    0x0194f2c0 2d756e6b 6e6f776e 2d6c696e 75782d6d -unknown-linux-m
│    0x0194f2d0 75736c2d 302e3135 2e302f73 68617265 usl-0.15.0/share
│    0x0194f2e0 2f783836 5f36342d 6c696e75 782d6768 /x86_64-linux-gh
│    0x0194f2f0 632d392e 302e322f 7661756c 74656e76 c-9.0.2/vaultenv
│    0x0194f300 2d726561 6c2d302e 31352e30 00766175 -real-0.15.0.vau
│    0x0194f310 6c74656e 765f7265 616c5f64 61746164 ltenv_real_datad
│ -  0x0194f320 6972002f 6e69782f 73746f72 652f7939 ir./nix/store/y9
│ -  0x0194f330 70313130 35377a70 63357239 63716e66 p11057zpc5r9cqnf
│ -  0x0194f340 79327367 66676a79 6d777635 396d2d76 y2sgfgjymwv59m-v
│ +  0x0194f320 6972002f 6e69782f 73746f72 652f6b6b ir./nix/store/kk
│ +  0x0194f330 62347730 69307176 686a3630 6b646e78 b4w0i0qvhj60kdnx
│ +  0x0194f340 7061736c 64713739 676c6e6d 76672d76 pasldq79glnmvg-v
│    0x0194f350 61756c74 656e762d 73746174 69632d78 aultenv-static-x
│    0x0194f360 38365f36 342d756e 6b6e6f77 6e2d6c69 86_64-unknown-li
│    0x0194f370 6e75782d 6d75736c 2d302e31 352e302f nux-musl-0.15.0/
│    0x0194f380 6c69622f 6768632d 392e302e 322f7838 lib/ghc-9.0.2/x8
│    0x0194f390 365f3634 2d6c696e 75782d67 68632d39 6_64-linux-ghc-9
│    0x0194f3a0 2e302e32 00766175 6c74656e 765f7265 .0.2.vaultenv_re
│    0x0194f3b0 616c5f64 796e6c69 62646972 002f6e69 al_dynlibdir./ni
│ -  0x0194f3c0 782f7374 6f72652f 79397031 31303537 x/store/y9p11057
│ -  0x0194f3d0 7a706335 72396371 6e667932 73676667 zpc5r9cqnfy2sgfg
│ -  0x0194f3e0 6a796d77 7635396d 2d766175 6c74656e jymwv59m-vaulten
│ +  0x0194f3c0 782f7374 6f72652f 6b6b6234 77306930 x/store/kkb4w0i0
│ +  0x0194f3d0 7176686a 36306b64 6e787061 736c6471 qvhj60kdnxpasldq
│ +  0x0194f3e0 3739676c 6e6d7667 2d766175 6c74656e 79glnmvg-vaulten
│    0x0194f3f0 762d7374 61746963 2d783836 5f36342d v-static-x86_64-
│    0x0194f400 756e6b6e 6f776e2d 6c696e75 782d6d75 unknown-linux-mu
│    0x0194f410 736c2d30 2e31352e 302f6c69 622f6768 sl-0.15.0/lib/gh
│    0x0194f420 632d392e 302e322f 7838365f 36342d6c c-9.0.2/x86_64-l
│    0x0194f430 696e7578 2d676863 2d392e30 2e322f76 inux-ghc-9.0.2/v
│    0x0194f440 61756c74 656e762d 7265616c 2d302e31 aultenv-real-0.1
│    0x0194f450 352e302d 42567343 36414a75 4e4d3735 5.0-BVsC6AJuNM75
│    0x0194f460 6253496d 724f6155 6d500076 61756c74 bSImrOaUmP.vault
│    0x0194f470 656e765f 7265616c 5f6c6962 64697200 env_real_libdir.
│ -  0x0194f480 2f6e6978 2f73746f 72652f79 39703131 /nix/store/y9p11
│ -  0x0194f490 3035377a 70633572 3963716e 66793273 057zpc5r9cqnfy2s
│ -  0x0194f4a0 6766676a 796d7776 35396d2d 7661756c gfgjymwv59m-vaul
│ +  0x0194f480 2f6e6978 2f73746f 72652f6b 6b623477 /nix/store/kkb4w
│ +  0x0194f490 30693071 76686a36 306b646e 78706173 0i0qvhj60kdnxpas
│ +  0x0194f4a0 6c647137 39676c6e 6d76672d 7661756c ldq79glnmvg-vaul
│    0x0194f4b0 74656e76 2d737461 7469632d 7838365f tenv-static-x86_
│    0x0194f4c0 36342d75 6e6b6e6f 776e2d6c 696e7578 64-unknown-linux
│    0x0194f4d0 2d6d7573 6c2d302e 31352e30 2f62696e -musl-0.15.0/bin
│    0x0194f4e0 00766175 6c74656e 765f7265 616c5f62 .vaultenv_real_b
│    0x0194f4f0 696e6469 72005061 7468735f 7661756c indir.Paths_vaul
│    0x0194f500 74656e76 5f726561 6c00546f 74616c20 tenv_real.Total 
│    0x0194f510 63756d75 6c617469 76652064 656c6179 cumulative delay

In fact, the offending store path is the final output path of building vaultenvStatic in nix/release.nix. I tried git cleaning my working directory to rule out that untracked intermediate files would affect the build and I ended up with the same store path.

The published binary differs from CI

Looking at the CI logs, it looks like CI built the same kkb4w0i0… path that I got locally. From the CI logs:

installing
Installing library in /nix/store/kkb4w0i0qvhj60kdnxpasldq79glnmvg-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/lib/ghc-9.0.2/x86_64-linux-ghc-9.0.2/vaultenv-real-0.15.0-BVsC6AJuNM75bSImrOaUmP
Installing executable vaultenv in /nix/store/kkb4w0i0qvhj60kdnxpasldq79glnmvg-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/bin
Warning: The directory
/nix/store/kkb4w0i0qvhj60kdnxpasldq79glnmvg-vaultenv-static-x86_64-unknown-linux-musl-0.15.0/bin
is not in the system search path.
Registering library for vaultenv-real-0.15.0..
post-installation fixup
cat nix-store-locations | cachix push channable-public
compressing and pushing /nix/store/ar8mk0qq5safyzp8gnpdz4bc448hgq7k-vaultenv-0.15.0 (5.50 MiB)
compressing and pushing /nix/store/kkb4w0i0qvhj60kdnxpasldq79glnmvg-vaultenv-static-x86_64-unknown-linux-musl-0.15.0 (24.14 MiB)
All done.

Could it be that the 0.15.0 binary that is published on GitHub was produced on a developer machine with a dirty working directory? At least, one that has files in it that pass this filter, possibly Vim swap files or something?

[Riscky]

Thanks for noticing this.
This was caused by artifacts generated by the integration tests, which are incorrectly included in the build.
I have uploaded the correct binary, and I will create a PR to ignore the integration test artifacts in the build.

[ruuda]

Thank you <3