Deterministic compilation / reproducible builds

[GCdePaula]

I need to make sure generated binaries (cross compiled) are reproducible. I'm a bit lost on how to achieve this with cross.

How can I set a specific version of the toolchain? Is that enough?

[Emilgardis]

just use it like cargo (cross +toolchain), but use a set image for cross to use so that it doesn't change with updates unexpectedly

https://github.com/cross-rs/cross/blob/main/docs/config_file.md#targettargetimage

ofc you should use --remap-path-prefix in cargo and other flags to make the output reproducible if necessary

[GCdePaula]

Ok! Thank you for the quick reply :)

If I understood correctly, I should set an image from the cross project with a specific tag, so that it doesn't change unexpectedly. Is there a change these images use a dependency that isn't "pegged", and some apt update/install makes the build not reproducible?

[Emilgardis]

Pretty much!
The untagged/images tagged main* are updated weekly, apt will ofc always change on apt update. So being reproducible that way you'll have to do it some other way, however usually we don't statically link foreign objects in rust, instead we dynamically link.

[GCdePaula]

Alright! Thanks!

Cheers.