<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
Hi All,
<p>I recently worked on reproducibility for the Ethereum client <a
href="https://github.com/ethereum/go-ethereum/">Geth</a> and
wanted to share some insights from this work.</p>
<p><br>
</p>
<p>Although the Go toolchain provides reproducibility primitives,
achieving fully reproducible builds in practice is still
challenging. </p>
<p>In our work with Geth, we found three primary reasons for this:</p>
<ol>
<li>
<p><strong>CGO Complexity</strong><br>
Integrating C code in Go introduces complexity, here resulting
in unreproducible builds. Specifically, we’ve observed
inconsistent build IDs (<code>.note.go.buildid</code> and <code>.note.gnu.build-id</code>),
likely due to system-specific paths.</p>
</li>
<li>
<p><strong>Project-Specific Build Configurations</strong><br>
Custom build scripts and environment settings can create
subtle issues. For instance, inconsistencies arise when
embedding metadata with <code>-ldflag -X</code>, or when
shared build states affect the <code>go buildinfo</code>
across jobs.</p>
</li>
<li>
<p><strong>Software Bugs</strong><br>
As known, reproducibility efforts also reveal software bugs.
We identified two ones: an <a
href="https://github.com/golang/go/issues/67011">issue</a>
with Go’s <code>trimpath</code> command and a <a
href="https://travis-ci.community/t/travis-uses-unexpected-ubuntu-distribution">bug</a>
in the Travis CI client leading to inconsistent GCC versions
when building.</p>
</li>
</ol>
<p><br>
</p>
<p>For details, see <strong>Chapter 5</strong> in <a
href="https://www.diva-portal.org/smash/record.jsf?pid=diva2%3A1908608&dswid=445">Geth
Rebuild: Verifiable Builds for Go Ethereum</a>.</p>
<p><br>
</p>
<p><b>Takeaway:</b><br>
</p>
<p>The reproducibility effort in Go still requires manual
intervention and community support to succeed, despite the
existing primitives. </p>
<p>In my experience, ease of adoption for developers is essential
for reproducible builds to be implemented as a security mechanism.
Therefore, it would be valuable to explore the broader
reproducibility state and remaining challenges to reproducible
builds in Go, eg. through a Go-specific rebuilder project.</p>
<p><br>
</p>
<p>Any thoughts are welcome!</p>
<pre class="moz-signature" cols="72">--
Vivi Andersson
PhD Student, Department of Theoretical Computer Science
KTH Royal Institute of Technology
Stockholm, Sweden</pre>
</body>
</html>