Reproducible Builds on Windows

[Danilo]

Hi folks

I'm involved with trying to achieve reproducible builds for Threema Desktop 2.0 (https://three.ma/md).

Threema Desktop is an Electron application containing both native node modules (written in C, using node-gyp as build system) as well as a Rust binary.

To achieve reproducible builds, things I've discovered and fixed so far:

- I added the undocumented `/Brepro` MSVC linker flag to ensure that no timestamps are added to the PE binaries
- I added the `/PDBALTPATH:%_PDB%` MSVC linker flag to avoid having absolute build directory paths embedded in the PE binaries
- I added a `rust-toolchain.toml` file to the Rust subproject to ensure that the identical toolchain version is being used for all builds

For node modules, the linker flags can be added in `binding.gyp`. For example:

    ...
    "msvs_settings": {
      ...
      "VCLinkerTool": {
        "AdditionalOptions": [
          # Reproducible builds: Do not include timestamps in binary
          "/Brepro",
          # Reproducible builds: Do not include absolute paths to debug symbols in binary
          "/PDBALTPATH:%_PDB%"
        ]}
    },
    ...

For the Rust project, the config can be added in `.cargo/config.toml`:

    [target.'cfg(target_env = "msvc")']
    rustflags = ["-C", "link-args=/Brepro"] # Reproducible builds on Windows

For debugging, diffoscope (especially the try.diffoscope.org website) was a big help, thanks!

One aspect that I cannot get rid of is the embedded toolchain information, as well as differing behavior between toolchain versions. As an example, the COFF header of the PE files contains the following header fields when buliding with the Visual Studio 2022 toolchain:

    MajorLinkerVersion»     14
    MinorLinkerVersion»     42

>From what I could gather, there is no way to really solve this issue. The approach that we currently plan to implement is to simply declare the toolchain version we used, and let the user deal with the effort to get it installed.

Are there any alternatives? How are other Windows projects dealing with this? Is there maybe a way to build using a MSVC toolchain in a container using Docker for Windows, or something similar? Or can a MSVC redistributable toolchain be installed to a directory, and selected using some environment variables?

Cheers,
Danilo