aboutsummaryrefslogtreecommitdiff
path: root/doc/safer-build.md
blob: 0502e312e34c246e3681832b2e200a36cadbf762 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
# Safer build options

By default,
the Rust compiler includes your current path information
in the binaries that it generates.
This could be a problem if,
for example, you are building from a path like
`/home/FirstnameLastname/build/arti`
and releasing binaries (or uploading backtraces)
under a pseudonym
that you do not want linked to `FirstnameLastname`.

There is a good overview of the issues here at
https://github.com/betrusted-io/xous-core/issues/57 .

There are a couple of workarounds here.

# Workaround one: reproducible build

If you have Docker,
you can run a reproducible build of Arti,
so that the binary you make will be the same
as a binary generated by anybody else.

See the
[`docker-reproducible-build`](../maint/docker-reproducible-build)
script for more information.

# Workaround two: RUSTFLAGS

As a quick-and-dirty solution,
you can use the `--remap-path-prefix` option
to tell the Rust compiler
to re-map your paths into anonymized ones.

This is not a perfect solution;
there are known issues under some configurations,
particularly if you are linking to a static OpenSSL.

Personally, I get good results from running:

```
RUSTFLAGS="--remap-path-prefix $HOME/.cargo=.cargo --remap-path-prefix $(pwd)=." \
   cargo build --locked --release -p arti
```

After you do this, you can use
`strings target/release/arti | grep "$HOME"`
to see if your home directory appears in the result.