@fmanco will it be possible to easily setup a system that builds a binary that has the same hash as the binary released upstream? (i'm talking about 100% reproducible builds)

In some sense yes. Buck is actually much better at guaranteeing reproducible builds than CMake. If you take a look at https://buckbuild.com/ this is the second thing highlighted. However we're not going to provide a toolchain anymore, so as far as you use the same toolchain this should be possible, but that's something that we're not providing, at least yet.

so, the real answer is no, not possible

Is the toolchain you are going to use internally public? Is it possible to replicate it?

@groob indeed no. But just to clarify are you talking about getting any distro building osquery and getting the exact same binary, or just building twice out of the same VM image giving the same binary?

I see; but doesn't that mean that osquery will have to build once for each supported system and distribution?

Possibly yes we would need to build for each os if we don't statically link everything. I'll check whether we'll be able to provide a toolchain as well. In fact the external build is something we're still finalising. What is clear is that toolchain will be out of the code dependencies (so you can build with whatever toolchain you like), but we can try to make it part of provisioning.

static binaries are awesome. please keep them ❤️

Indeed this would theoretically make it possible to have completely reproducible builds but AFAIK the current system doesn't do that either. If you build the same commit out of Ubuntu and Centos you'll get different binaries. Buck puts us in a better place to make this happen.

A small note though; it is already possible to use an arbitrary toolchain (and call CMake directly without the current Makefile wrapper)

@groob yes we will. But if you look at the current binary it is not 100% statically linked, we still have some dynamic libs.

that’s mostly fine

I think that having at least a small readme that shows how build the same toolchain used upstream is really important

What exactly do you mean by upstream? Notice that we'll test everything and build packages out of a public toolchain (either provided by us or packaged by the distro).