Reproducible Builds

[tri-adam]

Reproducible builds are important as they provide an independently-verifiable path from source to binary code (ref).

The goreleaser configuration follows some of the recommendations for reproducible builds available here. We do not currently make use of the -trimpath flag, though arguably formal releases are always built by continuous integration, and thus use a consistent directory structure.

On the other hand the mage build is not currently reproducible, as demonstrated by running the build twice from the same commit:

$ mage install
$ sha256sum ~/go/bin/siftool 
d959a6f5bc4e17353df582ce60b5ae5cb2a50a85210c9e6f061a25774c54c348  /home/adam/go/bin/siftool
$ mage install
$ sha256sum ~/go/bin/siftool 
f6a1b211003de62897ebc0fb476694945a81b9bdfa31d027670caaf96047a200  /home/adam/go/bin/siftool

I think it might make sense to make the siftool build reproducible, and unify the build flags used between goreleaser and mage.