mirror of
https://github.com/astral-sh/uv
synced 2026-06-21 13:47:25 +00:00
konsti
d190665157
Using the docker container, we can reproducibly build the committed windows trampolines given that neither the sources nor the crate versions change, as the crate versions are part of cargo's Strict Version Hash which determines the ordering in binaries. If we mandated the committed binaries to always be up to date, every version bump would require rebuilding them. Instead, we only require updating them when any rust sources of the trampoline crate change, or the "build:windows-trampoline" is set. This allows the trampolines to go "stale", while still ensuring that when the checked-in binaries are always built from checked-in sources (security) and that updating the trampoline sources comes with an update to the binaries.
43 lines
1.5 KiB
Bash
Executable File
43 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# Build all Windows trampoline executables reproducibly using Docker.
|
|
#
|
|
# Extra arguments are forwarded to the docker build command
|
|
|
|
set -euo pipefail
|
|
|
|
if ! command -v docker >/dev/null 2>&1 && command -v podman >/dev/null 2>&1; then
|
|
docker() { podman "$@"; }
|
|
fi
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
TRAMPOLINE_DIR="$REPO_ROOT/crates/uv-trampoline"
|
|
OUTPUT_DIR="$REPO_ROOT/crates/uv-trampoline-builder/trampolines"
|
|
|
|
# Read the nightly toolchain from `rust-toolchain.toml`.
|
|
TOOLCHAIN="$(grep '^channel' "$TRAMPOLINE_DIR/rust-toolchain.toml" | sed 's/.*"\(.*\)"/\1/')"
|
|
|
|
# Pin to linux/amd64 so the container always matches the x86_64-unknown-linux-gnu
|
|
# toolchain hardcoded in the Dockerfile, regardless of the host architecture.
|
|
PLATFORM="linux/amd64"
|
|
|
|
# Build the pinned toolchain image.
|
|
docker buildx build -t uv-trampoline-builder --load \
|
|
--platform "$PLATFORM" \
|
|
-f "$TRAMPOLINE_DIR/Dockerfile" "$TRAMPOLINE_DIR" \
|
|
"$@"
|
|
|
|
# Build trampolines inside the container.
|
|
docker run --rm \
|
|
--platform "$PLATFORM" \
|
|
-v "$REPO_ROOT:/source:ro" \
|
|
-v "$OUTPUT_DIR:/output" \
|
|
-v "$SCRIPT_DIR/build-trampolines-in-docker.sh:/build-trampolines-in-docker.sh:ro" \
|
|
uv-trampoline-builder \
|
|
bash /build-trampolines-in-docker.sh "$TOOLCHAIN"
|
|
|
|
# Zero out non-deterministic PE fields (timestamps, debug GUIDs).
|
|
cargo run --quiet -p uv-trampoline-builder --bin normalize-pe-timestamps -- "$OUTPUT_DIR"/*.exe
|
|
|
|
echo "Done. Trampolines written to $OUTPUT_DIR"
|