builder.rs

`crates/veilvoice-verify/src/builder.rs`

veilvoice-verify · 1210 lines · read the source here · or on GitHub

Build VeilVoice here, and compare what came out against what was published.

The question this answers, and the one it does not

veilvoice verify file answers is this download the one that was published. This answers the harder one: is the published build the one this source produces. A signature says who made a file. Only a build says what the file is made of.

It cannot answer it for anybody else. A build here proves something about this platform and this machine, and that is exactly how a reproducible-build claim is normally checked -- three machines give you three platforms verified. It is a real answer rather than a pretended one.

"Builds for every operating system" means "builds for the one it is on"

A build needs that platform's headers and linker. veilvoice-cli cannot be compiled for Linux from Windows because alsa-sys needs ALSA's headers, and a macOS build needs Apple's SDK, which Apple's licence does not allow to be redistributed or run elsewhere. Every other crate cross-checks cleanly with --target, and that is a type check, not a binary anybody should install.

So this builds VeilVoice for the machine it is on, and compares that against the published build for that platform.

A difference is a finding, not an accusation

Reproducibility is a property of the release, not of the checker. If a build here and the published build differ, that is something to look into and publish -- and this prints both hashes and the names of the differing files rather than a verdict, because "not reproducible" has several causes and most of them are boring: a different compiler version, a path baked into a panic message, a timestamp. It exits Status::NotReproducible, which is deliberately not the status that means tampering.

In plain words

Anyone can sign a file. A signature tells you who put their name to something; it does not tell you that the thing they signed was built from the source code they published. This builds VeilVoice on your own computer, from the source in front of you, and checks whether what comes out is byte-for-byte the same as what was released.

If it is, you know the released program is the source code -- not because anybody said so, but because you produced the same thing yourself.

If it is not, that is worth knowing and worth reporting, and it is usually something dull rather than something sinister. So this shows you both answers and which files differed, and leaves the conclusion to you.

WHAT THIS FILE CONTAINS

1210 lines defining 20 functions (16 public), 3 types and 3 constants. Everything below is read out of the source, so it cannot disagree with the code.

The types it owns.

struct Built line 79 · What a build produced.
struct Environment line 256 · Everything that would otherwise differ between two builds of one source.
enum Compared line 532 · How a built file compared against the published list.

What happens when it runs. These are the ways in: public, and nothing else in this file calls them, so they are what an outside caller reaches first.

looks_like_the_source line 94 · Whether the source tree this is pointed at is really one.
pinned_toolchain line 126 · The compiler version the source tree pins itself to.
Environment::describe line 278 · The settings, for printing before a build.
environment line 372 · The environment the release is built in, for this tree on this machine.
reaches as_the_compiler_sees_it, cargo_home, commit_date, host_triple, repro_link, target_directory, json_string_field
build line 423 · Run the release build.
reaches target_directory, json_string_field
hash_what_was_built line 495 · Hash every binary a release ships, from a directory a build left behind.
reaches with_platform_extension
compare line 565 · Compare a build against a hash list.
report_dependencies line 603 · Report what a dependency check found.
install line 646 · Run one install command, having been told yes.
agreed line 672 · Ask, and take only an unambiguous yes.
status_for line 689 · The status a comparison should exit with.
reaches all_matched

WHAT CALLS WHAT

The functions this file defines, and the calls between them. An edge means the callee's name appears, called, inside the caller's body. This is a syntactic reading, not a type-resolved one.

The same graph as Mermaid source

%%{init: {"theme":"base","themeVariables":{"background":"#1a1b26","primaryColor":"#1f2335","primaryTextColor":"#c0caf5","primaryBorderColor":"#7aa2f7","secondaryColor":"#16161e","tertiaryColor":"#16161e","lineColor":"#737aa2","textColor":"#c0caf5","mainBkg":"#1f2335","nodeBorder":"#7aa2f7","clusterBkg":"#16161e","clusterBorder":"#2f3549","fontFamily":"ui-monospace, SFMono-Regular, Consolas, monospace","fontSize":"14px"}}}%%
flowchart TD
    n_looks_like_the_source(["looks_like_the_source<br/>line 94"])
    n_pinned_toolchain(["pinned_toolchain<br/>line 126"])
    n_host_triple["host_triple<br/>line 139"]
    n_target_directory["target_directory<br/>line 168"]
    n_json_string_field["json_string_field<br/>line 199"]
    n_describe(["Environment::describe<br/>line 278"])
    n_repro_link["repro_link<br/>line 298"]
    n_cargo_home["cargo_home<br/>line 313"]
    n_commit_date["commit_date<br/>line 322"]
    n_as_the_compiler_sees_it["as_the_compiler_sees_it<br/>line 347"]
    n_environment(["environment<br/>line 372"])
    n_build(["build<br/>line 423"])
    n_hash_what_was_built(["hash_what_was_built<br/>line 495"])
    n_with_platform_extension["with_platform_extension<br/>line 522"]
    n_compare(["compare<br/>line 565"])
    n_all_matched["all_matched<br/>line 591"]
    n_report_dependencies(["report_dependencies<br/>line 603"])
    n_install(["install<br/>line 646"])
    n_agreed(["agreed<br/>line 672"])
    n_status_for(["status_for<br/>line 689"])
    n_build --> n_target_directory
    n_environment --> n_as_the_compiler_sees_it
    n_environment --> n_cargo_home
    n_environment --> n_commit_date
    n_environment --> n_host_triple
    n_environment --> n_repro_link
    n_environment --> n_target_directory
    n_hash_what_was_built --> n_with_platform_extension
    n_status_for --> n_all_matched
    n_target_directory --> n_json_string_field
    click n_looks_like_the_source href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L94" "open the source"
    click n_pinned_toolchain href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L126" "open the source"
    click n_host_triple href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L139" "open the source"
    click n_target_directory href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L168" "open the source"
    click n_json_string_field href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L199" "open the source"
    click n_describe href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L278" "open the source"
    click n_repro_link href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L298" "open the source"
    click n_cargo_home href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L313" "open the source"
    click n_commit_date href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L322" "open the source"
    click n_as_the_compiler_sees_it href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L347" "open the source"
    click n_environment href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L372" "open the source"
    click n_build href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L423" "open the source"
    click n_hash_what_was_built href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L495" "open the source"
    click n_with_platform_extension href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L522" "open the source"
    click n_compare href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L565" "open the source"
    click n_all_matched href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L591" "open the source"
    click n_report_dependencies href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L603" "open the source"
    click n_install href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L646" "open the source"
    click n_agreed href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L672" "open the source"
    click n_status_for href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-verify/src/builder.rs#L689" "open the source"
    classDef entry fill:#1f2335,stroke:#7aa2f7,color:#c0caf5
    class n_looks_like_the_source,n_pinned_toolchain,n_describe,n_environment,n_build,n_hash_what_was_built,n_compare,n_report_dependencies,n_install,n_agreed,n_status_for entry
    classDef api fill:#1f2335,stroke:#7dcfff,color:#c0caf5
    class n_host_triple,n_target_directory,n_repro_link,n_with_platform_extension,n_all_matched api
    classDef helper fill:#1f2335,stroke:#bb9af7,color:#c0caf5
    class n_json_string_field,n_cargo_home,n_commit_date,n_as_the_compiler_sees_it helper

This site loads no third-party script, so it cannot run Mermaid; the diagram above is the same nodes and edges drawn by the generator instead. GitHub renders the source below directly.

ITEMS

Item	Line	Documentation
`RELEASE_ARGS` _{pub const}	63	The profile a release is built with.
`RELEASE_DIR` _{pub const}	66	Where a release build leaves its binaries, relative to the target directory.
`SHIPPED` _{pub const}	75	The binaries a release publishes, without any platform extension.
`Built` _{pub struct}	79	What a build produced.
`looks_like_the_source` _{pub fn}	94	Whether the source tree this is pointed at is really one.
`pinned_toolchain` _{pub fn}	126	The compiler version the source tree pins itself to.
`host_triple` _{pub fn}	139	The platform triple this build is for, as rustc names it.
`target_directory` _{pub fn}	168	Where this workspace's build output actually goes.
`json_string_field` _fn	199	One top-level string out of cargo's JSON, without a JSON parser.
`Environment` _{pub struct}	256	Everything that would otherwise differ between two builds of one source.
`Environment::describe` _{pub fn}	278	The settings, for printing before a build.
`repro_link` _{pub fn}	298	Flags that make this platform's linker deterministic.
`cargo_home` _fn	313	Where cargo keeps downloaded crates, whose paths are also baked in.
`commit_date` _fn	322	The date of the commit being built, as seconds since the epoch.
`as_the_compiler_sees_it` _fn	347	A path as the compiler will see it, for the remapping to match.
`environment` _{pub fn}	372	The environment the release is built in, for this tree on this machine.
`build` _{pub fn}	423	Run the release build.
`hash_what_was_built` _{pub fn}	495	Hash every binary a release ships, from a directory a build left behind.
`with_platform_extension` _{pub fn}	522	A binary's name on this platform.
`Compared` _{pub enum}	532	How a built file compared against the published list.
`compare` _{pub fn}	565	Compare a build against a hash list.
`all_matched` _{pub fn}	591	Whether every file that could be compared matched.
`report_dependencies` _{pub fn}	603	Report what a dependency check found.
`install` _{pub fn}	646	Run one install command, having been told yes.
`agreed` _{pub fn}	672	Ask, and take only an unambiguous yes.
`status_for` _{pub fn}	689	The status a comparison should exit with.