Cross platform reproducible builds

Author: antoniolocascio

tools/reproduce/Dockerfile

@@ -1,26 +1,44 @@
 # Use a specific version of Rust for reproducibility
-# FROM debian:bullseye-slim as builder
-FROM debian:bullseye-slim@sha256:f527627d07c18abf87313c341ee8ef1b36f106baa8b6b6dc33f4c872d988b651 AS builder
-
-RUN apt-get update && apt-get install -y \
-    curl \
-    build-essential \
-    git \
-    libssl-dev \
-    pkg-config
-
-# version MUST be the same as in /tools/verifier/rust-toolchain.toml    
-RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain nightly-2025-07-25
-ENV PATH="/root/.cargo/bin:${PATH}"
-
-RUN rustup target add riscv32i-unknown-none-elf
-RUN rustup component add llvm-tools-preview
-RUN rustup component add rust-src
-RUN cargo install cargo-binutils
-
-# RUN git clone  --depth 1 -b mmzk_0608_reproduce  https://github.com/matter-labs/zksync-airbender.git
+# Pinning os version and architecture for reproducibility
+FROM --platform=linux/amd64 debian:bullseye-slim@sha256:4edd2740ebd41d71ef78eed0081c8979e287e2496c6fca892f5936d1e22adcd3 AS builder
+
+
+# Freeze APT to a specific point in time (matches base image date)
+ARG DEBIAN_SNAPSHOT=20250811T000000Z
+
+# Use snapshot.debian.org and disable Valid-Until
+RUN set -eux; \
+  printf 'Acquire::Check-Valid-Until "false";\n' > /etc/apt/apt.conf.d/99snapshot; \
+  printf 'Acquire::http::No-Cache "true";\n'     > /etc/apt/apt.conf.d/99no-cache; \
+  echo "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main"            >  /etc/apt/sources.list; \
+  echo "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" >> /etc/apt/sources.list; \
+  apt-get -o Acquire::Check-Valid-Until=false update
+
+# Setting a fixed SOURCE_DATE_EPOCH for reproducible builds
+# reproduce.sh will set it based on last commit date
+ARG SOURCE_DATE_EPOCH=1700000000
+ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH} \
+    CARGO_INCREMENTAL=0 \
+    TZ=UTC LANG=C.UTF-8 LC_ALL=C.UTF-8
+
+# Toolchain (paths pinned so absolute paths don’t leak)
+ENV CARGO_HOME=/opt/cargo RUSTUP_HOME=/opt/rustup
+ENV PATH=/opt/cargo/bin:$PATH
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates curl git build-essential libssl-dev pkg-config \
+ && rm -rf /var/lib/apt/lists/*
+# version MUST be the same as in /tools/verifier/rust-toolchain.toml
+RUN curl -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain nightly-2025-07-25 --profile minimal
+RUN rustup target add riscv32i-unknown-none-elf \
+ && cargo install cargo-binutils --locked \
+ && rustup component add llvm-tools-preview \
+ && rustup component add rust-src
+
+ENV CARGO_TARGET_RISCV32I_UNKNOWN_NONE_ELF_AR=llvm-ar
+ENV CARGO_TARGET_RISCV32I_UNKNOWN_NONE_ELF_RANLIB=llvm-ranlib
+
 COPY . zksync-airbender
 
-WORKDIR zksync-airbender/tools/verifier
+WORKDIR /zksync-airbender/tools/verifier
 
-RUN ./build.sh
+RUN ./build.sh

tools/reproduce/reproduce.sh

@@ -2,14 +2,21 @@
 
 # Make sure to run from the main zksync-airbender directory.
 
-set -e  # Exit on any error
+set -euo pipefail
+
+# Set source date epoch for reproducible builds
+SDE="$(git log -1 --format=%ct || echo 1700000000)"
 
 export DOCKER_DEFAULT_PLATFORM=linux/amd64
 
 # create a fresh docker
-docker build -t airbender-verifiers  -f tools/reproduce/Dockerfile .
+docker build \
+  --build-arg SOURCE_DATE_EPOCH="$SDE" \
+  --platform linux/amd64 \
+  -t airbender-verifiers \
+  -f tools/reproduce/Dockerfile .
 
-docker create --name verifiers airbender-verifiers
+cid="$(docker create --platform=linux/amd64 airbender-verifiers)"
 
 FILES=(
     base_layer.bin
@@ -35,9 +42,9 @@ FILES=(
 )
 
 for FILE in "${FILES[@]}"; do
-    docker cp verifiers:/zksync-airbender/tools/verifier/$FILE tools/verifier/
+    docker cp "$cid":/zksync-airbender/tools/verifier/"$FILE" tools/verifier/
     md5sum tools/verifier/$FILE
 done
 
 
-docker rm verifiers
+docker rm -f "$cid" >/dev/null

tools/verifier/.cargo/config.toml

@@ -7,5 +7,9 @@ rustflags = [
   "-C", "link-arg=-Tsrc/lds/link.x",
   "-C", "link-arg=--save-temps",
   "-C", "force-frame-pointers",
+  # reproducibility
+  "--remap-path-prefix= /=/src",
+  "-C", "link-arg=--build-id=sha1",
+  "-C", "codegen-units=1",
 ]
 

tools/verifier/rust-toolchain.toml

@@ -1,2 +1,3 @@
+# If changed, also change tools/reproduce/Dockerfile
 [toolchain]
-channel = "nightly-2025-07-25"
+channel = "nightly-2025-07-25"