cmd/rofl/build: Improve reproducible builds with squashfs-tools

[ptrus]

Fixes: #592

This change refactors the squashfs build to produce bit-for-bit identical outputs across multiple environments, but the resulting images differ from those built with previous versions. We should probably do a major bump of CLI to 0.17 once this is merged.

I have tested this change on:

• Ubuntu host
• Ubuntu Docker container on Ubuntu host
• Debian Bookworm Docker container on Ubuntu host
• Ubuntu Docker container on macOS host

In all cases, the resulting rofl app builds produced identical Enclave IDs.

I wasn't able to avoid fakeroot: even with adding -all-root -force-uid 0, -force-gid 0 to sqfstar.
Also, I wasn't able to get it working without tar -> sqfstar.
I also added a warning to check for version version 4.5, because using 4.7.4 i get a different Enclave IDs.

Edit:

• Maybe it would be worth finding out where the difference between 4.5 and 4.7.4 comes from, because based on the changelog, it's not apparent to me. Then we could achieve even greater reproducibility. Will try a bit, but don't want to spend too much time on this.
  • 4.6.x and 4.7.x produce identical images, while 4.5.x produces different. So the change is in 4.6 .

I have confirmed the difference comes from the following bug fix in 4.6:

8.4 Sqfstar would incorrectly strip pathname components in PAX header linkpath if symbolic.

Will try switching from "--format=pax to "--format=gnu in the tar command.

This fixed the issue 🎉 This is now also reproducable across squashfs-tools >= 4.5

[netlify]

✅ Deploy Preview for oasisprotocol-cli canceled.

Name	Link
🔨 Latest commit	92b87b2
🔍 Latest deploy log	https://app.netlify.com/projects/oasisprotocol-cli/deploys/6912eb7650803e0008e9be7a

[abukosek]

Looks good! :) I've given it a quick try on my macOS and Linux dev machines and it generates the exact same output.

Going via tar was also one of my considerations for fixing the UTF-8 normalization differences between Linux and macOS, it's good to see that this also fixes other problems.

[ptrus]

I have also made it reproducible across different squashfs tools versions (see updated description).

[kostko]

Very cool, great work!