Provide build instructions to verify bytecode

[jonathanpdunne]

Hey,

This code is compiled and built for use in a few browser extensions, and the Chrome store policies these extensions have to adhere to often restrict obfuscated code.

With this, it would be useful to include instructions in this repo, with some Dockerfile or similar, on how to generate the bytes that are uploaded to the npm package at npmjs.com, so the reviewers can verify the source.

A good example of this in practice is the uBlock Origin extension, which also contains compiled WASM: https://github.com/gorhill/uBlock/blob/master/src/js/wasm/README.md)

[jacogr]

CI simply executes “yarn build” and publishes that tag to npm.

The specific steps are here - https://github.com/polkadot-js/wasm/blob/master/scripts/build-wasm.sh

[jonathanpdunne]

Any details on the build environment? It seems that deterministic outputs aren't a guarantee with rust, and so I haven't been able to match the bytes in the npm package by running yarn build.

[jacogr]

It is non-deterministic since it is also known to add paths. However these are part of stacks, which we try to strip completely - have no looked at the raw release output in ages so there may still be some. The Rust version and wasm-bindgen versions do matter, different versions will do different things.

Rust version is set at

wasm/scripts/rust-version.sh

Line 6 in 8db0548

RUST_VER=nightly-2021-12-02

Which is then used at

https://github.com/polkadot-js/wasm/blob/master/scripts/install-build-deps.sh

(Rust/bindgen version do change at points, but it costs a lot of verification before such a change is made in terms of tests and then actual output sizes as well)

[polkadot-js-bot]

This issue has been open for 21 days with no activity and is not labelled as an enhancement. It will be closed in 7 days.

[polkadot-js-bot]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue if you think you have a related problem or query.