docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes - #2

Merged
HarryR merged 1 commit into
mainfrom
reproducible-builds-doc
Jul 10, 2026
Merged

docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes#2
HarryR merged 1 commit into
mainfrom
reproducible-builds-doc

Conversation

@HarryR

@HarryRHarryR commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

What

Adds a top-level REPRODUCIBLE-BUILDS.md describing how the stage0 -> UKI chain is kept byte-for-byte reproducible, and refreshes README/toolchain notes that went stale with the recent build changes.

REPRODUCIBLE-BUILDS.md covers

  • The guarantees: aligned pinned toolchain (both 1.91.1), SOURCE_DATE_EPOCH, --locked, per-target static rustflags.
  • The two path-embedding traps that broke CI==local and their --remap-path-prefix fixes: CARGO_HOME (/tmp/.cargo in CI vs /src/.cargo local) and rust-src (rust-analyzer installs it locally; CI's clean toolchain doesn't → different std panic-location paths).
  • The toolchain-bump procedure — update the /rustc/<hash> in the rust-src remap in both repos, or reproducibility silently regresses.
  • How to verify CI == local (gh run download the CI artifacts, sha256 linux.efi/stage2; Authenticode/path-canonical check for stage0's db-signed BOOTX64.EFI).

Also

Refreshes now-stale notes caused by the merged work: the README image table said "static-musl RUSTFLAGS" (moved to per-target config) and "stage1 1.91.0" (now 1.91.1), and described the shared .cargo/config.toml as carrying musl link flags (it now carries only [env]). Fixed those + this file's own comment.

Pairs with lockboot/stage0#9 and lockboot/stage1#18 (the reproducibility fixes themselves).

🤖 Generated with Claude Code

@HarryR@claude
docs: add REPRODUCIBLE-BUILDS.md; refresh stale README/toolchain notes
f826b4c
Document how the chain's builds are made byte-for-byte reproducible (and how CI
and local are kept identical): pinned+aligned toolchain, SOURCE_DATE_EPOCH,
locked deps, per-target static-linking rustflags, and the two path-embedding
traps that broke it -- CARGO_HOME (/tmp vs /src) and rust-src sysroot paths --
both fixed with --remap-path-prefix. Includes the toolchain-bump procedure
(update the /rustc/<hash> in the rust-src remap) and the CI==local verify steps.
Also refresh notes that went stale when the global RUSTFLAGS moved to per-target
config and stage1's toolchain was aligned to 1.91.1: the README image table and
toolchain/target policy, and this file's own comment (dropped the "lockboot
(1.91.0)" reference; stage0/stage1 are both 1.91.1 now).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@HarryR
HarryR marked this pull request as ready for review July 10, 2026 07:02
@HarryR
HarryR merged commit 9add9eb into mainJul 10, 2026
@HarryR
HarryR deleted the reproducible-builds-doc branch July 10, 2026 07:03
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@HarryR
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes - #2
Merged
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Jul 10, 2026
Merged
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes#2
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Conversation
@HarryR
@HarryRHarryR
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
What
Adds a top-level REPRODUCIBLE-BUILDS.md describing how the stage0 -> UKI chain is kept byte-for-byte reproducible, and refreshes README/toolchain notes that went stale with the recent build changes.
REPRODUCIBLE-BUILDS.md covers
  • The guarantees: aligned pinned toolchain (both 1.91.1), SOURCE_DATE_EPOCH, --locked, per-target static rustflags.
  • The two path-embedding traps that broke CI==local and their --remap-path-prefix fixes: CARGO_HOME (/tmp/.cargo in CI vs /src/.cargo local) and rust-src (rust-analyzer installs it locally; CI's clean toolchain doesn't → different std panic-location paths).
  • The toolchain-bump procedure — update the /rustc/<hash> in the rust-src remap in both repos, or reproducibility silently regresses.
  • How to verify CI == local (gh run download the CI artifacts, sha256 linux.efi/stage2; Authenticode/path-canonical check for stage0's db-signed BOOTX64.EFI).
Also
Refreshes now-stale notes caused by the merged work: the README image table said "static-musl RUSTFLAGS" (moved to per-target config) and "stage1 1.91.0" (now 1.91.1), and described the shared .cargo/config.toml as carrying musl link flags (it now carries only [env]). Fixed those + this file's own comment.
Pairs with lockboot/stage0#9 and lockboot/stage1#18 (the reproducibility fixes themselves).
🤖 Generated with Claude Code
@HarryR@claude
docs: add REPRODUCIBLE-BUILDS.md; refresh stale README/toolchain notes
f826b4c
Document how the chain's builds are made byte-for-byte reproducible (and how CI
and local are kept identical): pinned+aligned toolchain, SOURCE_DATE_EPOCH,
locked deps, per-target static-linking rustflags, and the two path-embedding
traps that broke it -- CARGO_HOME (/tmp vs /src) and rust-src sysroot paths --
both fixed with --remap-path-prefix. Includes the toolchain-bump procedure
(update the /rustc/<hash> in the rust-src remap) and the CI==local verify steps.
Also refresh notes that went stale when the global RUSTFLAGS moved to per-target
config and stage1's toolchain was aligned to 1.91.1: the README image table and
toolchain/target policy, and this file's own comment (dropped the "lockboot
(1.91.0)" reference; stage0/stage1 are both 1.91.1 now).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@HarryR
HarryR
marked this pull request as ready for review
July 10, 2026 07:02
@HarryR
HarryR
merged commit 9add9eb
into
mainJul 10, 2026
@HarryR
HarryR
deleted the

reproducible-builds-doc

branch
July 10, 2026 07:03
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@HarryR

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes - #2
Merged
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Jul 10, 2026
Merged
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes#2
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Conversation
@HarryR
@HarryRHarryR
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
What
Adds a top-level REPRODUCIBLE-BUILDS.md describing how the stage0 -> UKI chain is kept byte-for-byte reproducible, and refreshes README/toolchain notes that went stale with the recent build changes.
REPRODUCIBLE-BUILDS.md covers
  • The guarantees: aligned pinned toolchain (both 1.91.1), SOURCE_DATE_EPOCH, --locked, per-target static rustflags.
  • The two path-embedding traps that broke CI==local and their --remap-path-prefix fixes: CARGO_HOME (/tmp/.cargo in CI vs /src/.cargo local) and rust-src (rust-analyzer installs it locally; CI's clean toolchain doesn't → different std panic-location paths).
  • The toolchain-bump procedure — update the /rustc/<hash> in the rust-src remap in both repos, or reproducibility silently regresses.
  • How to verify CI == local (gh run download the CI artifacts, sha256 linux.efi/stage2; Authenticode/path-canonical check for stage0's db-signed BOOTX64.EFI).
Also
Refreshes now-stale notes caused by the merged work: the README image table said "static-musl RUSTFLAGS" (moved to per-target config) and "stage1 1.91.0" (now 1.91.1), and described the shared .cargo/config.toml as carrying musl link flags (it now carries only [env]). Fixed those + this file's own comment.
Pairs with lockboot/stage0#9 and lockboot/stage1#18 (the reproducibility fixes themselves).
🤖 Generated with Claude Code
@HarryR@claude
docs: add REPRODUCIBLE-BUILDS.md; refresh stale README/toolchain notes
f826b4c
Document how the chain's builds are made byte-for-byte reproducible (and how CI
and local are kept identical): pinned+aligned toolchain, SOURCE_DATE_EPOCH,
locked deps, per-target static-linking rustflags, and the two path-embedding
traps that broke it -- CARGO_HOME (/tmp vs /src) and rust-src sysroot paths --
both fixed with --remap-path-prefix. Includes the toolchain-bump procedure
(update the /rustc/<hash> in the rust-src remap) and the CI==local verify steps.
Also refresh notes that went stale when the global RUSTFLAGS moved to per-target
config and stage1's toolchain was aligned to 1.91.1: the README image table and
toolchain/target policy, and this file's own comment (dropped the "lockboot
(1.91.0)" reference; stage0/stage1 are both 1.91.1 now).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@HarryR
HarryR
marked this pull request as ready for review
July 10, 2026 07:02
@HarryR
HarryR
merged commit 9add9eb
into
mainJul 10, 2026
@HarryR
HarryR
deleted the

reproducible-builds-doc

branch
July 10, 2026 07:03
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@HarryR

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes - #2
Merged
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Jul 10, 2026
Merged
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes#2
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Conversation
@HarryR
@HarryRHarryR
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
What
Adds a top-level REPRODUCIBLE-BUILDS.md describing how the stage0 -> UKI chain is kept byte-for-byte reproducible, and refreshes README/toolchain notes that went stale with the recent build changes.
REPRODUCIBLE-BUILDS.md covers
  • The guarantees: aligned pinned toolchain (both 1.91.1), SOURCE_DATE_EPOCH, --locked, per-target static rustflags.
  • The two path-embedding traps that broke CI==local and their --remap-path-prefix fixes: CARGO_HOME (/tmp/.cargo in CI vs /src/.cargo local) and rust-src (rust-analyzer installs it locally; CI's clean toolchain doesn't → different std panic-location paths).
  • The toolchain-bump procedure — update the /rustc/<hash> in the rust-src remap in both repos, or reproducibility silently regresses.
  • How to verify CI == local (gh run download the CI artifacts, sha256 linux.efi/stage2; Authenticode/path-canonical check for stage0's db-signed BOOTX64.EFI).
Also
Refreshes now-stale notes caused by the merged work: the README image table said "static-musl RUSTFLAGS" (moved to per-target config) and "stage1 1.91.0" (now 1.91.1), and described the shared .cargo/config.toml as carrying musl link flags (it now carries only [env]). Fixed those + this file's own comment.
Pairs with lockboot/stage0#9 and lockboot/stage1#18 (the reproducibility fixes themselves).
🤖 Generated with Claude Code
@HarryR@claude
docs: add REPRODUCIBLE-BUILDS.md; refresh stale README/toolchain notes
f826b4c
Document how the chain's builds are made byte-for-byte reproducible (and how CI
and local are kept identical): pinned+aligned toolchain, SOURCE_DATE_EPOCH,
locked deps, per-target static-linking rustflags, and the two path-embedding
traps that broke it -- CARGO_HOME (/tmp vs /src) and rust-src sysroot paths --
both fixed with --remap-path-prefix. Includes the toolchain-bump procedure
(update the /rustc/<hash> in the rust-src remap) and the CI==local verify steps.
Also refresh notes that went stale when the global RUSTFLAGS moved to per-target
config and stage1's toolchain was aligned to 1.91.1: the README image table and
toolchain/target policy, and this file's own comment (dropped the "lockboot
(1.91.0)" reference; stage0/stage1 are both 1.91.1 now).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@HarryR
HarryR
marked this pull request as ready for review
July 10, 2026 07:02
@HarryR
HarryR
merged commit 9add9eb
into
mainJul 10, 2026
@HarryR
HarryR
deleted the

reproducible-builds-doc

branch
July 10, 2026 07:03
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@HarryR

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes - #2
Merged
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Jul 10, 2026
Merged
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes#2
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Conversation
@HarryR
@HarryRHarryR
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
What
Adds a top-level REPRODUCIBLE-BUILDS.md describing how the stage0 -> UKI chain is kept byte-for-byte reproducible, and refreshes README/toolchain notes that went stale with the recent build changes.
REPRODUCIBLE-BUILDS.md covers
  • The guarantees: aligned pinned toolchain (both 1.91.1), SOURCE_DATE_EPOCH, --locked, per-target static rustflags.
  • The two path-embedding traps that broke CI==local and their --remap-path-prefix fixes: CARGO_HOME (/tmp/.cargo in CI vs /src/.cargo local) and rust-src (rust-analyzer installs it locally; CI's clean toolchain doesn't → different std panic-location paths).
  • The toolchain-bump procedure — update the /rustc/<hash> in the rust-src remap in both repos, or reproducibility silently regresses.
  • How to verify CI == local (gh run download the CI artifacts, sha256 linux.efi/stage2; Authenticode/path-canonical check for stage0's db-signed BOOTX64.EFI).
Also
Refreshes now-stale notes caused by the merged work: the README image table said "static-musl RUSTFLAGS" (moved to per-target config) and "stage1 1.91.0" (now 1.91.1), and described the shared .cargo/config.toml as carrying musl link flags (it now carries only [env]). Fixed those + this file's own comment.
Pairs with lockboot/stage0#9 and lockboot/stage1#18 (the reproducibility fixes themselves).
🤖 Generated with Claude Code
@HarryR@claude
docs: add REPRODUCIBLE-BUILDS.md; refresh stale README/toolchain notes
f826b4c
Document how the chain's builds are made byte-for-byte reproducible (and how CI
and local are kept identical): pinned+aligned toolchain, SOURCE_DATE_EPOCH,
locked deps, per-target static-linking rustflags, and the two path-embedding
traps that broke it -- CARGO_HOME (/tmp vs /src) and rust-src sysroot paths --
both fixed with --remap-path-prefix. Includes the toolchain-bump procedure
(update the /rustc/<hash> in the rust-src remap) and the CI==local verify steps.
Also refresh notes that went stale when the global RUSTFLAGS moved to per-target
config and stage1's toolchain was aligned to 1.91.1: the README image table and
toolchain/target policy, and this file's own comment (dropped the "lockboot
(1.91.0)" reference; stage0/stage1 are both 1.91.1 now).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@HarryR
HarryR
marked this pull request as ready for review
July 10, 2026 07:02
@HarryR
HarryR
merged commit 9add9eb
into
mainJul 10, 2026
@HarryR
HarryR
deleted the

reproducible-builds-doc

branch
July 10, 2026 07:03
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@HarryR

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes - #2
Merged
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Jul 10, 2026
Merged
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes#2
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Conversation
@HarryR
@HarryRHarryR
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
What
Adds a top-level REPRODUCIBLE-BUILDS.md describing how the stage0 -> UKI chain is kept byte-for-byte reproducible, and refreshes README/toolchain notes that went stale with the recent build changes.
REPRODUCIBLE-BUILDS.md covers
  • The guarantees: aligned pinned toolchain (both 1.91.1), SOURCE_DATE_EPOCH, --locked, per-target static rustflags.
  • The two path-embedding traps that broke CI==local and their --remap-path-prefix fixes: CARGO_HOME (/tmp/.cargo in CI vs /src/.cargo local) and rust-src (rust-analyzer installs it locally; CI's clean toolchain doesn't → different std panic-location paths).
  • The toolchain-bump procedure — update the /rustc/<hash> in the rust-src remap in both repos, or reproducibility silently regresses.
  • How to verify CI == local (gh run download the CI artifacts, sha256 linux.efi/stage2; Authenticode/path-canonical check for stage0's db-signed BOOTX64.EFI).
Also
Refreshes now-stale notes caused by the merged work: the README image table said "static-musl RUSTFLAGS" (moved to per-target config) and "stage1 1.91.0" (now 1.91.1), and described the shared .cargo/config.toml as carrying musl link flags (it now carries only [env]). Fixed those + this file's own comment.
Pairs with lockboot/stage0#9 and lockboot/stage1#18 (the reproducibility fixes themselves).
🤖 Generated with Claude Code
@HarryR@claude
docs: add REPRODUCIBLE-BUILDS.md; refresh stale README/toolchain notes
f826b4c
Document how the chain's builds are made byte-for-byte reproducible (and how CI
and local are kept identical): pinned+aligned toolchain, SOURCE_DATE_EPOCH,
locked deps, per-target static-linking rustflags, and the two path-embedding
traps that broke it -- CARGO_HOME (/tmp vs /src) and rust-src sysroot paths --
both fixed with --remap-path-prefix. Includes the toolchain-bump procedure
(update the /rustc/<hash> in the rust-src remap) and the CI==local verify steps.
Also refresh notes that went stale when the global RUSTFLAGS moved to per-target
config and stage1's toolchain was aligned to 1.91.1: the README image table and
toolchain/target policy, and this file's own comment (dropped the "lockboot
(1.91.0)" reference; stage0/stage1 are both 1.91.1 now).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@HarryR
HarryR
marked this pull request as ready for review
July 10, 2026 07:02
@HarryR
HarryR
merged commit 9add9eb
into
mainJul 10, 2026
@HarryR
HarryR
deleted the

reproducible-builds-doc

branch
July 10, 2026 07:03
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@HarryR

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes - #2
Merged
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Jul 10, 2026
Merged
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes#2
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Conversation
@HarryR
@HarryRHarryR
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
What
Adds a top-level REPRODUCIBLE-BUILDS.md describing how the stage0 -> UKI chain is kept byte-for-byte reproducible, and refreshes README/toolchain notes that went stale with the recent build changes.
REPRODUCIBLE-BUILDS.md covers
  • The guarantees: aligned pinned toolchain (both 1.91.1), SOURCE_DATE_EPOCH, --locked, per-target static rustflags.
  • The two path-embedding traps that broke CI==local and their --remap-path-prefix fixes: CARGO_HOME (/tmp/.cargo in CI vs /src/.cargo local) and rust-src (rust-analyzer installs it locally; CI's clean toolchain doesn't → different std panic-location paths).
  • The toolchain-bump procedure — update the /rustc/<hash> in the rust-src remap in both repos, or reproducibility silently regresses.
  • How to verify CI == local (gh run download the CI artifacts, sha256 linux.efi/stage2; Authenticode/path-canonical check for stage0's db-signed BOOTX64.EFI).
Also
Refreshes now-stale notes caused by the merged work: the README image table said "static-musl RUSTFLAGS" (moved to per-target config) and "stage1 1.91.0" (now 1.91.1), and described the shared .cargo/config.toml as carrying musl link flags (it now carries only [env]). Fixed those + this file's own comment.
Pairs with lockboot/stage0#9 and lockboot/stage1#18 (the reproducibility fixes themselves).
🤖 Generated with Claude Code
@HarryR@claude
docs: add REPRODUCIBLE-BUILDS.md; refresh stale README/toolchain notes
f826b4c
Document how the chain's builds are made byte-for-byte reproducible (and how CI
and local are kept identical): pinned+aligned toolchain, SOURCE_DATE_EPOCH,
locked deps, per-target static-linking rustflags, and the two path-embedding
traps that broke it -- CARGO_HOME (/tmp vs /src) and rust-src sysroot paths --
both fixed with --remap-path-prefix. Includes the toolchain-bump procedure
(update the /rustc/<hash> in the rust-src remap) and the CI==local verify steps.
Also refresh notes that went stale when the global RUSTFLAGS moved to per-target
config and stage1's toolchain was aligned to 1.91.1: the README image table and
toolchain/target policy, and this file's own comment (dropped the "lockboot
(1.91.0)" reference; stage0/stage1 are both 1.91.1 now).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@HarryR
HarryR
marked this pull request as ready for review
July 10, 2026 07:02
@HarryR
HarryR
merged commit 9add9eb
into
mainJul 10, 2026
@HarryR
HarryR
deleted the

reproducible-builds-doc

branch
July 10, 2026 07:03
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@HarryR

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes - #2
Merged
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Jul 10, 2026
Merged
docs: REPRODUCIBLE-BUILDS.md + refresh stale README/toolchain notes#2
HarryR merged 1 commit into
mainfrom 
reproducible-builds-doc
Conversation
@HarryR
@HarryRHarryR
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
What
Adds a top-level REPRODUCIBLE-BUILDS.md describing how the stage0 -> UKI chain is kept byte-for-byte reproducible, and refreshes README/toolchain notes that went stale with the recent build changes.
REPRODUCIBLE-BUILDS.md covers
  • The guarantees: aligned pinned toolchain (both 1.91.1), SOURCE_DATE_EPOCH, --locked, per-target static rustflags.
  • The two path-embedding traps that broke CI==local and their --remap-path-prefix fixes: CARGO_HOME (/tmp/.cargo in CI vs /src/.cargo local) and rust-src (rust-analyzer installs it locally; CI's clean toolchain doesn't → different std panic-location paths).
  • The toolchain-bump procedure — update the /rustc/<hash> in the rust-src remap in both repos, or reproducibility silently regresses.
  • How to verify CI == local (gh run download the CI artifacts, sha256 linux.efi/stage2; Authenticode/path-canonical check for stage0's db-signed BOOTX64.EFI).
Also
Refreshes now-stale notes caused by the merged work: the README image table said "static-musl RUSTFLAGS" (moved to per-target config) and "stage1 1.91.0" (now 1.91.1), and described the shared .cargo/config.toml as carrying musl link flags (it now carries only [env]). Fixed those + this file's own comment.
Pairs with lockboot/stage0#9 and lockboot/stage1#18 (the reproducibility fixes themselves).
🤖 Generated with Claude Code
@HarryR@claude
docs: add REPRODUCIBLE-BUILDS.md; refresh stale README/toolchain notes
f826b4c
Document how the chain's builds are made byte-for-byte reproducible (and how CI
and local are kept identical): pinned+aligned toolchain, SOURCE_DATE_EPOCH,
locked deps, per-target static-linking rustflags, and the two path-embedding
traps that broke it -- CARGO_HOME (/tmp vs /src) and rust-src sysroot paths --
both fixed with --remap-path-prefix. Includes the toolchain-bump procedure
(update the /rustc/<hash> in the rust-src remap) and the CI==local verify steps.
Also refresh notes that went stale when the global RUSTFLAGS moved to per-target
config and stage1's toolchain was aligned to 1.91.1: the README image table and
toolchain/target policy, and this file's own comment (dropped the "lockboot
(1.91.0)" reference; stage0/stage1 are both 1.91.1 now).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@HarryR
HarryR
marked this pull request as ready for review
July 10, 2026 07:02
@HarryR
HarryR
merged commit 9add9eb
into
mainJul 10, 2026
@HarryR
HarryR
deleted the

reproducible-builds-doc

branch
July 10, 2026 07:03
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@HarryR