Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[feature] modify webpack config to achieve deterministic builds #64

Open
CoeJoder opened this issue Aug 2, 2024 · 0 comments
Open

[feature] modify webpack config to achieve deterministic builds #64

CoeJoder opened this issue Aug 2, 2024 · 0 comments

Comments

@CoeJoder
Copy link

CoeJoder commented Aug 2, 2024

I would like to build the project from source and also audit it for security reasons, but am not able to achieve a .jpl with the same checksum as that of the published version, v0.15.0. It appears to be due to webpack, which I'm not too familiar with, but some are saying it does not produce deterministic output unless specifically configured to do so. Related links:

Is it possible to have deterministic build output?
The optimization config referenced in the above discussion:
https://webpack.js.org/configuration/optimization/#optimizationmoduleids

Here are my current build steps:

$ git clone --branch v0.15.0 [email protected]:CalebJohn/joplin-rich-markdown.git
$ cd joplin-rich-markdown
$ export NODE_OPTIONS=--openssl-legacy-provider  # required to bypass SSL error
$ npm ci  # sources package-lock.json
$ sha256sum ./publish/plugin.calebjohn.rich-markdown.jpl
c1f0d0733a5075f92cb4609d635d6962a849be9e5cc18c219ecc195f1f0171a7  ./publish/plugin.calebjohn.rich-markdown.jpl

# expected from npmjs `v0.15.0` manifest:
# b274952c6f8a4dbc5710847de86134925b98c5274ae1e3222657ae3ccdf9ad61

System details:

$ node --version
v20.16.0
$ npm 
10.8.2
@CoeJoder CoeJoder changed the title [documentation] add deterministic build instructions [feature] modify webpack config to achieve deterministic builds Aug 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant