Add more build flags to make build deterministic

.gitlab-ci.yml

@@ -24,7 +24,11 @@ build:
 test_build:
   stage: test
   script:
-    - docker run ${TEST_IMAGE} /bin/bash -c "./build-obfs4proxy.py"
+    - docker run -v `pwd`:/opt/go-reproducer ${TEST_IMAGE} /bin/bash -c "./build-obfs4proxy.py"
+  artifacts:
+    paths:
+    - obfs4proxy-*.zip
+    expire_in: 1 week
   except:
     - tags
 

build-obfs4proxy.py

@@ -121,11 +121,14 @@ def build_android_arch(env, tool, ndk_arch, pie):
 
     env['CC'] = "%s/bin/%s-clang" % (os.path.abspath(toolchain), tool)
     env['CGO_ENABLED'] = "1"
+    env['CGO_CFLAGS'] = "-O2"  # removes -g
     env['GOOS'] = "android"
 
     build_mode = "pie" if pie else "exe"
+    extldflags = " -extldflags=-pie" if pie else ""
 
-    ex(['go', 'build', '-buildmode=%s' % build_mode, '-o', 'obfs4proxy'] + glob(SOURCE), env=env)
+    ex(['go', 'build', '-x', '-asmflags', '-trimpath', '-buildmode=%s' % build_mode, '-ldflags',
+        '-w -s' + extldflags, '-o', 'obfs4proxy'] + get_sources(), env=env)
 
     ex(['%s/bin/%s-strip' % (toolchain, tool), '-D', 'obfs4proxy'])
 
@@ -135,12 +138,16 @@ def build_android_arch(env, tool, ndk_arch, pie):
 
 
 def build_linux():
-    ex(['go', 'build', '-o', 'obfs4proxy'] + glob(SOURCE))
+    ex(['go', 'build', '-x', '-asmflags', '-trimpath', '-o', 'obfs4proxy'] + get_sources())
     ex(['strip', '-D', 'obfs4proxy'])
     zip_files(['obfs4proxy'], 'obfs4proxy_linux-x86_64.zip')
     os.remove('obfs4proxy')
 
 
+def get_sources():
+    return sorted(glob(SOURCE))
+
+
 def package_android(versions):
     file_list = ['obfs4proxy_arm.zip', 'obfs4proxy_arm_pie.zip',
                  'obfs4proxy_x86.zip', 'obfs4proxy_x86_pie.zip']
@@ -159,7 +166,7 @@ def package(versions, file_list, android):
     pom_file = create_pom_file(versions, android)
 
     # print hashes for debug purposes
-    for file in file_list + [jar_file, pom_file, zip_file]:
+    for file in file_list + [zip_file]:
         sha256hash = get_sha256(file)
         print("%s: %s" % (file, sha256hash))