# Provenance of v1.1.2

Built from the repository `github.com/aeva-chain/aeva`, commit `abb7d754c123` (`git archive`, a clean tree), inside
the pinned image

    golang:1.26.5@sha256:705e964a93a2fd2e75c7d59bb7d781b57e30f12293ffde5175c69229e18fb678

(the `golang:1.26.5` image index; this build ran its `linux/arm64` manifest `sha256:04b188c2db8449ea15c09355dfab9ce9ed4ecf9414e94674104e316bda7d1996`), with
`tools/release.sh`'s flags: `GOTOOLCHAIN=local` (the image's Go), `CGO_ENABLED=0`,
`GOFLAGS=-mod=readonly`, `go build -trimpath -buildvcs=false`, `-ldflags "-s -w"` with the version
`v1.1.2` and the commit, tags `netgo,ledger`; linux/amd64 and linux/arm64. The Go module cache
is the image's `GOMODCACHE=/go/pkg/mod` (its path lands in `aevad`: `-trimpath` does not rewrite
assembly files that gnark-crypto includes from another directory, and the image fixes the path to
`/go/pkg/mod` on every machine), filled read-only from the host's module download cache through a
`file://` proxy (then `proxy.golang.org`) and checked against `go.sum` / `go.work.sum`. Two builds,
each in a fresh container with empty module and build caches, gave the same bytes, and no binary
holds a home-directory path.

```sh
git clone github.com/aeva-chain/aeva aeva && cd aeva
tools/mainnet-launch/upgrade/build-release.sh v1.1.2 abb7d754c123   # needs Docker; dist/release/
cd dist/release/<the folder it names> && shasum -a 256 -c SHA256SUMS
```

## Build environment

As the container reported it (`go version`, `go env`, `/etc/os-release`, `uname`):

```text
go version go1.26.5 linux/arm64
GOVERSION=go1.26.5
GOROOT=/usr/local/go
GOTOOLCHAIN=local
GOHOSTOS=linux
GOHOSTARCH=arm64
CGO_ENABLED=0
GOFLAGS=-mod=readonly
GOMODCACHE=/go/pkg/mod
GOCACHE=/tmp/go-build
GOPROXY=file:///goproxy,https://proxy.golang.org
GOSUMDB=sum.golang.org
GOWORK=/src/go.work
linux/amd64 GOAMD64=v1
linux/arm64 GOARM64=v8.0
os=Debian GNU/Linux 13 (trixie)
kernel=Linux 6.12.68-linuxkit aarch64
```

## Binaries

```text
69f29318c0380c9b4c577687550aa4ea4580bdb62c7b76afe5f33cbf2879f0df  aevad-v1.1.2-linux-amd64
15d110490019558dfb323b60508628f15a9353afdd7c3c0f8939d32531a7fd03  aevad-v1.1.2-linux-arm64
863a151abcf84eb28c60d7f5e949c1ce4790d707b011265d1de94e16edf1e4ed  aeva-indexer-v1.1.2-linux-amd64
8b2955d3d3840adacb8a7586f96b5df3e1482c84eec4e309095f1db9064f8cce  aeva-indexer-v1.1.2-linux-arm64
274fd561c2c7d33eae50014c553514323b40c989dc9a613962c5c14c432a81f0  aeva-faucet-v1.1.2-linux-amd64
e2451ae24fced7c999cfd82e5963bb7ca752ced40f70443a4cddc6ef44ce1545  aeva-faucet-v1.1.2-linux-arm64
```

`SHA256SUMS.minisig` is the signature of `SHA256SUMS` with the Aeva release
key (`aeva-release-key.pub`, `1B6F54CB7B98D7EC`).

## Reproduced on a second machine

A build of the same commit in a fresh `golang:1.26.5` container made to look like a different
machine (a different user, home and source path; empty caches; the same image,
`GOMODCACHE=/go/pkg/mod` and Go toolchain) produced byte-identical binaries. The container
reported:

```text
image=golang@sha256:705e964a93a2fd2e75c7d59bb7d781b57e30f12293ffde5175c69229e18fb678
go version go1.26.5 linux/arm64
os=Debian GNU/Linux 13 (trixie)
kernel=Linux 6.12.68-linuxkit aarch64
user=4242
4242 home=/tmp/aeva-second-machine src=/second-machine/src
```