# Provenance of v1.1.3

Built from the repository `https://github.com/AevaChain/aeva.git`, commit `2b4c21286082` (`git archive`, a clean tree), inside
the pinned image

    golang:1.26.5@sha256:705e964a93a2fd2e75c7d59bb7d781b57e30f12293ffde5175c69229e18fb678

(the `golang:1.26.5` image index; this build ran its `linux/arm64` manifest `sha256:04b188c2db8449ea15c09355dfab9ce9ed4ecf9414e94674104e316bda7d1996`), with
`tools/release.sh`'s flags: `GOTOOLCHAIN=local` (the image's Go), `CGO_ENABLED=0`,
`GOFLAGS=-mod=readonly`, `go build -trimpath -buildvcs=false`, `-ldflags "-s -w"` with the version
`v1.1.3` and the commit, tags `netgo,ledger`; linux/amd64 and linux/arm64. The Go module cache
is the image's `GOMODCACHE=/go/pkg/mod` (its path lands in `aevad`: `-trimpath` does not rewrite
assembly files that gnark-crypto includes from another directory, and the image fixes the path to
`/go/pkg/mod` on every machine), filled read-only from the host's module download cache through a
`file://` proxy (then `proxy.golang.org`) and checked against `go.sum` / `go.work.sum`. Two builds,
each in a fresh container with empty module and build caches, gave the same bytes, and no binary
holds a home-directory path.

```sh
git clone https://github.com/AevaChain/aeva.git aeva && cd aeva
tools/mainnet-launch/upgrade/build-release.sh v1.1.3 2b4c21286082   # needs Docker; dist/release/
cd dist/release/<the folder it names> && shasum -a 256 -c SHA256SUMS
```

## Build environment

As the container reported it (`go version`, `go env`, `/etc/os-release`, `uname`):

```text
go version go1.26.5 linux/arm64
GOVERSION=go1.26.5
GOROOT=/usr/local/go
GOTOOLCHAIN=local
GOHOSTOS=linux
GOHOSTARCH=arm64
CGO_ENABLED=0
GOFLAGS=-mod=readonly
GOMODCACHE=/go/pkg/mod
GOCACHE=/tmp/go-build
GOPROXY=file:///goproxy,https://proxy.golang.org
GOSUMDB=sum.golang.org
GOWORK=/src/go.work
linux/amd64 GOAMD64=v1
linux/arm64 GOARM64=v8.0
os=Debian GNU/Linux 13 (trixie)
kernel=Linux 6.12.68-linuxkit aarch64
```

## Binaries

```text
155d75fe31e9353491d2c838f5af5207654b2ee1890a57002f53d2b905a6cca7  aevad-v1.1.3-linux-amd64
a28c2b1e35ca3339429ca1f423ef4033545ecec346719d37fdc235f00d6dd615  aevad-v1.1.3-linux-arm64
ad19a4005f68b7d2b9e56d439132c374faa213048f4996eb1b8024f45c3bf4bb  aeva-indexer-v1.1.3-linux-amd64
c90edef52b70cd5ad02315a1413787135f48fef35e49165a691e4e0b14410351  aeva-indexer-v1.1.3-linux-arm64
67a003ee46e422206a2f755fa56a7dd9d28c73364df7a9b9fc9a8814468f3b69  aeva-faucet-v1.1.3-linux-amd64
8026df50b2403c79cdd7fd70368fc4704475279a62732095490608d6ad5a6480  aeva-faucet-v1.1.3-linux-arm64
```

`SHA256SUMS.minisig` is the signature of `SHA256SUMS` with the Aeva release
key (`aeva-release-key.pub`, `1B6F54CB7B98D7EC`).

## Reproduced in a differently configured container

A build of the same commit, on the release machine, in a fresh `golang:1.26.5` container made to look like a different
machine (a different user, home and source path; empty caches; the same image,
`GOMODCACHE=/go/pkg/mod` and Go toolchain) produced byte-identical binaries. The container
reported:

```text
image=golang@sha256:705e964a93a2fd2e75c7d59bb7d781b57e30f12293ffde5175c69229e18fb678
go version go1.26.5 linux/arm64
os=Debian GNU/Linux 13 (trixie)
kernel=Linux 6.12.68-linuxkit aarch64
user=4242
4242 home=/tmp/aeva-second-machine src=/second-machine/src
```

## Reproduced on a second machine

On 2026-10-21, on aeva-services-1 (linux/amd64; not the release machine, which is linux/arm64), from
the `git archive` of commit `2b4c21286082` (`aeva-v1.1.3-2b4c21286082.tar.gz`, sha256
`1198d0f689682662b92cbdd83a83619107760b6b8bc418bdd99165ccd8f07310`), in the same pinned image with
`tools/release.sh`'s flags, modules from `proxy.golang.org`:

```text
host=aeva-services-1 x86_64 Ubuntu 24.04.5 LTS docker 29.1.3
go version go1.26.5 linux/amd64
155d75fe31e9353491d2c838f5af5207654b2ee1890a57002f53d2b905a6cca7  aevad-v1.1.3-linux-amd64
a28c2b1e35ca3339429ca1f423ef4033545ecec346719d37fdc235f00d6dd615  aevad-v1.1.3-linux-arm64
```