# Provenance of v1.1.4

Built from the repository `https://github.com/AevaChain/aeva.git`, commit `b1810d7c2fcb` (`git archive`, a clean tree), inside
the pinned image

    golang:1.26.10@sha256:3745f1aa11822297b79113f5e84ce2bffeb039734571c39855809cfe9e5d7be6

(the `golang:1.26.10` image index; this build ran its `linux/arm64` manifest `sha256:76182005c4267c55933318fd01e8766d6615011564fc3bdd7b4dec28d8dec249`), with
`tools/release.sh`'s flags: `GOTOOLCHAIN=local` (the image's Go), `CGO_ENABLED=0`,
`GOFLAGS=-mod=readonly`, `go build -trimpath -buildvcs=false`, `-ldflags "-s -w"` with the version
`v1.1.4` and the commit, tags `netgo,ledger`; linux/amd64 and linux/arm64. The Go module cache
is the image's `GOMODCACHE=/go/pkg/mod` (its path lands in `aevad`: `-trimpath` does not rewrite
assembly files that gnark-crypto includes from another directory, and the image fixes the path to
`/go/pkg/mod` on every machine), filled read-only from the host's module download cache through a
`file://` proxy (then `proxy.golang.org`) and checked against `go.sum` / `go.work.sum`. Two builds,
each in a fresh container with empty module and build caches, gave the same bytes, and no binary
holds a home-directory path.

```sh
git clone https://github.com/AevaChain/aeva.git aeva && cd aeva
tools/mainnet-launch/upgrade/build-release.sh v1.1.4 b1810d7c2fcb   # needs Docker; dist/release/
cd dist/release/<the folder it names> && shasum -a 256 -c SHA256SUMS
```

## Build environment

As the container reported it (`go version`, `go env`, `/etc/os-release`, `uname`):

```text
go version go1.26.10 linux/arm64
GOVERSION=go1.26.10
GOROOT=/usr/local/go
GOTOOLCHAIN=local
GOHOSTOS=linux
GOHOSTARCH=arm64
CGO_ENABLED=0
GOFLAGS=-mod=readonly
GOMODCACHE=/go/pkg/mod
GOCACHE=/tmp/go-build
GOPROXY=file:///goproxy,https://proxy.golang.org
GOSUMDB=sum.golang.org
GOWORK=/src/go.work
linux/amd64 GOAMD64=v1
linux/arm64 GOARM64=v8.0
os=Debian GNU/Linux 13 (trixie)
kernel=Linux 6.12.68-linuxkit aarch64
```

## Binaries

```text
bacbcdb709fd49664406dc9b8daea77624a1a5cd5e2671b1187adcb9757d525a  aevad-v1.1.4-linux-amd64
507b2d0cfa15246349286dd6ee378a3490d98ae5d539d70109ec79b44ebc9fe3  aevad-v1.1.4-linux-arm64
deff999df73a71d450449e71485e8b043d304f166e7d67a3aef7418b1d237f30  aeva-indexer-v1.1.4-linux-amd64
ebc4faf0e3dbe900d52f0520897f24bbcf649a90710038d5b202f7204173008c  aeva-indexer-v1.1.4-linux-arm64
5218e679113a18226b6586f29ced4109cc347ee8956d8ebb53b8f7582eb55f2e  aeva-faucet-v1.1.4-linux-amd64
5b7aa7d60a80fd96363bb94b392a1b2ed25d58139268591b0aa40e9ca0277323  aeva-faucet-v1.1.4-linux-arm64
```

`SHA256SUMS.minisig` is the signature of `SHA256SUMS` with the Aeva release
key (`aeva-release-key.pub`, `1B6F54CB7B98D7EC`).

## Reproduced in a differently configured container

A build of the same commit, on the release machine, in a fresh `golang:1.26.10` container made to look like a different
machine (a different user, home and source path; empty caches; the same image,
`GOMODCACHE=/go/pkg/mod` and Go toolchain) produced byte-identical binaries. The container
reported:

```text
image=golang@sha256:3745f1aa11822297b79113f5e84ce2bffeb039734571c39855809cfe9e5d7be6
go version go1.26.10 linux/arm64
os=Debian GNU/Linux 13 (trixie)
kernel=Linux 6.12.68-linuxkit aarch64
user=4242
4242 home=/tmp/aeva-second-machine src=/second-machine/src
```

## Reproduced on a second machine

On 2026-10-21, on aeva-services-1 (linux/amd64; not the release machine, which is linux/arm64), from
the `git archive` of commit `b1810d7c2fcb`, in the same pinned image with `tools/release.sh`'s flags,
modules from `proxy.golang.org`:

```text
host=aeva-services-1 x86_64 Ubuntu 24.04.5 LTS docker 29.1.3
go version go1.26.10 linux/amd64
bacbcdb709fd49664406dc9b8daea77624a1a5cd5e2671b1187adcb9757d525a  aevad-v1.1.4-linux-amd64
507b2d0cfa15246349286dd6ee378a3490d98ae5d539d70109ec79b44ebc9fe3  aevad-v1.1.4-linux-arm64
```