Some builds of contracts that reference older Rust framework are not reproducible

[andreibancioiu]

Contracts that reference older versions of the Rust framework require - at build time, when the meta crate is invoked - some dependencies which were not strictly referenced by the meta crate itself (back then). Newer versions of these dependencies have been released in the meantime. And these newer dependencies - which (unfortunately) satisfy the (loose) versioning constraints of the (old) meta crate are not compatible with the Rust versions that were hard-coded in the Docker images of v4.1.*. Thus, trying to reproduce such builds lead to errors such as:

error: package `clap_derive v4.4.7` cannot be built because it requires rustc 1.70.0 or newer, while the currently active rustc version is 1.66.0-nightly
Either upgrade to rustc 1.70.0 or newer, or use
cargo update -p [email protected] --precise ver
where `ver` is the latest version of `clap_derive` supporting rustc 1.66.0-nightly

[andreibancioiu]

• Fix v4, part 1: bring "main" into release/v4 #41
• Fix v4, part 2: undo breaking changes of (v4) -> (v5), handle workspaces #42
• On reproducible builds, add support for packaging all source code of a Cargo workspace mx-sdk-py-cli#382
• Add support for "package_whole_project_src" mx-sc-actions#24

[andreibancioiu]

In order to reproduce a previous build of a contract that references a version of the Rust framework that has loose dependency constraints, the following steps should be followed:

Step 1 - fix Cargo.lock of the Cargo workspace

Commands to adjust the Cargo.lock of a Cargo workspace that contains the contract in question (whose build needs to be reproduced), so that it's compatible with the Rust versions hard-coded within the Docker image that was originally used to create the build.

cargo update -p colored --precise 2.0.4
cargo update -p anstyle --precise 1.0.1
cargo update -p anstyle-parse --precise 0.2.1
cargo update -p anstyle-query --precise 1.0.0
cargo update -p clap --precise 4.3.11
cargo update -p clap_derive --precise 4.3.2
cargo update -p clap_lex --precise 0.5.0
cargo update -p clap_builder --precise 4.3.11
cargo update -p ignore --precise 0.4.20
cargo update -p ruplacer --precise 0.8.1

These commands adjusts the versions of some meta crate dependencies. Generally speaking, this does not impact the actual WASM artifacts.

Make sure to have all Cargo.lock files committed in your source code repository. No exception! (while some exceptions might be seen as technically reasonable at first sight, they might lead to issues on the long run - e.g. unfortunate exceptions play a role in issues such as this one).

Step 2 - reproduce the build using the latest image of a given major version

The previous build should be reproducible using the latest v4 image, which is able to correctly include all files of a Cargo workspace in the packaged source file (on demand). Thus, compatible versions of meta crate dependencies are fetched, and the build should work.

For example:

mxpy contract reproducible-build --docker-image multiversx/sdk-rust-contract-builder:v4.2.1 --package-whole-project-src --contract pair

[andreibancioiu]

Examples of problematic builds that were fixed as described above:

• [Reproduce previous build] v2.4.1-pair-safe-price-v2 mx-exchange-sc#795
• [Reproduce previous build] v2.5.2-governance-merkle-tree mx-exchange-sc#796
• [Reproduce previous build] v1.10.4-backwards-comp-proxy-dex mx-exchange-sc#797
• [Reproduce previous build] v2.1.1-staking-upgrade mx-exchange-sc#798
• [Reproduce previous build] v2.0-rc6-reproducible mx-exchange-sc#799