Add reprotest to travis

.dockerignore

@@ -1,4 +1,5 @@
 target
+fuzz
 Dockerfile
 .dockerignore
 .git

.travis.yml

@@ -14,6 +14,9 @@ matrix:
   - os: linux
     rust: stable
     env: TARGET=x86_64-unknown-linux-gnu BUILD_MODE=boxxy
+  - os: linux
+    rust: stable
+    env: TARGET=x86_64-unknown-linux-gnu BUILD_MODE=reprotest
   - os: linux
     rust: stable
     env: TARGET=i686-unknown-linux-gnu

README.md

@@ -70,14 +70,28 @@ so a configuration file is read from `/etc/sniffglue.conf`. This config
 file specifies an empty directory for `chroot` and an unprivileged account
 in `user` that is used to drop root privileges.
 
-## boxxy-rs
+### boxxy-rs
 
 This project includes a small [boxxy-rs] based shell that can be used to
 explore the sandbox at various stages during and after initialization.
 
     cargo run --example boxxy
 
-## Fuzzing
+[boxxy-rs]: https://github.com/kpcyrd/boxxy-rs
+
+### Reproducible builds
+
+This project is tested using reprotest. Currently the following variations are
+excluded:
+
+- `-time` - needed because the crates.io cert expires in the future
+
+You need rustup to be installed and the nightly toolchain needs to be
+available. Don't forget to install the build dependencies.
+
+    ci/reprotest.sh
+
+### Fuzzing
 
 The packet processing of sniffglue can be fuzzed using [cargo-fuzz].
 Everything you should need is provided in the `fuzz/` directory that is

ci/Dockerfile.reprotest

@@ -0,0 +1,10 @@
+FROM debian:testing
+RUN apt-get update -qq \
+    && DEBIAN_FRONTEND=noninteractive apt-get upgrade -yq \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -yq reprotest \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -yq git curl libpcap-dev libseccomp-dev
+ENV PYTHONIOENCODING=utf-8
+RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain nightly \
+    && cp ~/.cargo/bin/rustup ~/.cargo/bin/rustc /usr/bin/
+WORKDIR /sniffglue/
+COPY . .

ci/build.sh

@@ -14,6 +14,9 @@ case "$BUILD_MODE" in
     boxxy)
         cargo build --verbose --examples
         ;;
+    reprotest)
+        docker build -t reprotest-sniffglue -f ci/Dockerfile.reprotest .
+        ;;
     *)
         cargo build --verbose --target="$TARGET"
         ;;

ci/reprotest.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -xue
+. /etc/os-release
+
+export TMPDIR="$HOME/tmp/repro-test"
+mkdir -p "$TMPDIR"
+
+reprotest -vv --host-distro="$ID" --vary=-time --source-pattern 'Cargo.* src/' '
+    RUSTC_BOOTSTRAP=1 CARGO_HOME="$PWD/.cargo" RUSTUP_HOME='"$HOME/.rustup"' \
+        RUSTFLAGS="-Zremap-path-prefix-from=$HOME -Zremap-path-prefix-to=/remap-home -Zremap-path-prefix-from=$PWD -Zremap-path-prefix-to=/remap-pwd" \
+        rustup run nightly cargo build --release --verbose' \
+    target/release/sniffglue

ci/test.sh

@@ -24,6 +24,9 @@ case "$BUILD_MODE" in
             exit 1
         fi
         ;;
+    reprotest)
+        docker run --privileged reprotest-sniffglue ci/reprotest.sh
+        ;;
     *)
         cargo test --verbose --target="$TARGET"
         ;;