Build audit

5-target build matrix

The matrix is split into two workflows (per the ljh-sh dist regime):

• build-and-test.yml — fires on push to main + every PR. Runs the matrix + smoke + uploads per-target artifacts.
• release.yml — fires on v* tags + workflow_dispatch. Runs the same matrix, downloads all artifacts, and creates a GitHub Release with the SHA256SUMS file.

What scripts/build.sh does

1. autoreconf -if --force on upstream/wdiff/ and upstream/diffutils/. The --force flag is needed because the upstream 1.2.2 tarball ships pre-generated po/ files that autopoint would otherwise refuse to overwrite.
2. Sub-build 1: diffutils — out-of-tree configure with --disable-shared --enable-static, then make. Produces build/diffutils/src/diff.
3. Sub-build 2: wdiff — out-of-tree configure with DIFF_PROGRAM=$abs_path_to_diff baked in (via the diff_cv_prog_diff_program cache variable), then make. Produces build/wdiff/src/wdiff.

Both sub-builds are out-of-tree: nothing under upstream/ is mutated. This lets musl-Alpine and host-glibc builds share the same source tree without fighting over Makefile state.

Reproducibility

The build is not bit-for-bit reproducible across machines (yet) because:

• The upstream wdiff / diffutils autotools configure scripts embed the build host and timestamp into the generated config.h.
• The default ar / ranlib ordering depends on the toolchain vendor (alpine gcc 14 vs. macOS Apple clang).

A user who runs bash scripts/build.sh on the same OS with the same toolchain version will get a functionally-identical binary but with different bytes. Bit-for-bit reproducibility is a future v0.2.0 goal, tracked under the OpenSSF Scorecard "reproducible-builds" check.

Verifying a release

Each GitHub Release ships:

• 5 per-target archives (wdiff-<target>.tar.gz or .zip)
• 5 per-archive .sha256 files
• 1 top-level SHA256SUMS file (basename-keyed, no dist/ prefix)

To verify the Linux x86_64 musl binary:

curl -L -O https://github.com/ljh-sh/wdiff/releases/latest/download/wdiff-x86_64-linux-musl.tar.gz
curl -L -O https://github.com/ljh-sh/wdiff/releases/latest/download/wdiff-x86_64-linux-musl.tar.gz.sha256
sha256sum -c wdiff-x86_64-linux-musl.tar.gz.sha256

To verify all 5 archives against the top-level SHA256SUMS:

curl -L -O https://github.com/ljh-sh/wdiff/releases/latest/download/SHA256SUMS
for f in wdiff-*.tar.gz wdiff-*.zip; do sha256sum -c <(grep "  $f$" SHA256SUMS); done