[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GZ4H5FM5FR56SSZGP19HT6":3,"skill-same:01M6GZ4H5FM5FR56SSZGP19HT6":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":30,"linkOnly":31,"markdownContent":32,"markdownBody":33,"frontMatter":34,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":38,"repositoryHtmlUrl":39,"repositoryHomepageUrl":6,"ownerHtmlUrl":40,"ownerBlogUrl":41,"ownerDescription":42,"updatedAt":43,"install":44,"resources":57},"01M6GZ4H5FM5FR56SSZGP19HT6","make-a-build-reproducible",null,"Use when two builds of the same commit produce different bytes. Pins inputs and strips nondeterminism so the same source yields byte-identical artifacts.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-make-a-build-reproducible\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-make-a-build-reproducible\u002FSKILL.md",[],[20,21,22,23,24,25,26,27,28,29],"Reproducible","build","make","make a build reproducible","commit","artifacts","produce","use","source","when","2026-11-10 10:12:30",false,"---\nname: make-a-build-reproducible\ndescription: Use when two builds of the same commit produce different bytes. Pins inputs and strips nondeterminism so the same source yields byte-identical artifacts.\n---\n\n# Make a Build Reproducible\n\nIf two builds of the same commit differ, a checksum in a release note proves nothing and every cache hit is luck. Determinism must be shown, not assumed.\n\n## Procedure\n\n1. Measure the drift before fixing it. Build twice and diff the trees:\n   `diffoscope build-a.tar.gz build-b.tar.gz | head -60`\n   Build once locally and once in a clean container to expose environment leakage.\n2. Pin every input. Use `FROM debian@sha256:\u003Cdigest>`, not `debian:stable`. A floating `node:20` tag is not a pin.\n3. Set `SOURCE_DATE_EPOCH` to the commit time so embedded dates are stable:\n   `export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)`\n4. Normalise the shell: `export LC_ALL=C TZ=UTC PYTHONHASHSEED=0`. Sort any generated file under `LC_ALL=C sort -u`.\n5. Strip build paths. Go: `go build -trimpath -ldflags=\"-buildid=\" -o out`. C: add `-ffile-prefix-map=$PWD=.`. Rust: set `remap-path-prefix` inside `RUSTFLAGS`.\n6. Make archives deterministic — tar records mtime, owners and readdir order:\n   `tar --sort=name --mtime=@$SOURCE_DATE_EPOCH --owner=0 --group=0 --numeric-owner -czf out.tgz dir\u002F`\n   For zip: `zip -X -r out.zip dir\u002F` and reset each entry's mtime to the epoch.\n7. Remove counters and host data. `git describe --dirty` embeds working-tree state; use `git rev-parse HEAD`. Drop build counters and hostnames.\n8. Rebuild on a second machine and compare digests: `sha256sum a\u002Fout.tgz b\u002Fout.tgz`.\n\n## Pitfalls\n\n- Signing, SBOM and packaging steps re-add a timestamp. Hash and sign the built artifact in a separate pass, then never rebuild it.\n- `apt-get install` in the Dockerfile pulls unpinned versions; pin via a committed lock or a hermetic mirror.\n- Python `.pyc` files embed absolute source paths. Build with `PYTHONDONTWRITEBYTECODE=1`.\n- Parallel linkers can reorder object files. Emit linker inputs as a sorted list.\n- A cache that keys on branch name, not content, hides drift until release day.\n\n## Verification\n\n    .\u002Fbuild.sh && cp -r dist dist1 && rm -rf dist && .\u002Fbuild.sh && \\\n      diff -r dist dist1 && echo REPRODUCIBLE\n\n`diff -r` prints nothing and exits 0 on a match. For a single binary, compare `sha256sum dist\u002Fapp dist1\u002Fapp` and assert equal.\n\nReport: \"Two builds of \u003Ccommit> match byte-for-byte; after setting SOURCE_DATE_EPOCH and deterministic tar flags, diffoscope reports no differences.\"\n","# Make a Build Reproducible\n\nIf two builds of the same commit differ, a checksum in a release note proves nothing and every cache hit is luck. Determinism must be shown, not assumed.\n\n## Procedure\n\n1. Measure the drift before fixing it. Build twice and diff the trees:\n   `diffoscope build-a.tar.gz build-b.tar.gz | head -60`\n   Build once locally and once in a clean container to expose environment leakage.\n2. Pin every input. Use `FROM debian@sha256:\u003Cdigest>`, not `debian:stable`. A floating `node:20` tag is not a pin.\n3. Set `SOURCE_DATE_EPOCH` to the commit time so embedded dates are stable:\n   `export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)`\n4. Normalise the shell: `export LC_ALL=C TZ=UTC PYTHONHASHSEED=0`. Sort any generated file under `LC_ALL=C sort -u`.\n5. Strip build paths. Go: `go build -trimpath -ldflags=\"-buildid=\" -o out`. C: add `-ffile-prefix-map=$PWD=.`. Rust: set `remap-path-prefix` inside `RUSTFLAGS`.\n6. Make archives deterministic — tar records mtime, owners and readdir order:\n   `tar --sort=name --mtime=@$SOURCE_DATE_EPOCH --owner=0 --group=0 --numeric-owner -czf out.tgz dir\u002F`\n   For zip: `zip -X -r out.zip dir\u002F` and reset each entry's mtime to the epoch.\n7. Remove counters and host data. `git describe --dirty` embeds working-tree state; use `git rev-parse HEAD`. Drop build counters and hostnames.\n8. Rebuild on a second machine and compare digests: `sha256sum a\u002Fout.tgz b\u002Fout.tgz`.\n\n## Pitfalls\n\n- Signing, SBOM and packaging steps re-add a timestamp. Hash and sign the built artifact in a separate pass, then never rebuild it.\n- `apt-get install` in the Dockerfile pulls unpinned versions; pin via a committed lock or a hermetic mirror.\n- Python `.pyc` files embed absolute source paths. Build with `PYTHONDONTWRITEBYTECODE=1`.\n- Parallel linkers can reorder object files. Emit linker inputs as a sorted list.\n- A cache that keys on branch name, not content, hides drift until release day.\n\n## Verification\n\n    .\u002Fbuild.sh && cp -r dist dist1 && rm -rf dist && .\u002Fbuild.sh && \\\n      diff -r dist dist1 && echo REPRODUCIBLE\n\n`diff -r` prints nothing and exits 0 on a match. For a single binary, compare `sha256sum dist\u002Fapp dist1\u002Fapp` and assert equal.\n\nReport: \"Two builds of \u003Ccommit> match byte-for-byte; after setting SOURCE_DATE_EPOCH and deterministic tar flags, diffoscope reports no differences.\"\n",{"name":5,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fpayments\u002F0xklen-make-a-build-reproducible",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-14 02:27:51",{"source":8,"skillName":5,"commands":45,"prompt":55,"zipAvailable":56},[46,49,52],{"tool":47,"command":48},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill make-a-build-reproducible",{"tool":50,"command":51},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill make-a-build-reproducible",{"tool":53,"command":54},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill make-a-build-reproducible","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-make-a-build-reproducible\u002FSKILL.md",true,[58,62,68],{"path":59,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":61,"sourceHtmlUrl":16},"LICENSE","许可证",1063,{"path":63,"resourceType":64,"resourceTypeDesc":65,"sizeBytes":66,"sourceHtmlUrl":67},"SOURCE.md","REFERENCE","参考文档",351,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-make-a-build-reproducible\u002FSOURCE.md",{"path":69,"resourceType":64,"resourceTypeDesc":65,"sizeBytes":70,"sourceHtmlUrl":71},"TRUST.auto.yaml",2144,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-make-a-build-reproducible\u002FTRUST.auto.yaml",[73,101,124,142,155,165],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":77,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":30},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":105,"licenseFileUrl":106,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":30},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[110,111,112,113,114,115,116,117,118,119,120,121,122,123],"mexc spot websocket","spot","websocket","api","workflows","public","listen","streams","depth","keys","for","api keys","maintenance","protobuf",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":105,"licenseFileUrl":128,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":30},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[132,111,133,134,135,136,137,121,120,119,138,139,140,115,141,114,113],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","data","orders",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":105,"licenseFileUrl":146,"sourceHtmlUrl":147,"categories":148,"keywords":149,"publishedAt":30},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[150,151,112,152,153,122,120,154,118,117,115,114],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":156,"name":157,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":158,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":30},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[162,163,164],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":169,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":30},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[173,174,175,176,177,178,179,27,180,181,182],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","patch","code","share"]