Make firmware builds reproducible

.github/workflows/ci.yml

@@ -81,7 +81,8 @@ jobs:
           ./target
           ./firmware/target
         key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-    - run: nix develop .#embedded --command bash -c "cd firmware && cargo build --no-default-features --features ${{ matrix.target }} --release"
+    - run: nix develop .#embedded-reproducible --command bash -c "cd firmware && cargo build --no-default-features --features ${{ matrix.target }} --release"
+    - run: sha256sum ./firmware/target/thumbv7em-none-eabihf/release/firmware
     - uses: actions/upload-artifact@v2
       with:
         name: firmware-${{ matrix.target }}

flake.nix

@@ -89,6 +89,18 @@
 
           CC_thumbv7em_none_eabihf = "${pkgs.gcc-arm-embedded}/bin/arm-none-eabi-gcc";
         };
+        devShells.embedded-reproducible = pkgs.mkShell {
+          buildInputs = defaultDeps ++ embeddedDeps;
+
+          CC_thumbv7em_none_eabihf = "${pkgs.clang}/bin/clang";
+
+          shellHook = ''
+            export MAIN_DIR=$PWD
+
+            export CFLAGS_thumbv7em_none_eabihf="-fno-PIC -fno-stack-protector -I${pkgs.clang}/resource-root/include -target thumbv7em-none-eabihf -ffile-prefix-map=$HOME/.cargo="
+            export RUSTFLAGS="-Clink-arg=-Tlink.x --remap-path-prefix $HOME/.cargo= --remap-path-prefix $MAIN_DIR/firmware=firmware --remap-path-prefix $MAIN_DIR/model=model --remap-path-prefix $MAIN_DIR/gui=gui";
+          '';
+        };
         devShells.android = pkgs.mkShell rec {
           buildInputs = defaultDeps ++ androidDeps;