Make firmware builds reproducible

.github/workflows/ci.yml

@@ -81,7 +81,8 @@ jobs:
           ./target
           ./firmware/target
         key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-    - run: nix develop .#embedded --command bash -c "cd firmware && cargo build --no-default-features --features ${{ matrix.target }} --release"
+    - run: nix develop .#embedded-reproducible --command bash -c "cd firmware && cargo build --no-default-features --features ${{ matrix.target }} --release"
+    - run: sha256sum ./firmware/target/thumbv7em-none-eabihf/release/firmware
     - uses: actions/upload-artifact@v2
       with:
         name: firmware-${{ matrix.target }}

flake.nix

@@ -75,7 +75,7 @@
         };
 
         defaultDeps = with pkgs; [ cmake SDL2 fltk pango rust-analyzer pkg-config libusb ];
-        embeddedDeps = with pkgs; [ probe-rs gcc-arm-embedded qemu gdb openocd clang (getRust { withEmbedded = true; }) ];
+        embeddedDeps = with pkgs; [ probe-rs gcc-arm-embedded qemu gdb openocd clang_17 (getRust { withEmbedded = true; }) ];
         androidDeps = with pkgs; [ cargo-ndk jdk gnupg (getRust { fullAndroid = true; }) ];
         iosDeps = with pkgs; [ (getRust { withIos = true; }) ];
       in
@@ -89,6 +89,18 @@
 
           CC_thumbv7em_none_eabihf = "${pkgs.gcc-arm-embedded}/bin/arm-none-eabi-gcc";
         };
+        devShells.embedded-reproducible = pkgs.mkShell {
+          buildInputs = defaultDeps ++ embeddedDeps;
+
+          CC_thumbv7em_none_eabihf = "clang-17";
+
+          shellHook = ''
+            export MAIN_DIR=$PWD
+
+            export CFLAGS_thumbv7em_none_eabihf="-fno-PIC -fno-stack-protector -frandom-seed=22 -I${pkgs.clang_17}/resource-root/include/ -I${pkgs.gcc-arm-embedded}/arm-none-eabi/include -target thumbv7em-none-eabihf -ffile-prefix-map=$HOME/.cargo="
+            export RUSTFLAGS="-Clink-arg=-Tlink.x --remap-path-prefix $HOME/.cargo= --remap-path-prefix $MAIN_DIR/firmware=firmware --remap-path-prefix $MAIN_DIR/model=model --remap-path-prefix $MAIN_DIR/gui=gui";
+          '';
+        };
         devShells.android = pkgs.mkShell rec {
           buildInputs = defaultDeps ++ androidDeps;