Generated GUIDs and reproducible output #9

New issue

Closed

opened 2026-10-14 01:26:54 -05:00 by jeff · 2 comments

jeff commented

2026-10-14 01:26:54 -05:00

Owner

Parent

Part of #1

What to build

Id="*" on Product and Package and Guid="*" on Component have zixl generate the GUID, as ADR-0003 decides: a UUIDv5 over a hash of every input (the preprocessed WiX sources and the contents of every source path) and the identity of the element asking, except that a component GUID comes from its key path alone. GUIDs written out are normalized to uppercase with braces. Timestamps come from SOURCE_DATE_EPOCH when it is set.

Acceptance criteria

Seam 1 tests: the same inputs give the same product code, package code and component GUIDs; changing one source path's contents changes the package code and product code but not the component GUIDs.
Seam 1 test: a component GUID changes when its key path changes.
Seam 1 test: an explicit lowercase GUID without braces is stored as {UPPERCASE}; a malformed one is a diagnostic.
VM test: building a fixture twice with SOURCE_DATE_EPOCH set gives byte-identical installer packages.
zixl depends on zig-uuid for UUID generation and formatting rather than code of its own.

Blocked by

Outside this repository: zig-uuid (https://git.jcollie.dev/jeff/zig-uuid) supports Zig 0.16 only. It is to be ported to Zig 0.17 in a session of its own, following the Zig upgrade procedure, before this ticket starts.

## Parent Part of #1 ## What to build `Id="*"` on `Product` and `Package` and `Guid="*"` on `Component` have zixl generate the GUID, as ADR-0003 decides: a UUIDv5 over a hash of every input (the preprocessed WiX sources and the contents of every source path) and the identity of the element asking, except that a component GUID comes from its key path alone. GUIDs written out are normalized to uppercase with braces. Timestamps come from `SOURCE_DATE_EPOCH` when it is set. ## Acceptance criteria - [ ] Seam 1 tests: the same inputs give the same product code, package code and component GUIDs; changing one source path's contents changes the package code and product code but not the component GUIDs. - [ ] Seam 1 test: a component GUID changes when its key path changes. - [ ] Seam 1 test: an explicit lowercase GUID without braces is stored as `{UPPERCASE}`; a malformed one is a diagnostic. - [ ] VM test: building a fixture twice with `SOURCE_DATE_EPOCH` set gives byte-identical installer packages. - [ ] zixl depends on `zig-uuid` for UUID generation and formatting rather than code of its own. ## Blocked by Outside this repository: `zig-uuid` (https://git.jcollie.dev/jeff/zig-uuid) supports Zig 0.16 only. It is to be ported to Zig 0.17 in a session of its own, following the Zig upgrade procedure, before this ticket starts.

jeff added the

ready-for-agent

label

2026-10-14 01:26:54 -05:00

jeff added a new dependency

2026-10-14 01:27:06 -05:00

#3 Files in an embedded, uncompressed cabinet

jeff added a new dependency

2026-10-14 01:27:07 -05:00

#15 The Windows build of zixl gives identical output

jeff commented

2026-10-14 02:18:59 -05:00

Author

Owner

The outside blocker is resolved: zig-uuid v0.1.0 (commit 7473a97) builds with Zig 0.17.0 and adds what this ticket needs — serializeRegistry() / fmt(.registry) for {UPPERCASE} GUIDs, deserialize accepting braces and either case, and UUID.fromName(.v5, namespace, parts). Fetch with zig fetch --save git+https://git.jcollie.dev/jeff/zig-uuid#v0.1.0.

The outside blocker is resolved: zig-uuid v0.1.0 (commit 7473a97) builds with Zig 0.17.0 and adds what this ticket needs — `serializeRegistry()` / `fmt(.registry)` for `{UPPERCASE}` GUIDs, `deserialize` accepting braces and either case, and `UUID.fromName(.v5, namespace, parts)`. Fetch with `zig fetch --save git+https://git.jcollie.dev/jeff/zig-uuid#v0.1.0`.

jeff self-assigned this

2026-10-14 03:45:46 -05:00

jeff referenced this issue from a commit

2026-10-14 03:54:06 -05:00

Generate GUIDs and keep output reproducible (#9)

jeff commented

2026-10-14 04:13:01 -05:00

Author

Owner

Done in 1d6a544; CI run 7 is green.

Product and package codes are UUIDv5s in zixl's own namespace over a SHA-256 of every preprocessed source and every source file's contents. A component GUID comes from its key path alone, lowercased.
Seam 1:
- the same inputs give the same codes;
- a file's contents change the product and package codes but not the component GUIDs;
- renaming the key file changes the component GUID, but changing only its case doesn't;
- explicit GUIDs are stored as {UPPERCASE}, and malformed ones are errors;
- Guid="" is an untracked component;
- a generated GUID needs a key file.
End to end:
- every fixture is built twice with SOURCE_DATE_EPOCH set and must be byte-identical;
- the generated fixture installs under Wine;
- its product code and component GUIDs are masked against wixl's, which derives its own (also UUIDv5, in another namespace).
zig-uuid v0.1.0 does all UUID generation and formatting.

Done in 1d6a544; CI run 7 is green. - **Product and package codes** are UUIDv5s in zixl's own namespace over a SHA-256 of every preprocessed source and every source file's contents. A component GUID comes from its key path alone, lowercased. - **Seam 1:** - the same inputs give the same codes; - a file's contents change the product and package codes but not the component GUIDs; - renaming the key file changes the component GUID, but changing only its case doesn't; - explicit GUIDs are stored as `{UPPERCASE}`, and malformed ones are errors; - `Guid=""` is an untracked component; - a generated GUID needs a key file. - **End to end:** - every fixture is built twice with `SOURCE_DATE_EPOCH` set and must be byte-identical; - the `generated` fixture installs under Wine; - its product code and component GUIDs are masked against wixl's, which derives its own (also UUIDv5, in another namespace). - **zig-uuid v0.1.0** does all UUID generation and formatting.

jeff closed this issue

2026-10-14 04:13:01 -05:00