# Livre Wallet Reproducible Builds

This file describes the planned verification workflow for Livre Wallet and
related on-chain programs.

## Goals

- Let users build the app from source and compare release artifacts.
- Let reviewers verify that deployed Solana programs match published source.
- Keep private keys, wallet data, signing credentials, and deployment secrets
  outside the public repository.

## Flutter App Builds

Flutter desktop/mobile builds are not fully byte-for-byte reproducible across
all machines by default because Xcode, Android SDK, Flutter SDK, native
toolchains, signing identities, and absolute paths can affect artifacts.

For public verification, publish:

- Flutter version: `flutter --version`
- Dart version: `dart --version`
- Xcode version for Apple builds.
- Android SDK/NDK versions for Android builds.
- Commit hash.
- Build command.
- SHA-256 hash of unsigned or reproducibly packaged artifacts where possible.

Example:

```bash
flutter --version
dart --version
git rev-parse HEAD
flutter pub get
flutter build macos --release
shasum -a 256 "build/macos/Build/Products/Release/Livre Wallet.app/Contents/MacOS/Livre Wallet"
```

## Solana Program Verification

When an on-chain program is ready for public release:

1. Publish the exact source commit.
2. Build in a pinned Docker/toolchain environment.
3. Deploy the binary generated from that environment.
4. Publish the program ID and binary hash.
5. Use a Solana verification tool such as `solana-verify` when appropriate.

Planned command shape:

```bash
solana-verify build
solana-verify verify-from-repo <PUBLIC_REPOSITORY_URL> --program-id <PROGRAM_ID>
```

Record verified program IDs in `README.md`.

## Public Release Checklist

- [ ] Fresh repository with no private Git history.
- [ ] No `.env`, wallet keypair JSON, seed phrase, or private note files.
- [ ] `rg -i "seed|mnemonic|private|secret|keypair|personal-name|\\.env"` reviewed.
- [ ] Program IDs documented.
- [ ] Confirm no relayer endpoint is bundled by default, or document any
  optional relayer endpoint deliberately configured for the release.
- [ ] Build tool versions documented.
- [ ] Release artifact hashes published.
- [ ] License included.
