EPIC: Modify Docker build to create Deterministic Images

[AlfredoG87]

Problem

As a consumer of block node application docker images
I want the images to be deterministic
So that, I could reproduce the same image to verify its contents

We need the builds from the block-node docker images to be deterministic

Solution

• Integrate the gradle plugin as it is on hedera-services so that we get deterministic software builds
• Use the hedera-services Dockerfile and support scripts to ensure deterministic images
• Use the CI GHA yamls and scripts to build and verify the required behavior

Tasks

Preview Give feedback

1. Configure gradle to build deterministically #408
   Block Node Feature Enhancement Release +3
   
2. Configure the Block Node Dockerfile to build deterministic images #409
   Block Node Feature Enhancement Release +3
   
3. Configure GitHub Actions to build and deploy deterministic images #410
   Block Node Feature Enhancement Release +3

[ata-nas]

Maybe this is a duplicate of #299?

[mattp-swirldslabs]

• Important piece of deterministic build
• com.hedera.gradle.java.gradle.kts

[mattp-swirldslabs]

• Must use UTF-8 encoding
• javadoc as well in UTF-8
• These changes should be available in the gradlew plugin available from Hiero

[mattp-swirldslabs]

• Steal this from services
• It's used to make the jars deterministic
• Ensures the commands we need are available
• Hashes of the jar files, sorted list, with hash - want to use the SHA256SUM -b (binary switch)

[mattp-swirldslabs]

• Pipeline file must use UTF-8 as well
• Steal this too

[mattp-swirldslabs]

• We'll need a service account for the repo
• Might need to comment out the application section if we don't have multiple jar file directories
• BASELINE part is important for testing the determinism

[mattp-swirldslabs]

• Standardize git line endings is also important

[mattp-swirldslabs]

• Docker determinism pieces

[mattp-swirldslabs]

SOURCE_DATE_EPOCH="0" is not valid in later versions of docker build kit

[mattp-swirldslabs]

• Script used to make apt-get deterministic in the docker build

[mattp-swirldslabs]

• Might not need the "Deterministic Build Hack" section in the Dockerfile but that hasn't been verified.

[mattp-swirldslabs]

• S6 overlay may not be required.
• End up with 2 layers in the end?

[mattp-swirldslabs]

GHA testing:

• You can check the output of the GHA scripts to verify the run was deterministic

[ata-nas]

@AlfredoG87 @mattp-swirldslabs maybe #343 could be added here to be fixed together?