From cb4b75b6a70722d807a0a8861e67d68b030510f1 Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Fri, 24 Jul 2026 20:42:28 +0000
Subject: [PATCH] Fix cross-path release reproducibility

---
 .github/workflows/blackstar-ci.yml         | 13 ++++++
 .github/workflows/release.yml              | 12 +-----
 CHANGELOG.md                               |  4 +-
 docs/RELEASE_POLICY.md                     |  3 +-
 extras/scripts/buildBlackSTARRelease.sh    | 12 ++++--
 extras/scripts/compareBlackSTARReleases.sh | 46 ++++++++++++++++++++++
 6 files changed, 74 insertions(+), 16 deletions(-)
 create mode 100755 extras/scripts/compareBlackSTARReleases.sh

diff --git a/.github/workflows/blackstar-ci.yml b/.github/workflows/blackstar-ci.yml
index 7c1624b3..0a890e45 100644
--- a/.github/workflows/blackstar-ci.yml
+++ b/.github/workflows/blackstar-ci.yml
@@ -65,6 +65,18 @@ jobs:
           JOBS: "2"
         run: extras/scripts/buildBlackSTARRelease.sh
 
+      - name: Build independent release reproduction
+        env:
+          DIST_DIR: ${{ runner.temp }}/release-build-2
+          JOBS: "2"
+        run: |
+          git worktree add --detach "${RUNNER_TEMP}/release-source-2" HEAD
+          cd "${RUNNER_TEMP}/release-source-2"
+          extras/scripts/buildBlackSTARRelease.sh
+
+      - name: Verify cross-path release reproducibility
+        run: extras/scripts/compareBlackSTARReleases.sh dist "${RUNNER_TEMP}/release-build-2"
+
       - name: Verify release identity and OpenMP linkage
         run: |
           test "$(source/STAR --version)" = "2.7.11b-blackstar.3"
@@ -126,6 +138,7 @@ jobs:
           retention-days: 14
           path: |
             dist
+            ${{ runner.temp }}/release-build-2
             ${{ runner.temp }}/genome-insert-hardening
             ${{ runner.temp }}/saindex-strategies
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c90655e1..b21145e2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -56,17 +56,7 @@ jobs:
           extras/scripts/buildBlackSTARRelease.sh
 
       - name: Compare release products
-        run: |
-          version="$(sed -n 's/^#define BLACKSTAR_VERSION "\(.*\)"$/\1/p' source/VERSION)"
-          package="blackstar-${version}-linux-x86_64"
-          cmp "${RUNNER_TEMP}/build-1/${package}.tar.gz" "${RUNNER_TEMP}/build-2/${package}.tar.gz"
-          cmp "${RUNNER_TEMP}/build-1/${package}.tar.gz.sha256" "${RUNNER_TEMP}/build-2/${package}.tar.gz.sha256"
-          cmp "${RUNNER_TEMP}/build-1/${package}.spdx.json" "${RUNNER_TEMP}/build-2/${package}.spdx.json"
-          cmp "${RUNNER_TEMP}/build-1/${package}/STAR" "${RUNNER_TEMP}/build-2/${package}/STAR"
-          cmp "${RUNNER_TEMP}/build-1/${package}/build-info.tsv" "${RUNNER_TEMP}/build-2/${package}/build-info.tsv"
-          cmp "${RUNNER_TEMP}/build-1/${package}/ldd.txt" "${RUNNER_TEMP}/build-2/${package}/ldd.txt"
-          cmp "${RUNNER_TEMP}/build-1/${package}/LICENSE" "${RUNNER_TEMP}/build-2/${package}/LICENSE"
-          cmp "${RUNNER_TEMP}/build-1/${package}/ATTRIBUTION.md" "${RUNNER_TEMP}/build-2/${package}/ATTRIBUTION.md"
+        run: extras/scripts/compareBlackSTARReleases.sh "${RUNNER_TEMP}/build-1" "${RUNNER_TEMP}/build-2"
 
       - name: Attest release products
         uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d0962064..406784ab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,7 @@
 This changelog records BlackSTAR project releases. The inherited STAR history
 remains available in `CHANGES.md` and `RELEASEnotes.md`.
 
-## Unreleased
+## 1.0.0 - 2026-07-24
 
 - Transition project identity from a GitHub fork to an independently maintained
   successor while preserving upstream attribution.
@@ -12,6 +12,8 @@ remains available in `CHANGES.md` and `RELEASEnotes.md`.
 - Add BlackSTAR-owned issue intake, pull-request requirements, and migration
   documentation.
 - Add a recoverable GitHub fork-detachment procedure and evidence archive.
+- Make Linux release artifacts independent of the absolute checkout path,
+  including bundled HTSlib compilation.
 
 No alignment, indexing, or output behavior is changed by the project-identity
 work alone.
diff --git a/docs/RELEASE_POLICY.md b/docs/RELEASE_POLICY.md
index 4dc5cf5c..fb398b6e 100644
--- a/docs/RELEASE_POLICY.md
+++ b/docs/RELEASE_POLICY.md
@@ -23,7 +23,8 @@ Every stable release must:
 5. classify inherited upstream defects separately from BlackSTAR regressions;
 6. update the changelog, release boundary, acceptance record, and limitations;
 7. record compiler, flags, OpenMP linkage, commit, and source-date epoch; and
-8. reproduce the package and executable across two clean builds.
+8. reproduce every package artifact across two clean builds rooted at different
+   absolute source paths.
 
 Performance-affecting releases additionally require seeded, order-balanced
 candidate/control pairs on a controlled host. Raw outputs remain outside Git;
diff --git a/extras/scripts/buildBlackSTARRelease.sh b/extras/scripts/buildBlackSTARRelease.sh
index 0455fd91..032b4bd1 100755
--- a/extras/scripts/buildBlackSTARRelease.sh
+++ b/extras/scripts/buildBlackSTARRelease.sh
@@ -9,6 +9,7 @@ repo_root="$(cd "${script_dir}/../.." && pwd)"
 cxx="${CXX:-g++}"
 jobs="${JOBS:-$(nproc 2>/dev/null || echo 1)}"
 allow_dirty="${ALLOW_DIRTY:-0}"
+user_cxxflags_extra="${CXXFLAGSEXTRA:-}"
 
 cd "${repo_root}"
 if [[ "${allow_dirty}" != "1" && -n "$(git status --porcelain)" ]]; then
@@ -54,13 +55,17 @@ trap cleanup EXIT
 mkdir "${package_dir}"
 
 provenance="commit=${commit};tree=$([[ -z "$(git status --porcelain)" ]] && echo clean || echo dirty);release=${version};executable=${executable_version}"
+path_map_flags="-ffile-prefix-map=${repo_root}=. -fdebug-prefix-map=${repo_root}=. -fmacro-prefix-map=${repo_root}=."
+effective_cxxflags_extra="${user_cxxflags_extra:+${user_cxxflags_extra} }${path_map_flags}"
+htslib_cflags="-g -Wall -O2 ${path_map_flags}"
 export SOURCE_DATE_EPOCH="${source_date_epoch}"
-make -C source clean
+make -C source CLEAN
+make -C source/htslib -j"${jobs}" lib-static CFLAGS="${htslib_cflags}"
 make -C source -j"${jobs}" STAR \
     CXX="${cxx}" \
     BUILD_PLACE="blackstar-reproducible-build" \
     GIT_PROVENANCE="${provenance}" \
-    CXXFLAGSextra="${CXXFLAGSEXTRA:-}" \
+    CXXFLAGSextra="${effective_cxxflags_extra}" \
     LDFLAGSextra="${LDFLAGSEXTRA:-}"
 
 if [[ "$(source/STAR --version)" != "${executable_version}" ]]; then
@@ -99,7 +104,8 @@ sbom_sha256="$(sha256sum "${package_dir}/sbom.spdx.json" | awk '{print $1}')"
     printf 'build_utc\t%s\n' "${build_utc}"
     printf 'build_place\tblackstar-reproducible-build\n'
     printf 'compiler\t%s\n' "${compiler_version}"
-    printf 'cxxflags_extra\t%s\n' "${CXXFLAGSEXTRA:-}"
+    printf 'cxxflags_extra\t%s\n' "${user_cxxflags_extra}"
+    printf 'source_path_mapping\trepository root mapped to .\n'
     printf 'ldflags_extra\t%s\n' "${LDFLAGSEXTRA:-}"
     printf 'binary_sha256\t%s\n' "${binary_sha256}"
     printf 'license_sha256\t%s\n' "${license_sha256}"
diff --git a/extras/scripts/compareBlackSTARReleases.sh b/extras/scripts/compareBlackSTARReleases.sh
new file mode 100755
index 00000000..fc6db02f
--- /dev/null
+++ b/extras/scripts/compareBlackSTARReleases.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$#" -ne 2 ]]; then
+    echo "Usage: $0 BUILD_DIRECTORY_1 BUILD_DIRECTORY_2" >&2
+    exit 2
+fi
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "${script_dir}/../.." && pwd)"
+version="$(sed -n 's/^#define BLACKSTAR_VERSION "\(.*\)"$/\1/p' "${repo_root}/source/VERSION")"
+package="blackstar-${version}-linux-x86_64"
+first="$1"
+second="$2"
+status=0
+
+products=(
+    "${package}.tar.gz"
+    "${package}.tar.gz.sha256"
+    "${package}.spdx.json"
+    "${package}/STAR"
+    "${package}/build-info.tsv"
+    "${package}/ldd.txt"
+    "${package}/LICENSE"
+    "${package}/ATTRIBUTION.md"
+    "${package}/sbom.spdx.json"
+)
+
+for product in "${products[@]}"; do
+    first_path="${first}/${product}"
+    second_path="${second}/${product}"
+    if [[ ! -f "${first_path}" || ! -f "${second_path}" ]]; then
+        echo "MISSING: ${product}" >&2
+        status=1
+    elif ! cmp -s "${first_path}" "${second_path}"; then
+        echo "MISMATCH: ${product}" >&2
+        sha256sum "${first_path}" "${second_path}" >&2
+        status=1
+    fi
+done
+
+if [[ "${status}" -ne 0 ]]; then
+    exit "${status}"
+fi
+
+echo "BlackSTAR release products are byte-identical across independent source paths"