feat: add native reproducibility hygiene checks

.github/workflows/ci.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [main]
 
+env:
+  # Keep in sync with native/rust-toolchain.toml.
+  RUST_TOOLCHAIN: "1.85.1"
+
 jobs:
   build-and-test:
     strategy:
@@ -17,7 +21,9 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
 
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
@@ -71,7 +77,9 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
 
       - name: Setup Dart
         uses: dart-lang/setup-dart@v1
@@ -95,7 +103,9 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
 
       - name: Setup Java
         uses: actions/setup-java@v4
@@ -128,7 +138,9 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
 
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
@@ -150,3 +162,25 @@ jobs:
       - name: Build iOS simulator app (bdk_demo)
         working-directory: bdk_demo
         run: flutter build ios --simulator --no-codesign
+
+  reproducibility:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+
+      - name: Setup Dart
+        uses: dart-lang/setup-dart@v1
+        with:
+          sdk: "3.10.0"
+
+      - name: Check deterministic bindings and native library hash
+        run: |
+          chmod +x scripts/generate_bindings.sh scripts/check_reproducibility.sh
+          ./scripts/check_reproducibility.sh

.gitignore

@@ -3,6 +3,7 @@
 native/target/
 **/*.rs.bk
 Cargo.lock
+!native/Cargo.lock
 
 # Flutter/Dart
 **/build/

PUBDEV_RELEASE_CHECKLIST.md

@@ -14,8 +14,12 @@ Use this checklist before publishing `bdk_dart` to pub.dev.
 ## 2. Source and generated bindings
 
 - [ ] Native and bindings changes are finalized.
-- [ ] `lib/bdk.dart` is regenerated if needed.
+- [ ] `native/Cargo.lock` changes are intentional and reviewed when native dependencies change.
+- [ ] Release native builds use the pinned Rust toolchain from `native/rust-toolchain.toml`.
+- [ ] `lib/bdk.dart` is regenerated if needed and the working tree remains clean for generated bindings.
 - [ ] `scripts/generate_bindings.sh` succeeds on a clean checkout.
+- [ ] `scripts/check_reproducibility.sh` passes for deterministic binding generation and native build input hygiene.
+- [ ] Native binary hash enforcement is enabled only after the UniFFI trait-ordering fix is available in the native dependency stack.
 
 ## 3. Local quality gates
 

README.md

@@ -63,7 +63,13 @@ If you have the Rust toolchain installed, the native library will be automatical
 As a user of the package, you don't need to worry about building the native library or bindings yourself.
 Only if you want to contribute to the bindings or modify the native code yourself, you can follow the instructions in [development](#development) below.
 The first build can take several minutes depending on your machine and network (subsequent builds are faster).
-We pin git dependencies to immutable refs for reproducibility. `bdk-ffi` and `uniffi-dart` both track upstream release tags.
+We pin git dependencies to immutable refs for reproducibility. `bdk-ffi` tracks an upstream release
+tag; `uniffi-dart` is temporarily pinned to an immutable merge commit until a release tag includes
+the deterministic Dart helper ordering fix.
+The native Rust crate also commits `native/Cargo.lock` and uses the pinned Rust toolchain in
+`native/rust-toolchain.toml` for deterministic binding generation and native build input hygiene.
+The native hash comparison is reported as hygiene until the upstream UniFFI trait-ordering fix is
+available through the native dependency stack.
 
 ## Development
 
@@ -79,6 +85,12 @@ For release operations, see [PUBDEV_RELEASE_CHECKLIST.md](PUBDEV_RELEASE_CHECKLI
    bash ./scripts/generate_bindings.sh
    ```
 
+3. Before release-oriented changes, verify generated bindings and native build input hygiene:
+
+   ```bash
+   bash ./scripts/check_reproducibility.sh
+   ```
+
 ### Testing
 
 Once you have generated `lib/bdk.dart` and the native library locally you can execute the

hook/build.dart

@@ -5,6 +5,7 @@ void main(List<String> args) async {
   await build(args, (input, output) async {
     await const RustBuilder(
       assetName: 'uniffi:bdk_dart_ffi',
+      extraCargoBuildArgs: ['--locked'],
     ).run(input: input, output: output);
   });
 }