From 5adad74388fb872d62165c0880a5d872045e2563 Mon Sep 17 00:00:00 2001 From: Ethan Date: Wed, 11 Nov 2026 06:39:13 +0000 Subject: [PATCH 1/2] fix: make install-bitvm.sh install the published releases --- .claude/commands/install-bitvm.sh | 45 ++++++++++++++++++++++++------- .github/workflows/release.yml | 3 ++- 2 files changed, 37 insertions(+), 11 deletions(-) diff --git a/.claude/commands/install-bitvm.sh b/.claude/commands/install-bitvm.sh index a194ed784..24e39d9a0 100755 --- a/.claude/commands/install-bitvm.sh +++ b/.claude/commands/install-bitvm.sh @@ -71,32 +71,51 @@ do_install() { local platform platform="$(detect_platform)" - local tarball="bitvm-node-${version}-${platform}.tar.gz" local base_url="https://github.com/${REPO}/releases/download/${version}" - local url="${base_url}/${tarball}" - local sha_url="${url}.sha256" echo "Platform : $(uname -s) $(uname -m) -> ${platform}" echo "Version : ${version}" echo "Install : ${INSTALL_DIR}" echo "" - echo "Downloading ${tarball} ..." local tmpdir tmpdir="$(mktemp -d)" - trap 'rm -rf "${tmpdir}"' EXIT - - curl -fSL -o "${tmpdir}/${tarball}" "${url}" - curl -fSL -o "${tmpdir}/${tarball}.sha256" "${sha_url}" + # Expanded now: the local is gone when the EXIT trap runs. + trap "rm -rf -- '${tmpdir}'" EXIT + + # Releases up to v0.3.3 still carry the repository's former name. + local tarball="" candidate + for candidate in "bitvm-node-${version}-${platform}.tar.gz" \ + "bitvm2-node-${version}-${platform}.tar.gz"; do + echo "Downloading ${candidate} ..." + if curl -fsSL -o "${tmpdir}/${candidate}" "${base_url}/${candidate}"; then + tarball="${candidate}" + break + fi + done + if [[ -z "${tarball}" ]]; then + echo "Error: no ${platform} archive in release ${version}" >&2 + exit 1 + fi + curl -fSL -o "${tmpdir}/${tarball}.sha256" "${base_url}/${tarball}.sha256" echo "Verifying checksum ..." cd "${tmpdir}" + # Compare the hash only: older releases list the archive under + # release-artifacts/, which `-c` cannot find here. + local expected actual + expected="$(awk '{print $1}' "${tarball}.sha256")" if command -v sha256sum &>/dev/null; then - sha256sum -c "${tarball}.sha256" + actual="$(sha256sum "${tarball}" | awk '{print $1}')" elif command -v shasum &>/dev/null; then - shasum -a 256 -c "${tarball}.sha256" + actual="$(shasum -a 256 "${tarball}" | awk '{print $1}')" else echo "Warning: no sha256sum or shasum found, skipping checksum verification" >&2 + actual="${expected}" + fi + if [[ -z "${expected}" || "${actual}" != "${expected}" ]]; then + echo "Error: checksum mismatch for ${tarball}" >&2 + exit 1 fi mkdir -p "${INSTALL_DIR}" @@ -175,6 +194,12 @@ while [[ $# -gt 0 ]]; do esac done +# Absolute, since the install runs from a temporary directory. +case "${INSTALL_DIR}" in + /*) ;; + *) INSTALL_DIR="${PWD}/${INSTALL_DIR#./}" ;; +esac + COMMAND="${1:-}" shift || true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4ce5cdf53..8173acfc0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -107,7 +107,8 @@ jobs: ARCHIVE_NAME="bitvm-node-${VERSION}-${PLATFORM}.tar.gz" tar -czf "release-artifacts/${ARCHIVE_NAME}" -C "$STAGING_DIR" . - $CHECKSUM_CMD "release-artifacts/${ARCHIVE_NAME}" > "release-artifacts/${ARCHIVE_NAME}.sha256" + # Name only: the checksum is checked next to the downloaded archive. + (cd release-artifacts && $CHECKSUM_CMD "${ARCHIVE_NAME}" > "${ARCHIVE_NAME}.sha256") echo "Archive created:" ls -lh release-artifacts/ From 2b88cfe0086f157fed80363aa1fcede32b0c6b44 Mon Sep 17 00:00:00 2001 From: Ethan Date: Wed, 11 Nov 2026 06:39:13 +0000 Subject: [PATCH 2/2] fix: build releases and images with the CI-pinned Ziren toolchain and tag dev images by commit --- .github/actions/install-ziren/action.yml | 21 ++++++++++++++++ .github/workflows/ci.yml | 25 ++----------------- .../docker-proof-builder-rpc-regtest.yml | 11 ++++++-- .github/workflows/docker.yml | 11 ++++++-- .github/workflows/release.yml | 4 +-- 5 files changed, 42 insertions(+), 30 deletions(-) create mode 100644 .github/actions/install-ziren/action.yml diff --git a/.github/actions/install-ziren/action.yml b/.github/actions/install-ziren/action.yml new file mode 100644 index 000000000..ca33a2679 --- /dev/null +++ b/.github/actions/install-ziren/action.yml @@ -0,0 +1,21 @@ +name: Install Ziren toolchain +description: The pinned Ziren toolchain every workflow builds with. +runs: + using: composite + steps: + - shell: bash + env: + # Bump both together, in this file only. + ZKMUP_COMMIT: 582f7927cac0668883a86cbd02fbc18b500b1b6f + ZKM_TOOLCHAIN_VERSION: '20260917' + run: | + set -euo pipefail + installer="$RUNNER_TEMP/zkmup" + curl --proto '=https' --tlsv1.2 -fsSL --retry 3 \ + "https://raw.githubusercontent.com/ProjectZKM/toolchain/${ZKMUP_COMMIT}/zkmup" \ + -o "$installer" + sh "$installer" install -v "$ZKM_TOOLCHAIN_VERSION" + SHELL=/bin/true sh "$installer" setup -v "$ZKM_TOOLCHAIN_VERSION" + source "$HOME/.zkm-toolchain/env" + rustc --version + cargo --version diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ccef823bb..3154ddbab 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,7 +15,6 @@ on: env: CARGO_TERM_COLOR: always - ZKM_TOOLCHAIN_VERSION: '20260917' concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} @@ -68,17 +67,7 @@ jobs: override: true components: clippy - name: Install Ziren toolchain - run: | - set -euo pipefail - installer="$RUNNER_TEMP/zkmup" - curl --proto '=https' --tlsv1.2 -fsSL --retry 3 \ - https://raw.githubusercontent.com/ProjectZKM/toolchain/582f7927cac0668883a86cbd02fbc18b500b1b6f/zkmup \ - -o "$installer" - sh "$installer" install -v "$ZKM_TOOLCHAIN_VERSION" - SHELL=/bin/true sh "$installer" setup -v "$ZKM_TOOLCHAIN_VERSION" - source "$HOME/.zkm-toolchain/env" - rustc --version - cargo --version + uses: ./.github/actions/install-ziren - name: Install Dependencies run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libclang-18-dev - run: | @@ -92,17 +81,7 @@ jobs: steps: - uses: actions/checkout@v5 - name: Install Ziren toolchain - run: | - set -euo pipefail - installer="$RUNNER_TEMP/zkmup" - curl --proto '=https' --tlsv1.2 -fsSL --retry 3 \ - https://raw.githubusercontent.com/ProjectZKM/toolchain/582f7927cac0668883a86cbd02fbc18b500b1b6f/zkmup \ - -o "$installer" - sh "$installer" install -v "$ZKM_TOOLCHAIN_VERSION" - SHELL=/bin/true sh "$installer" setup -v "$ZKM_TOOLCHAIN_VERSION" - source "$HOME/.zkm-toolchain/env" - rustc --version - cargo --version + uses: ./.github/actions/install-ziren - name: Install Dependencies run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libclang-18-dev - name: Launch the Regtest diff --git a/.github/workflows/docker-proof-builder-rpc-regtest.yml b/.github/workflows/docker-proof-builder-rpc-regtest.yml index 18292a619..a208bfcbd 100644 --- a/.github/workflows/docker-proof-builder-rpc-regtest.yml +++ b/.github/workflows/docker-proof-builder-rpc-regtest.yml @@ -37,7 +37,7 @@ jobs: sudo docker builder prune -a - name: Install Ziren toolchain - run: curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/ProjectZKM/toolchain/refs/heads/main/setup.sh | sh + uses: ./.github/actions/install-ziren - name: Install Dependencies run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libclang-18-dev @@ -50,6 +50,13 @@ jobs: run: | VERSION=$(grep '^version =' ./Cargo.toml | head -n1 | sed -E 's/version = "(.*)"/\1/') echo "CARGO_VERSION=$VERSION" >> $GITHUB_ENV + # The release version is tagged from main only; dev builds are + # dev-, so a pinned version never pulls an unreleased build. + if [ "$GITHUB_REF" = "refs/heads/main" ]; then + echo "VERSION_TAG=$VERSION" >> $GITHUB_ENV + else + echo "VERSION_TAG=dev-${GITHUB_SHA::12}" >> $GITHUB_ENV + fi echo "Using version: $VERSION" - name: Set lowercase repo name @@ -74,4 +81,4 @@ jobs: push: true tags: | ghcr.io/${{ env.REPO_LOWER }}-proof-builder-rpc:latest - ghcr.io/${{ env.REPO_LOWER }}-proof-builder-rpc:${{ env.CARGO_VERSION }} + ghcr.io/${{ env.REPO_LOWER }}-proof-builder-rpc:${{ env.VERSION_TAG }} diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index d93f1adff..c5554960c 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -24,13 +24,20 @@ jobs: uses: actions/checkout@v5 - name: Install Ziren toolchain - run: curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/ProjectZKM/toolchain/refs/heads/main/setup.sh | sh + uses: ./.github/actions/install-ziren - name: Extract version from Cargo.toml id: version run: | VERSION=$(grep '^version =' Cargo.toml | head -n1 | sed -E 's/version = "(.*)"/\1/') echo "CARGO_VERSION=$VERSION" >> $GITHUB_ENV + # The release version is tagged from main only; dev builds are + # dev-, so a pinned version never pulls an unreleased build. + if [ "$GITHUB_REF" = "refs/heads/main" ]; then + echo "VERSION_TAG=$VERSION" >> $GITHUB_ENV + else + echo "VERSION_TAG=dev-${GITHUB_SHA::12}" >> $GITHUB_ENV + fi echo "Using version: $VERSION" - name: Install Dependencies @@ -61,4 +68,4 @@ jobs: push: true tags: | ghcr.io/${{ env.REPO_LOWER }}-node:latest - ghcr.io/${{ env.REPO_LOWER }}-node:${{ env.CARGO_VERSION }} + ghcr.io/${{ env.REPO_LOWER }}-node:${{ env.VERSION_TAG }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8173acfc0..61e6275e5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,9 +39,7 @@ jobs: echo "CGO_ENABLED=1" >> $GITHUB_ENV - name: Install Ziren toolchain - run: | - curl --proto '=https' --tlsv1.2 -sSf \ - https://raw.githubusercontent.com/ProjectZKM/toolchain/refs/heads/main/setup.sh | sh + uses: ./.github/actions/install-ziren # Install Go for all platforms (required for zkm-recursion-gnark-ffi) - name: Install Go (Ubuntu, macOS)