fix: repair install-bitvm.sh and build releases with the pinned toolchain

.claude/commands/install-bitvm.sh

@@ -71,32 +71,51 @@ do_install() {
     local platform
     platform="$(detect_platform)"
 
-    local tarball="bitvm-node-${version}-${platform}.tar.gz"
     local base_url="https://github.com/${REPO}/releases/download/${version}"
-    local url="${base_url}/${tarball}"
-    local sha_url="${url}.sha256"
 
     echo "Platform : $(uname -s) $(uname -m) -> ${platform}"
     echo "Version  : ${version}"
     echo "Install  : ${INSTALL_DIR}"
     echo ""
-    echo "Downloading ${tarball} ..."
 
     local tmpdir
     tmpdir="$(mktemp -d)"
-    trap 'rm -rf "${tmpdir}"' EXIT
-
-    curl -fSL -o "${tmpdir}/${tarball}" "${url}"
-    curl -fSL -o "${tmpdir}/${tarball}.sha256" "${sha_url}"
+    # Expanded now: the local is gone when the EXIT trap runs.
+    trap "rm -rf -- '${tmpdir}'" EXIT
+
+    # Releases up to v0.3.3 still carry the repository's former name.
+    local tarball="" candidate
+    for candidate in "bitvm-node-${version}-${platform}.tar.gz" \
+        "bitvm2-node-${version}-${platform}.tar.gz"; do
+        echo "Downloading ${candidate} ..."
+        if curl -fsSL -o "${tmpdir}/${candidate}" "${base_url}/${candidate}"; then
+            tarball="${candidate}"
+            break
+        fi
+    done
+    if [[ -z "${tarball}" ]]; then
+        echo "Error: no ${platform} archive in release ${version}" >&2
+        exit 1
+    fi
+    curl -fSL -o "${tmpdir}/${tarball}.sha256" "${base_url}/${tarball}.sha256"
 
     echo "Verifying checksum ..."
     cd "${tmpdir}"
+    # Compare the hash only: older releases list the archive under
+    # release-artifacts/, which `-c` cannot find here.
+    local expected actual
+    expected="$(awk '{print $1}' "${tarball}.sha256")"
     if command -v sha256sum &>/dev/null; then
-        sha256sum -c "${tarball}.sha256"
+        actual="$(sha256sum "${tarball}" | awk '{print $1}')"
     elif command -v shasum &>/dev/null; then
-        shasum -a 256 -c "${tarball}.sha256"
+        actual="$(shasum -a 256 "${tarball}" | awk '{print $1}')"
     else
         echo "Warning: no sha256sum or shasum found, skipping checksum verification" >&2
+        actual="${expected}"
+    fi
+    if [[ -z "${expected}" || "${actual}" != "${expected}" ]]; then
+        echo "Error: checksum mismatch for ${tarball}" >&2
+        exit 1
     fi
 
     mkdir -p "${INSTALL_DIR}"
@@ -175,6 +194,12 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
+# Absolute, since the install runs from a temporary directory.
+case "${INSTALL_DIR}" in
+    /*) ;;
+    *)  INSTALL_DIR="${PWD}/${INSTALL_DIR#./}" ;;
+esac
+
 COMMAND="${1:-}"
 shift || true
 

.github/actions/install-ziren/action.yml

@@ -0,0 +1,21 @@
+name: Install Ziren toolchain
+description: The pinned Ziren toolchain every workflow builds with.
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        # Bump both together, in this file only.
+        ZKMUP_COMMIT: 582f7927cac0668883a86cbd02fbc18b500b1b6f
+        ZKM_TOOLCHAIN_VERSION: '20260917'
+      run: |
+        set -euo pipefail
+        installer="$RUNNER_TEMP/zkmup"
+        curl --proto '=https' --tlsv1.2 -fsSL --retry 3 \
+          "https://raw.githubusercontent.com/ProjectZKM/toolchain/${ZKMUP_COMMIT}/zkmup" \
+          -o "$installer"
+        sh "$installer" install -v "$ZKM_TOOLCHAIN_VERSION"
+        SHELL=/bin/true sh "$installer" setup -v "$ZKM_TOOLCHAIN_VERSION"
+        source "$HOME/.zkm-toolchain/env"
+        rustc --version
+        cargo --version

.github/workflows/ci.yml

@@ -15,7 +15,6 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  ZKM_TOOLCHAIN_VERSION: '20260917'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -68,17 +67,7 @@ jobs:
           override: true
           components: clippy
       - name: Install Ziren toolchain
-        run: |
-          set -euo pipefail
-          installer="$RUNNER_TEMP/zkmup"
-          curl --proto '=https' --tlsv1.2 -fsSL --retry 3 \
-            https://raw.githubusercontent.com/ProjectZKM/toolchain/582f7927cac0668883a86cbd02fbc18b500b1b6f/zkmup \
-            -o "$installer"
-          sh "$installer" install -v "$ZKM_TOOLCHAIN_VERSION"
-          SHELL=/bin/true sh "$installer" setup -v "$ZKM_TOOLCHAIN_VERSION"
-          source "$HOME/.zkm-toolchain/env"
-          rustc --version
-          cargo --version
+        uses: ./.github/actions/install-ziren
       - name: Install Dependencies
         run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libclang-18-dev
       - run: |
@@ -92,17 +81,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - name: Install Ziren toolchain
-        run: |
-          set -euo pipefail
-          installer="$RUNNER_TEMP/zkmup"
-          curl --proto '=https' --tlsv1.2 -fsSL --retry 3 \
-            https://raw.githubusercontent.com/ProjectZKM/toolchain/582f7927cac0668883a86cbd02fbc18b500b1b6f/zkmup \
-            -o "$installer"
-          sh "$installer" install -v "$ZKM_TOOLCHAIN_VERSION"
-          SHELL=/bin/true sh "$installer" setup -v "$ZKM_TOOLCHAIN_VERSION"
-          source "$HOME/.zkm-toolchain/env"
-          rustc --version
-          cargo --version
+        uses: ./.github/actions/install-ziren
       - name: Install Dependencies
         run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libclang-18-dev
       - name: Launch the Regtest

.github/workflows/docker-proof-builder-rpc-regtest.yml

@@ -37,7 +37,7 @@ jobs:
           sudo docker builder prune -a
 
       - name: Install Ziren toolchain
-        run: curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/ProjectZKM/toolchain/refs/heads/main/setup.sh | sh
+        uses: ./.github/actions/install-ziren
 
       - name: Install Dependencies
         run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libclang-18-dev
@@ -50,6 +50,13 @@ jobs:
         run: |
           VERSION=$(grep '^version =' ./Cargo.toml | head -n1 | sed -E 's/version = "(.*)"/\1/')
           echo "CARGO_VERSION=$VERSION" >> $GITHUB_ENV
+          # The release version is tagged from main only; dev builds are
+          # dev-<sha>, so a pinned version never pulls an unreleased build.
+          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+            echo "VERSION_TAG=$VERSION" >> $GITHUB_ENV
+          else
+            echo "VERSION_TAG=dev-${GITHUB_SHA::12}" >> $GITHUB_ENV
+          fi
           echo "Using version: $VERSION"
 
       - name: Set lowercase repo name
@@ -74,4 +81,4 @@ jobs:
           push: true
           tags: |
             ghcr.io/${{ env.REPO_LOWER }}-proof-builder-rpc:latest
-            ghcr.io/${{ env.REPO_LOWER }}-proof-builder-rpc:${{ env.CARGO_VERSION }}
+            ghcr.io/${{ env.REPO_LOWER }}-proof-builder-rpc:${{ env.VERSION_TAG }}

.github/workflows/docker.yml

@@ -24,13 +24,20 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Ziren toolchain
-        run: curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/ProjectZKM/toolchain/refs/heads/main/setup.sh | sh
+        uses: ./.github/actions/install-ziren
 
       - name: Extract version from Cargo.toml
         id: version
         run: |
           VERSION=$(grep '^version =' Cargo.toml | head -n1 | sed -E 's/version = "(.*)"/\1/')
           echo "CARGO_VERSION=$VERSION" >> $GITHUB_ENV
+          # The release version is tagged from main only; dev builds are
+          # dev-<sha>, so a pinned version never pulls an unreleased build.
+          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+            echo "VERSION_TAG=$VERSION" >> $GITHUB_ENV
+          else
+            echo "VERSION_TAG=dev-${GITHUB_SHA::12}" >> $GITHUB_ENV
+          fi
           echo "Using version: $VERSION"
 
       - name: Install Dependencies
@@ -61,4 +68,4 @@ jobs:
           push: true
           tags: |
             ghcr.io/${{ env.REPO_LOWER }}-node:latest
-            ghcr.io/${{ env.REPO_LOWER }}-node:${{ env.CARGO_VERSION }}
+            ghcr.io/${{ env.REPO_LOWER }}-node:${{ env.VERSION_TAG }}

.github/workflows/release.yml

@@ -39,9 +39,7 @@ jobs:
           echo "CGO_ENABLED=1" >> $GITHUB_ENV        
 
       - name: Install Ziren toolchain
-        run: |
-          curl --proto '=https' --tlsv1.2 -sSf \
-            https://raw.githubusercontent.com/ProjectZKM/toolchain/refs/heads/main/setup.sh | sh
+        uses: ./.github/actions/install-ziren
 
       # Install Go for all platforms (required for zkm-recursion-gnark-ffi)
       - name: Install Go (Ubuntu, macOS)
@@ -107,7 +105,8 @@ jobs:
 
           ARCHIVE_NAME="bitvm-node-${VERSION}-${PLATFORM}.tar.gz"
           tar -czf "release-artifacts/${ARCHIVE_NAME}" -C "$STAGING_DIR" .
-          $CHECKSUM_CMD "release-artifacts/${ARCHIVE_NAME}" > "release-artifacts/${ARCHIVE_NAME}.sha256"
+          # Name only: the checksum is checked next to the downloaded archive.
+          (cd release-artifacts && $CHECKSUM_CMD "${ARCHIVE_NAME}" > "${ARCHIVE_NAME}.sha256")
 
           echo "Archive created:"
           ls -lh release-artifacts/