feat: ship the Solidity verifier in every circuit's release tarball - #10
Merged
Merged
Conversation
The verifier derives from the vk alone, so it belongs in the release that publishes the vk. Until now every consumer re-ran bb to derive it, which put a bb pin in repos that have no other reason to know bb exists. build.sh now runs gen-verifier.sh per circuit into artifacts/<circuit>/, so release.yml packages and hashes it with no change. The contract name is derived from the directory and pinned for the two known circuits, so a rename fails the build instead of silently renaming what consumers compile. Assisted-by: Claude Fable 5.1 Signed-off-by: xgreenx <xgreenx9999@gmail.com>
The release.yml header, README and toolchain.env described a downstream `verifiers` job re-running bb over the vks. That is no longer the contract: the .sol ships in the tarball and the manifest, and a consumer downloads, checks sha256, runs forge fmt under its own foundry.toml, and compiles. Assisted-by: Claude Fable 5.1 Signed-off-by: xgreenx <xgreenx9999@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bbshould run in exactly one repo. The verifier derives from thevkalone, so it ships in the release that publishes thevk; consumers stop re-deriving it and drop their bb pin.Changes
scripts/build.shrunsgen-verifier.shper circuit intoartifacts/<circuit>/, sorelease.ymlpackages and hashes the.solwith no packaging change and CI exercises it on every PR.scripts/gen-verifier.shderives the contract name from the circuit directory (bearer-link→BearerLinkHonkVerifier,oidc-google→OidcGoogleHonkVerifier), pins those two names and fails if a directory is renamed, gains--artifacts <dir>, defaults the output to<artifacts>/<circuit>/<Contract>.sol, and asserts exactly one concrete contract and no bareassembly {in the output.release.yml/ci.ymlheaders,README.md,toolchain.env) no longer say libid-contracts regenerates verifiers; README "Consuming a release" states the new flow: download, check sha256,forge fmt, compile.Verified
scripts/build.shunder nargo 1.0.0-beta.25 + bb 5.2.0 (arm64 macOS):BearerLinkHonkVerifier.sol104011 B,OidcGoogleHonkVerifier.sol104013 B; one concrete contract each; 5/5assemblyblocks memory-safe; vk hashes unchanged from the README table.--out <dir>(the CI path) and default output byte-identical;gen-verifier.sh --artifacts <unpacked>regenerates a byte-identical.solfrom the vk alone.circuits/bearer-linkis moved;shellcheckclean.release.ymlrun locally over the new layout:<Contract>.solappears in each tarball'sfilesmap.Not verified / known issues
release.ymlend to end: it only runs on a published release; its packaging logic is untouched. The GNU-tar step could not be simulated on macOS.forge fmt/forge buildof the shipped.sol: no Foundry toolchain here by design; the consumer's CI covers it.