Docker reproducible builds, more VE content (#34)

* fix #28 - add talk on VE
* docker reproducible builds
* shitty workaround for sp1 tooling :-(

Author: nuke-web3

Cargo.lock

@@ -22,11 +22,10 @@ sp1-zkvm = "5.0"
 sp1-sdk = "5.0"
 sp1-build = "5.0"
 chacha20 = "0.9"
-jsonrpsee = { version = "0.24", features = ["macros", "server", "http-client"] }
+jsonrpsee = { version = "0.25", features = ["macros", "server", "http-client"] }
 serde = { version = "1.0", default-features = false, features = ["derive"] }
 serde_json = "1.0"
 tokio = { version = "1", features = ["full"] }
-tonic = { version = "0.12", default-features = false }
 celestia-types = "0.11"
 dotenv = "0.15"
 hyper-rustls = "0.27.6"
@@ -48,3 +47,6 @@ rustls-pemfile = "2.2"
 [patch.crates-io]
 # TODO: update to 5.0?
 sha2 = { git = "https://github.com/sp1-patches/RustCrypto-hashes", tag = "patch-sha2-0.10.8-sp1-4.0.0" }
+
+[workspace.features]
+reproducible-elf = ["service/reproducible-elf"]

Cargo.toml

@@ -1,12 +1,12 @@
 #  Base with Rust, Go, CUDA, SP1, and cargo-chef
-FROM nvidia/cuda:12.8.1-devel-ubuntu24.04 AS base-dev
+FROM nvidia/cuda:12.9.1-devel-ubuntu24.04 AS base-dev
 
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive \
   apt-get install --no-install-recommends -y \
   clang libclang-dev docker.io curl tar build-essential pkg-config git ca-certificates gnupg2 \
   && rm -rf /var/lib/apt/lists/*
 
-ENV GO_VERSION=1.22.0
+ENV GO_VERSION=1.24.4
 ENV GO_URL="https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz"
 RUN curl -L --proto '=https' --tlsv1.2 -sSf ${GO_URL} -o go.tar.gz && \
     mkdir -p /opt/go && \
@@ -49,17 +49,18 @@ RUN --mount=type=cache,id=target_cache,target=/app/target \
 COPY . .
 
 # Build SP1 ELF to be proven (with optimizations)
+# TODO: need to use `cargo prove --docker` for repoducible builds?
 RUN --mount=type=cache,id=target_cache,target=/app/target \
-  /root/.sp1/bin/cargo-prove prove build -p chacha-program
-
+  RUSTFLAGS="-Copt-level=3 -Clto=fat -Ccodegen-units=1 -Cdebuginfo=1 -Cembed-bitcode=yes" /root/.sp1/bin/cargo-prove prove build -p chacha-program
 # Build the final binary
+# NOTE: default feature is to use --docker ELF
 RUN --mount=type=cache,id=target_cache,target=/app/target \
-  cargo build --release && \
+  cargo build --release --no-default-features && \
   strip /app/target/release/pda-proxy && \
   cp target/release/pda-proxy /app/pda-proxy # pop out of cache
 
 ####################################################################################################
-FROM nvidia/cuda:12.8.1-base-ubuntu24.04 AS runtime
+FROM nvidia/cuda:12.9.1-base-ubuntu24.04 AS runtime
 
 # SP1 CUDA support needs Docker-in-Docker to run `moongate-server` prover service
 # Internally run on localhost:3000

Dockerfile

@@ -1,5 +1,21 @@
 # Verifiable Encryption
 
+<figure align="center">
+  <iframe
+    width="560"
+    height="315"
+    src="https://www.youtube.com/embed/6P7yWZ4Cshs?si=RzSswRKxYD-gFa7T"
+    title="YouTube video player"
+    frameborder="0"
+    allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
+    referrerpolicy="strict-origin-when-cross-origin"
+    allowfullscreen>
+  </iframe>
+  <figcaption>
+     May 2025 overview talk - <a href="https://hackmd.io/@Nuke/SyHBUsdWlg">Slides here</a>
+  </figcaption>
+</figure>
+
 ### _A New Primitive Empowering Private Data Availability_
 
 > “Don’t trust. Verify.”
@@ -64,7 +80,7 @@ In a world where chain data is globally replicated and indexed, **encryption at
 
 - **PDA as a database** for collaborative dApps with fine-grained access control.
 - **Private rollups** with programmable cryptography, enabling [obfuscated state](https://0xparc.org/blog/programmable-cryptography-1).
-- **Private bridging and escrow** sending verifibly correctm but private messages around web2 and/or web3 apps.
+- **Private bridging and escrow** sending verifiably correct but private messages around web2 and/or web3 apps.
 - **Drop-in support** for existing DA users via a [proxy service](../README.md), simplifying migration to PDA.
 
 ### _Trustless Data Markets_
@@ -76,7 +92,7 @@ Here is a [diagram inspired by them](https://docs.google.com/presentation/d/1qq1
 
 ```mermaid
 flowchart LR
-    Data["Data to be Sold"] --> zkVM_Algo["zkVM(tranform media)"]
+    Data["Data to be Sold"] --> zkVM_Algo["zkVM(transform media)"]
     zkVM_Algo -- "proven data transform w/ VE anchor" --> Contract["Marketplace on <dApp chain>"]
     Data -- "VE data" --> Celestia["Celestia"]
     Celestia -- "header" --> Blobstream["Blobstream on <dApp chain>"]
@@ -85,7 +101,7 @@ flowchart LR
 
 ### _Verifiable Private Backups_
 
-> NOTE: Celestia does _not_ guarantee that data will be avalible forever!
+> NOTE: Celestia does _not_ guarantee that data will be available forever!
 > See [the docs on retrievability](https://docs.celestia.org/learn/retrievability#data-retrievability-and-pruning-in-celestia-node) for the latest safe assumptions to use.
 
 With PDA, sensitive data can be publicly published in encrypted form, with **predefined methods for recovery** - without revealing its contents.

doc/verifiable_encryption.md

@@ -60,7 +60,9 @@ PDA_PORT=26657
 # IMPORTANT: the prover programs *embed the ELF* into their own bin,
 # so this vat is only for development & compilation
 # NOTE: MUST USE FULL PATH, used in scripts, so relative will fail.
-ZK_PROGRAM_ELF_PATH=
+ZK_PROGRAM_ELF_PATH=/full/path/to/target/elf-compilation/release/riscv32im-succinct-zkvm-elf/release/chacha-program
+# See https://docs.succinct.xyz/docs/sp1/writing-programs/compiling#production-builds
+ZK_PROGRAM_REPRODUCIBLE_ELF_PATH=/full/path/to/target/elf-compilation/docker/riscv32im-succinct-zkvm-elf/release/chacha-program
 
 # 'mock' for generating mock proofs locally, 'cpu', 'cuda', or 'network'
 SP1_PROVER=cuda

example.env

@@ -30,7 +30,8 @@ initial-config-installs:
     @just sp1 initial-config-installs
 
 _pre-build:
-    @just sp1 build-elf
+    # ALWAYS build with docker
+    @just sp1 build-elf-reproducible
 
 _pre-run:
     echo "just pre-run TODO"
@@ -50,7 +51,7 @@ run-debug *FLAGS: _pre-build _pre-run
 
 # Build docker image & tag
 docker-build:
-    docker build --build-arg BUILDKIT_INLINE_CACHE=1 --tag "$DOCKER_CONTAINER_NAME" --progress=plain .
+    DOCKER_BUILDKIT=1 docker build --build-arg BUILDKIT_INLINE_CACHE=1 --tag "$DOCKER_CONTAINER_NAME" --progress=plain .
 
 # Save docker image to a tar.gz
 docker-save:

justfile

@@ -10,7 +10,6 @@ serde_json.workspace = true
 celestia-types.workspace = true
 jsonrpsee.workspace = true
 tokio.workspace = true
-tonic.workspace = true
 hyper = { workspace = true, features = ["http1", "server"] }
 hyper-util = { workspace = true, features = ["tokio"] }
 http-body-util.workspace = true
@@ -27,3 +26,8 @@ rustls.workspace = true
 tokio-rustls.workspace = true
 rustls-pemfile.workspace = true
 hyper-rustls.workspace = true
+
+[features]
+default = ["reproducible-elf"]
+
+reproducible-elf = []

service/Cargo.toml

@@ -12,9 +12,17 @@ use std::sync::Arc;
 use tokio::sync::{OnceCell, mpsc};
 
 /// Hardcoded ELF binary for the crate `program-keccak-inclusion`
-static CHACHA_ELF: &[u8] = include_bytes!(
+/// For reproducible builds, you need `cargo prove --docker`
+#[cfg(feature = "reproducible-elf")]
+pub const CHACHA_ELF: &[u8] = include_bytes!(
+    "../../../target/elf-compilation/docker/riscv32im-succinct-zkvm-elf/release/chacha-program"
+);
+
+#[cfg(not(feature = "reproducible-elf"))]
+pub const CHACHA_ELF: &[u8] = include_bytes!(
     "../../../target/elf-compilation/riscv32im-succinct-zkvm-elf/release/chacha-program"
 );
+
 /// Hardcoded ID for the crate `program-keccak-inclusion`
 static CHACHA_ID: OnceCell<SuccNetProgramId> = OnceCell::const_new();
 

service/src/internal/runner.rs

@@ -11,5 +11,6 @@ rand = { workspace = true, default-features = false, optional = true, features =
 sha2 = { workspace = true, optional = true }
 
 [features]
-default = ["std"]
+default = ["std", "reproducible-elf"]
 std = ["rand/os_rng", "sha2"]
+reproducible-elf = []

zkVM/common/Cargo.toml

@@ -1,5 +1,14 @@
 // Include the binary input file
-pub const INPUT_BYTES: &[u8] = include_bytes!("../../static/proof_input_example.bin");
+/// For reproducible builds, you need `cargo prove --docker`
+#[cfg(feature = "reproducible-elf")]
+pub const CHACHA_ELF: &[u8] = include_bytes!(
+    "../../../target/elf-compilation/docker/riscv32im-succinct-zkvm-elf/release/chacha-program"
+);
+
+#[cfg(not(feature = "reproducible-elf"))]
+pub const CHACHA_ELF: &[u8] = include_bytes!(
+    "../../../target/elf-compilation/riscv32im-succinct-zkvm-elf/release/chacha-program"
+);
 
 use chacha20::ChaCha20;
 use chacha20::cipher::{KeyIvInit, StreamCipher};