Merge pull request #1135 from 0xPolygonHermez/develop

Merge develop (1.0.0-alpha) into main
-------------
Co-authored-by: Xavier Pinsach <10213118+xavi-pinsach@users.noreply.github.com>
Co-authored-by: agnusmor <agnusmor@gmail.com>
Co-authored-by: zkronos73 <zkronos73@gmail.com>
Co-authored-by: Roger Taulé Buxadera <55488871+RogerTaule@users.noreply.github.com>
Co-authored-by: zkronos73 <94566827+zkronos73@users.noreply.github.com>
Co-authored-by: RogerTaule <roger.taulee@gmail.com>
Co-authored-by: Héctor Masip Ardevol <hmasip@polygon.technology>
Co-authored-by: rickb80 <75077385+rickb80@users.noreply.github.com>
Co-authored-by: fractasy <fractasy@gmail.com>
Co-authored-by: jestape <jestape@proton.me>

Author: 8 people

.cargo/config.toml

@@ -0,0 +1,14 @@
+# Export the host binary's symbols to dlopen'd plugins.
+#
+# Proving-key `.so` files (e.g. `recursive1.so`) reference GMP symbols but
+# do not list libgmp in their `DT_NEEDED` — they expect the loading process
+# to already provide GMP. Without `--export-dynamic`, Rust binaries do not
+# expose their statically-linked symbols to libraries opened via `dlopen`,
+# causing runtime errors like:
+#
+#   symbol lookup error: .../recursive1.so: undefined symbol: __gmpz_init_set_ui
+#
+# Linux-only: macOS uses a different export model and the affected `.so`
+# files are Linux-targeted anyway.
+[target.'cfg(target_os = "linux")']
+rustflags = ["-C", "link-arg=-Wl,--export-dynamic"]

.github/scripts/zisk_cycle_diff.py

@@ -57,12 +57,16 @@ def delta(b, p):
     if b is None or p is None:
         return "N/A"
     d = p - b
-    if d == 0:
-        return "➖ 0.00%"
     if b == 0:
+        if d == 0:
+            return "➖ 0.00%"
         return "🔴 new" if d > 0 else "🟢 —"
+    pct = d / b * 100
+    # A diff that rounds to 0.00% is reported as no-change.
+    if round(pct, 2) == 0:
+        return "➖ 0.00%"
     dot = "🔴" if d > 0 else "🟢"
-    return f"{dot} {d / b * 100:+.2f}%"
+    return f"{dot} {pct:+.2f}%"
 
 
 def summary(rows):

.github/workflows/book.yml

@@ -12,6 +12,9 @@ on:
       - "book/**"
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   # test:
   #   runs-on: ubuntu-latest

.github/workflows/cycle-tracking.yml

@@ -29,7 +29,6 @@ jobs:
     timeout-minutes: 120
     env:
       CARGO_NET_GIT_FETCH_WITH_CLI: "true"
-      WS: ${{ github.workspace }}/.zk-setup
     steps:
       - name: "Free disk space"
         uses: jlumbroso/free-disk-space@v1.3.1

.github/workflows/lib_float_repro.yml

@@ -1,10 +1,11 @@
 name: lib-float reproducibility
 
-# Guards the reproducibility of lib-float's artifacts. ziskfloat.elf is compiled
-# inside a pinned Docker image (lib-float/c/docker/Dockerfile) and feeds the
-# program vk via include_bytes! in core/src/elf2rom.rs, so its bytes must be
-# both deterministic (same image -> same bytes) and stable unless changed
-# deliberately (locked by the committed per-artifact lib-float/c/*.md5).
+# Guards the reproducibility of lib-float's committed artifacts. ziskfloat.elf is
+# compiled inside a pinned Docker image (lib-float/c/docker/Dockerfile) and feeds
+# the program vk via include_bytes! in core/src/elf2rom.rs. This job rebuilds the
+# artifacts from source in that image and fails if the result differs from the
+# committed lib-float/c/lib/ziskfloat.elf and libziskfloat.a — i.e. the committed
+# binaries must be byte-identical to a fresh reproducible build.
 
 on:
   pull_request:
@@ -36,30 +37,17 @@ jobs:
       - name: Checkout sources
         uses: actions/checkout@v4
 
-      - name: Build in pinned Docker image (run 1)
+      - name: Rebuild artifacts in the pinned Docker image
         run: |
           set -euxo pipefail
           make clean
           make docker
-          md5sum lib/ziskfloat.elf lib/libziskfloat.a > "$RUNNER_TEMP/run1.md5"
 
-      - name: Rebuild from scratch (run 2) and assert determinism
-        run: |
-          set -euxo pipefail
-          make clean
-          make docker
-          md5sum lib/ziskfloat.elf lib/libziskfloat.a > "$RUNNER_TEMP/run2.md5"
-          if ! diff -u "$RUNNER_TEMP/run1.md5" "$RUNNER_TEMP/run2.md5"; then
-            echo "::error::Non-deterministic build: two clean builds in the pinned image produced different artifacts."
-            exit 1
-          fi
-          echo "Determinism OK: both clean builds produced identical artifacts."
-
-      - name: Verify artifacts match md5 references
+      - name: Verify committed artifacts match built artifacts
         run: |
           set -euo pipefail
-          if ! make check-hashes; then
-            echo "::error::ziskfloat artifacts changed vs the committed lib-float/c/*.md5 -> the code has changed. If this is intended, run 'make -C lib-float/c docker && make -C lib-float/c update-hashes' and commit the updated lib-float/c/*.md5 in this PR."
+          if ! git diff --exit-code -- lib/ziskfloat.elf lib/libziskfloat.a; then
+            echo "::error::Committed lib-float/c/lib artifacts differ from built artifacts in the pinned Docker image -> If this is intended, run 'make -C lib-float/c docker' and commit the updated lib-float/c/lib/ziskfloat.elf and libziskfloat.a in this PR."
             exit 1
           fi
-          echo "OK: artifacts match the committed c/*.md5 files."
+          echo "OK: committed ziskfloat.elf / libziskfloat.a match built artifacts."

.github/workflows/pr.yml

@@ -5,7 +5,7 @@ on:
     branches:
       - develop
       - main
-      - "pre-develop-[0-9]+.[0-9]+.[0-9]+"
+      - "pre-develop-[0-9]+.[0-9]+.[0-9]*"
     paths-ignore:
       - 'book/**'
   workflow_dispatch:
@@ -14,39 +14,117 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   cargo-tests:
     name: Cargo tests
-    runs-on: ubuntu-latest
+    runs-on: rocket
+    container:
+      image: ubuntu:22.04
     env:
       CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4
 
       - name: Install dependencies
         run: |
           cd "$GITHUB_WORKSPACE/tools/test-env"
-          sudo ./install_deps.sh
+          ./install_deps.sh
+
+      - name: Add Cargo to PATH
+        # install_deps.sh already installs Rust via rustup into ~/.cargo/bin;
+        # just expose it to subsequent steps.
+        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Show versions
+        run: |
+          rustc --version
+          cargo --version
+
+      - name: Build cargo-zisk
+        run: cargo build --bin cargo-zisk
+
+      - name: Install ZisK rust toolchain
+        run: ./target/debug/cargo-zisk toolchain install
 
       - name: Run cargo check
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --all-targets # --all-features
+        run: cargo check --all-targets
 
       - name: Run cargo test
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --release
+        run: cargo test --workspace --release
         env:
           RUSTFLAGS: -Copt-level=3 -Cdebug-assertions -Coverflow-checks=y -Cdebuginfo=0 -C target-cpu=native
           RUST_BACKTRACE: 1
 
+  zisk-contracts:
+    name: Hardhat tests (zisk-contracts)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+
+      - name: Install system dependencies
+        run: |
+          cd "$GITHUB_WORKSPACE/tools/test-env"
+          sudo ./install_deps.sh
+
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+
+      - name: Build cargo-zisk-dev
+        run: cargo build --release -p cargo-zisk --bin cargo-zisk-dev
+
+      - name: Generate Solidity calldata fixture
+        working-directory: zisk-contracts
+        run: ../target/release/cargo-zisk-dev export-solidity-calldata -p test/plonk_proof.bin -o fixtures/fixture.json
+
+      - name: Install JS dependencies
+        working-directory: zisk-contracts
+        run: npm install --no-audit --no-fund
+
+      - name: Run Hardhat test
+        working-directory: zisk-contracts
+        env:
+          ZISK_SOLIDITY_FIXTURE: fixtures/fixture.json
+        run: npx hardhat test
+
+  build-riscv64im:
+    name: Build ziskos-staticlib (riscv64im-unknown-none-elf)
+    runs-on: ubuntu-latest
+    env:
+      CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+
+      - name: Install Rust nightly with rust-src
+        # riscv64im-unknown-none-elf is a Tier 3 target — no pre-built std is available.
+        # rust-src is required so that -Z build-std can compile core/alloc from source.
+        # No cross-compiler is needed; Rust uses its bundled rust-lld linker.
+        run: rustup toolchain install nightly --component rust-src --no-self-update
+
+      - name: Build ziskos-staticlib for riscv64im-unknown-none-elf
+        run: cargo +nightly build -p ziskos-staticlib --release --target riscv64im-unknown-none-elf -Z build-std=core,alloc --config 'profile.release.lto="fat"' --features panic-handler
+        env:
+          RUSTFLAGS: "-D warnings"
+
   test-x86_64:
     name: Test on Ubuntu x86_64
-    runs-on: gpu-hosted
+    runs-on:
+      group: zisk-gpu
     timeout-minutes: 180
     # NOTE: We intentionally use 'docker exec' in individual steps rather than
     # defining a job-level container. The test scripts deploy systemd services
@@ -73,6 +151,12 @@ jobs:
           sudo chown -R 1000:1000 "$GITHUB_WORKSPACE"
           sudo chmod -R u+rwX "$GITHUB_WORKSPACE"
 
+      - name: Prepare cache-setup directory
+        run: |
+          sudo mkdir -p /home/gha/cache-setup
+          sudo chown -R 1000:1000 /home/gha/cache-setup
+          sudo chmod -R u+rwX /home/gha/cache-setup
+
       - name: Start test container with systemd
         run: |
           docker rm -f "${TEST_CONTAINER}" || true
@@ -88,7 +172,6 @@ jobs:
             -v /home/gha/cache-setup:/home/ziskuser/output:rw \
             -e ZISK_GHA=1 \
             -e ZISK_REPO_DIR=/workspace/zisk \
-            -e ZISK_TESTVECTORS_BRANCH="${ZISK_TESTVECTORS_BRANCH}" \
             -e PROVE_FLAGS=-y \
             -e TERM=xterm \
             ziskvm/zisk-runner-gpu:latest \
@@ -110,6 +193,24 @@ jobs:
             systemctl is-system-running || true
           '
 
+          # Wait for the in-container Docker daemon (started by systemd) to be
+          # ready. lib-float/build.rs invokes `docker` early in the build, so it
+          # must be up before the "Build ZisK" step runs.
+          echo "Waiting for in-container Docker daemon..."
+          for i in $(seq 1 30); do
+            if docker exec -u ziskuser "${TEST_CONTAINER}" docker info >/dev/null 2>&1; then
+              echo "Docker daemon is ready."
+              break
+            fi
+            if [ "$i" -eq 30 ]; then
+              echo "Docker daemon did not become ready in time"
+              docker exec "${TEST_CONTAINER}" systemctl status docker.service --no-pager || true
+              docker exec "${TEST_CONTAINER}" journalctl -u docker.service --no-pager -n 50 || true
+              exit 1
+            fi
+            sleep 2
+          done
+
       - name: Build ZisK
         run: |
           .github/scripts/docker_exec.sh \
@@ -168,12 +269,20 @@ jobs:
               ./test_diagnostic.sh
             '
 
+      - name: Build zec-reth ELF file
+        run: |
+          .github/scripts/docker_exec.sh \
+            -u ziskuser \
+            -- bash -lc '
+              cd /workspace/zisk/tools/test-env
+              ./build_zec_reth.sh
+            '
+
       - name: Prove Ethereum block
         run: |
           .github/scripts/docker_exec.sh \
             -u ziskuser \
             -e BLOCK_INPUTS_SINGLE="mainnet_24628607_66_7_zec_reth.bin,mainnet_24626900_221_16_zec_reth.bin" \
-            -e ZISK_ETH_CLIENT_BRANCH="${ZISK_ETH_CLIENT_BRANCH}" \
             -- bash -lc '
               cd /workspace/zisk/tools/test-env
               ./test_eth_block.sh
@@ -184,8 +293,6 @@ jobs:
           .github/scripts/docker_exec.sh \
             -u ziskuser \
             -e BLOCK_INPUTS_ETHPROOFS="mainnet_24628595_641_54_zec_reth.bin,mainnet_24697073_308_22_zec_reth.bin" \
-            -e ZISK_ETHPROOFS_BRANCH="${ZISK_ETHPROOFS_BRANCH}" \
-            -e ZISK_ETH_CLIENT_BRANCH="${ZISK_ETH_CLIENT_BRANCH}" \
             -- bash -lc '
               cd /workspace/zisk/tools/test-env
               ./test_ethproofs.sh
@@ -195,8 +302,6 @@ jobs:
         run: |
           .github/scripts/docker_exec.sh \
             -u ziskuser \
-            -e ZISK_ETHPROOFS_BRANCH="${ZISK_ETHPROOFS_BRANCH}" \
-            -e ZISK_ETH_CLIENT_BRANCH="${ZISK_ETH_CLIENT_BRANCH}" \
             -e ENABLE_HINTS="1" \
             -- bash -lc '
               cd /workspace/zisk/tools/test-env
@@ -213,7 +318,7 @@ jobs:
   test-macos:
     name: Test on macOS
     runs-on: macos-14
-    timeout-minutes: 30
+    timeout-minutes: 45
     defaults:
       run:
         shell: bash
@@ -238,6 +343,11 @@ jobs:
           cd "$GITHUB_WORKSPACE/tools/test-env"
           ./build_zisk.sh
 
+      - name: Build zec-reth ELF file
+        run: |
+          cd "$GITHUB_WORKSPACE/tools/test-env"
+          ./build_zec_reth.sh
+
       - name: Test sha_hasher
         run: |
           cd "$GITHUB_WORKSPACE/tools/test-env"
@@ -283,6 +393,15 @@ jobs:
         env:
           CARGO_INCREMENTAL: 1
 
+      - name: Build cargo-zisk
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --bin cargo-zisk
+
+      - name: Install ZisK rust toolchain
+        run: ./target/debug/cargo-zisk toolchain install
+
       - name: Run cargo clippy
         uses: actions-rs/cargo@v1
         with:

.github/workflows/pr_emulator.yml

@@ -5,7 +5,7 @@ on:
     branches:
       - develop
       - main
-      - "pre-develop-[0-9]+.[0-9]+.[0-9]+"
+      - "pre-develop-[0-9]+.[0-9]+.[0-9]*"
     paths:
       - "emulator/**"
       - "emulator-asm/**"
@@ -19,6 +19,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   riscof-elf-tests-rust:
     name: Riscof ELF tests (rust emulator)