Merge develop (0.18.0) into main

.github/scripts/check-libziskos.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+. "$HOME/.cargo/env"
+
+FAIL=0
+TARGET=riscv64ima-zisk-zkvm-elf
+
+cargo +zisk build -p ziskos-staticlib --release \
+  --target "$TARGET" \
+  --config 'profile.release.lto="fat"'
+
+LIBZISKOS=$(find target -name "libziskos_staticlib.a" -path "*$TARGET*" | head -1)
+if [ -z "$LIBZISKOS" ]; then
+  echo "FAIL: libziskos_staticlib.a not found"
+  exit 1
+fi
+
+# Check that std is not bundled
+if ar t "$LIBZISKOS" | grep -q std; then
+  echo "FAIL: libziskos_staticlib.a contains std object files:"
+  ar t "$LIBZISKOS" | grep std
+  FAIL=1
+else
+  echo "OK: no std object files bundled"
+fi
+
+# Use llvm-nm from the zisk toolchain sysroot to avoid LLVM version mismatches
+# when reading bitcode objects produced by lto="fat".
+rustup component add llvm-tools --toolchain zisk 2>/dev/null || true
+LLVM_NM=$(rustup run zisk sh -c 'find "$(rustc --print sysroot)" -name "llvm-nm" -type f | head -1')
+if [[ -z "$LLVM_NM" ]]; then
+  echo "FAIL: llvm-nm not found in zisk toolchain sysroot"
+  exit 1
+fi
+echo "Using llvm-nm: $LLVM_NM"
+
+NM_OUTPUT=$("$LLVM_NM" "$LIBZISKOS" 2>/dev/null || true)
+if [[ -z "$NM_OUTPUT" ]]; then
+  echo "FAIL: llvm-nm produced no output for $LIBZISKOS"
+  exit 1
+fi
+
+REQUIRED_SYMBOLS=(
+  _start
+  read_input
+  write_output
+  zkvm_init
+  zkvm_deinit
+  zkvm_keccak256
+  zkvm_sha256
+  zkvm_secp256k1_ecrecover
+  zkvm_secp256k1_verify
+  zkvm_secp256r1_verify
+  zkvm_bn254_g1_add
+  zkvm_bn254_g1_mul
+  zkvm_bn254_pairing
+  zkvm_bls12_g1_add
+  zkvm_bls12_g1_msm
+  zkvm_bls12_g2_add
+  zkvm_bls12_g2_msm
+  zkvm_bls12_pairing
+  zkvm_bls12_map_fp_to_g1
+  zkvm_bls12_map_fp2_to_g2
+  zkvm_blake2f
+  zkvm_ripemd160
+  zkvm_modexp
+  zkvm_kzg_point_eval
+)
+
+for SYM in "${REQUIRED_SYMBOLS[@]}"; do
+  if ! grep -qE " T $SYM$" <<< "$NM_OUTPUT"; then
+    echo "FAIL: missing symbol: $SYM"
+    FAIL=1
+  fi
+done
+
+if [ "$FAIL" -eq 0 ]; then
+  echo "OK: libziskos_staticlib.a passes all checks"
+else
+  exit "$FAIL"
+fi

.github/scripts/docker_exec.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Wrapper for 'docker exec' with cancellation support.
+# When SIGINT/SIGTERM is received (e.g. from a GitHub Actions job cancellation),
+# it forcefully removes the container so the runner step exits immediately
+# instead of blocking until the docker exec command finishes on its own.
+#
+# The container name is read from the TEST_CONTAINER environment variable.
+# Use '--' to separate docker exec options from the command:
+#
+# Usage: docker_exec.sh [docker exec options] -- COMMAND [ARGS...]
+#   e.g. docker_exec.sh -u myuser -e VAR=val -- bash -lc 'echo hello'
+set -e
+
+if [[ -z "${TEST_CONTAINER:-}" ]]; then
+    echo "ERROR: TEST_CONTAINER environment variable is not set" >&2
+    exit 1
+fi
+
+# Split args into docker exec options (before --) and command (after --)
+EXEC_OPTS=()
+while [[ $# -gt 0 && "$1" != "--" ]]; do
+    EXEC_OPTS+=("$1")
+    shift
+done
+shift  # remove --
+
+_cleanup() {
+    echo "Signal received — stopping container ${TEST_CONTAINER}..."
+    docker rm -f "${TEST_CONTAINER}" 2>/dev/null || true
+}
+trap _cleanup INT TERM
+
+# Run the command in the container
+docker exec "${EXEC_OPTS[@]}" "${TEST_CONTAINER}" "$@" &
+wait $!

.github/workflows/pr.yml

@@ -46,72 +46,169 @@ jobs:
 
   test-x86_64:
     name: Test on Ubuntu x86_64
-    runs-on: self-hosted
+    runs-on: gpu-hosted
     timeout-minutes: 180
-    container:
-      image: ubuntu:22.04
-      options:
-        --shm-size=48g
-        -v /home/gha/cache-setup:/github/home/output:rw
+    # NOTE: We intentionally use 'docker exec' in individual steps rather than
+    # defining a job-level container. The test scripts deploy systemd services
+    # (zisk-coordinator, zisk-worker) inside the container, which requires
+    # systemd as PID 1 and a fully privileged environment. GitHub Actions
+    # job-level containers do not support this setup.
     defaults:
       run:
         shell: bash
     env:
-      ZISK_GHA: "1"
-      ZISK_REPO_DIR: ${{ github.workspace }}
-      ZISK_TESTVECTORS_BRANCH: "develop-0.3.0"
-      DISTRIBUTED_PROCESSES: "2"
-      DISTRIBUTED_THREADS: "64"
-      PROVE_FLAGS: "-y"
-      TERM: xterm
+      TEST_CONTAINER: zisk-gha-test
+
     steps:
+      - name: Fix workspace permissions
+        run: |
+          sudo chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE" || true
+          sudo chmod -R u+rwX "$GITHUB_WORKSPACE" || true
+
       - name: Checkout sources
         uses: actions/checkout@v4
 
-      - name: Install dependencies
+      - name: Give workspace ownership to container user
         run: |
-          cd "$GITHUB_WORKSPACE/tools/test-env"
-          ./install_deps.sh
+          sudo chown -R 1000:1000 "$GITHUB_WORKSPACE"
+          sudo chmod -R u+rwX "$GITHUB_WORKSPACE"
+
+      - name: Start test container with systemd
+        run: |
+          docker rm -f "${TEST_CONTAINER}" || true
+
+          docker run -d \
+            --name "${TEST_CONTAINER}" \
+            --privileged \
+            --cgroupns=host \
+            --gpus all \
+            --shm-size=48g \
+            -v /sys/fs/cgroup:/sys/fs/cgroup:rw \
+            -v "$GITHUB_WORKSPACE":/workspace/zisk:rw \
+            -v /home/gha/cache-setup:/home/ziskuser/output:rw \
+            -e ZISK_GHA=1 \
+            -e ZISK_REPO_DIR=/workspace/zisk \
+            -e ZISK_TESTVECTORS_BRANCH="${ZISK_TESTVECTORS_BRANCH}" \
+            -e PROVE_FLAGS=-y \
+            -e TERM=xterm \
+            ziskvm/zisk-runner-gpu:latest \
+            /sbin/init
+
+          sleep 3
+
+          if ! docker ps --format '{{.Names}}' | grep -q "^${TEST_CONTAINER}$"; then
+            echo "Container stopped unexpectedly"
+            docker ps -a
+            docker logs "${TEST_CONTAINER}" || true
+            docker inspect "${TEST_CONTAINER}" --format '{{.State.ExitCode}} {{.State.Error}}' || true
+            exit 1
+          fi
+
+          docker exec "${TEST_CONTAINER}" bash -lc '
+            echo "PID 1:"
+            ps -p 1 -o pid,comm,args
+            systemctl is-system-running || true
+          '
 
       - name: Build ZisK
         run: |
-          cd "$GITHUB_WORKSPACE/tools/test-env"
-          ./build_zisk.sh
+          .github/scripts/docker_exec.sh \
+            -u ziskuser \
+            -- bash -lc '
+              cd /workspace/zisk/tools/test-env
+              ./build_zisk.sh
+            '
+
+      - name: Check libziskos.a does not bundle std and contains required symbols
+        run: |
+          docker cp .github/scripts/check-libziskos.sh "${TEST_CONTAINER}:/home/ziskuser/check-libziskos.sh"
+          docker exec "${TEST_CONTAINER}" chmod +x /home/ziskuser/check-libziskos.sh
+          .github/scripts/docker_exec.sh \
+            -u ziskuser \
+            -- bash -lc '
+              cd /workspace/zisk
+              /home/ziskuser/check-libziskos.sh
+            '
 
       - name: Build setup
-        env:
-          USE_CACHE_SETUP: "1"
         run: |
-          cd "$GITHUB_WORKSPACE/tools/test-env"
-          ./build_setup.sh
+          .github/scripts/docker_exec.sh \
+            -u ziskuser \
+            -e USE_CACHE_SETUP="1" \
+            -- bash -lc '
+              cd /workspace/zisk/tools/test-env
+              ./build_setup.sh
+            '
 
-      - name: Test sha_hasher
-        env:
-          ZISK_TEMPLATE_BRANCH: "pre-develop-0.17.0"
+      - name: Test sha_hasher (CPU)
         run: |
-          cd "$GITHUB_WORKSPACE/tools/test-env"
-          ./test_sha_hasher.sh
+          .github/scripts/docker_exec.sh \
+            -u ziskuser \
+            -e ONLY_CPU="1" \
+            -- bash -lc '
+              cd /workspace/zisk/tools/test-env
+              ./test_sha_hasher.sh
+            '
 
-      - name: Test ELF diagnostic
+      - name: Test sha_hasher (GPU)
         run: |
-          cd "$GITHUB_WORKSPACE/tools/test-env"
-          ./test_diagnostic.sh
+          .github/scripts/docker_exec.sh \
+            -u ziskuser \
+            -- bash -lc '
+              cd /workspace/zisk/tools/test-env
+              ./test_sha_hasher.sh
+            '
 
-      - name: Verify Constraints Ethereum block
-        env:
-          DISABLE_PROVE: "1"
-          BLOCK_INPUTS: "mainnet_24626900_221_16_zec_reth.bin"
+      - name: Test ELF diagnostic
         run: |
-          cd "$GITHUB_WORKSPACE/tools/test-env"
-          ./test_eth_block.sh
+          .github/scripts/docker_exec.sh \
+            -u ziskuser \
+            -- bash -lc '
+              cd /workspace/zisk/tools/test-env
+              ./test_diagnostic.sh
+            '
 
       - name: Prove Ethereum block
-        env:
-          DISABLE_ROM_SETUP: "1"
-          BLOCK_INPUTS_DISTRIBUTED: "mainnet_24628607_66_7_zec_reth.bin"
         run: |
-          cd "$GITHUB_WORKSPACE/tools/test-env"
-          ./test_eth_block.sh
+          .github/scripts/docker_exec.sh \
+            -u ziskuser \
+            -e BLOCK_INPUTS_SINGLE="mainnet_24628607_66_7_zec_reth.bin,mainnet_24626900_221_16_zec_reth.bin" \
+            -e ZISK_ETH_CLIENT_BRANCH="${ZISK_ETH_CLIENT_BRANCH}" \
+            -- bash -lc '
+              cd /workspace/zisk/tools/test-env
+              ./test_eth_block.sh
+            '
+
+      - name: Ethproofs test (no hints)
+        run: |
+          .github/scripts/docker_exec.sh \
+            -u ziskuser \
+            -e BLOCK_INPUTS_ETHPROOFS="mainnet_24628595_641_54_zec_reth.bin,mainnet_24697073_308_22_zec_reth.bin" \
+            -e ZISK_ETHPROOFS_BRANCH="${ZISK_ETHPROOFS_BRANCH}" \
+            -e ZISK_ETH_CLIENT_BRANCH="${ZISK_ETH_CLIENT_BRANCH}" \
+            -- bash -lc '
+              cd /workspace/zisk/tools/test-env
+              ./test_ethproofs.sh
+            '
+
+      - name: Ethproofs test (hints)
+        run: |
+          .github/scripts/docker_exec.sh \
+            -u ziskuser \
+            -e ZISK_ETHPROOFS_BRANCH="${ZISK_ETHPROOFS_BRANCH}" \
+            -e ZISK_ETH_CLIENT_BRANCH="${ZISK_ETH_CLIENT_BRANCH}" \
+            -e ENABLE_HINTS="1" \
+            -- bash -lc '
+              cd /workspace/zisk/tools/test-env
+              ./test_ethproofs.sh
+            '
+
+      - name: Stop test container
+        if: always()
+        run: |
+          docker rm -f "${TEST_CONTAINER}" || true
+          sudo chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE" || true
+          sudo chmod -R u+rwX "$GITHUB_WORKSPACE" || true
 
   test-macos:
     name: Test on macOS
@@ -142,8 +239,6 @@ jobs:
           ./build_zisk.sh
 
       - name: Test sha_hasher
-        env:
-          ZISK_TEMPLATE_BRANCH: "pre-develop-0.17.0"
         run: |
           cd "$GITHUB_WORKSPACE/tools/test-env"
           ./test_sha_hasher.sh

.github/workflows/release.yml

@@ -135,10 +135,10 @@ jobs:
         if: matrix.platform == 'linux'
         shell: bash
         run: |
-            tmp_log=$(mktemp)
-            cargo build --release --target "${{ matrix.target }}" -vv 2>&1 | tee "${tmp_log}"
-            if ! grep -qi "STARKS compiled with GPU support" "${tmp_log}"; then
-              echo "Error: Zisk built without GPU support, aborting."
+            CUDA_ARCHS="major" cargo build --release --target "${{ matrix.target }}"
+            version_output=$(./target/${{ matrix.target }}/release/cargo-zisk --version)
+            if ! echo "${version_output}" | grep -qi "\[gpu\]"; then
+              echo "Error: Zisk built without GPU support, aborting. Version: ${version_output}"
               exit 1
             fi