Repository navigation
Ship cosigner v0.1.1, and build the dev enclave image - #2
Merged
Merged
Conversation
The cosigner is vtxos/cosigner's now, released as cosigner.wasm. A release here takes those exact bytes, pinned by tag and sha256 in pins.env, instead of cloning the wallet and building with whatever stable was that day. MerlinPlatform must build against the same tag. dev-enclave/ is the image a wallet's e2e boots from compose: enclave-runtime's QEMU dev bundle and that cosigner in one container, both pinned here. The harness inside is the runtime's dev-enclave.sh, unmodified; it drives the host's Docker, so the bundle runs from a host directory mounted at its own path. The workflow boots each image on the runner's KVM before pushing it, and prints the digest to pin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…v0.1.1 The runtime no longer publishes dev bundles. The image's build.sh checks out the runtime at DEV_RUNTIME_REV and packs the bundle itself (dev-enclave.sh --pack). Same commit, same image: the runtime builds its enclave image the same on every machine, and packing bf5f804 here gives PCR0 458969f7, as the runtime's own CI does. The cosigner is v0.1.1, the first release built by Nix, which anyone can rebuild from its tag and compare. MerlinPlatform moves to the commit that builds against it. The entrypoint opens up the bundle it copies into the host directory: it copies as root, and the host user has to be able to clear it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aruokhai
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The cosigner moved to vtxos/cosigner. It releases
cosigner.wasmbuilt by Nix, and anyone can rebuild a release from its tag and get the same bytes. This repo ships that release and builds the dev enclave image the wallet's e2e runs.pins.envCOSIGNER_RELEASE=v0.1.1and its sha256 (e3d704c3…). These replaceMERLINWALLET_REV.MERLINPLATFORM_REVpoints at vtxos/platform's merge, which builds againstv0.1.1.DEV_RUNTIME_REVis the vtxos/runtime commit the dev image packs from (bf5f804, runtime main). The runtime no longer publishes dev bundles.release.ymlstable.vtxos/cosignerat the same tag.dev-enclave/builds the image: the runtime's QEMU dev bundle and the released cosigner in one container.build.shchecks out the runtime atDEV_RUNTIME_REVand packs the bundle itself (dev-enclave.sh --pack).dev-enclave.sh, unmodified. It drives the host's Docker, so the bundle runs from a host directory mounted at the same path inside the container.compose.ymldocuments how it runs: host network,/dev/kvmand/dev/vsock, the Docker socket, andseccomp:unconfinedforAF_VSOCK. It's dev only.dev-enclave-image.ymlboots each image on the runner's KVM before pushingghcr.io/vtxos/dev-enclave:cosigner-<release>-runtime-<rev>, and prints the digest for the wallet to pin.What was run (on a KVM workstation)
dev-enclave/build.shpacks runtimebf5f804to PCR0458969f7…, the same value the runtime's own CI builds. The runtime image is reproducible across machines as of Build the same enclave image on every machine runtime#7.v0.1.1and checks its sha256.compose.yml, anddownleaves no harness containers behind.After merge
ghcr.io/vtxos/dev-enclavepackage public once, so the wallet's CI can pull it.c2ea60e(flake.lock), which predates telemetry, and cosignerv0.1.1importsenclave:telemetry. The next production release needs the runtime raised to at leastc4a0b96. A new PCR0 or PCR16 also means a store the locked key policy allows.🤖 Generated with Claude Code