One toolchain across the estate. The tree carried 1.26.0, .1, .3, .4 and .5
at once, so which compiler built a binary depended on which repo it came
from.
Co-authored-by: Hanzo Dev <[email protected]>
The official golang images set GOTOOLCHAIN=local, so a base older than the
governing go.mod `go` directive fails hard instead of fetching a toolchain:
go: go.mod requires go >= 1.26.5 (running go 1.26.4; GOTOOLCHAIN=local)
docker/Dockerfile.multi-node sat on golang:1.24.5-alpine, two minor versions
under the root go.mod floor of 1.26.4. Dockerfile, deploy/testnet/Dockerfile
and Dockerfile.dvenue were at 1.26.4 — exactly at the floor, with no headroom.
Two orthogonal halves:
1. pin every Go builder base to the latest stable patch, 1.26.5, so the
images carry current compiler and stdlib security fixes;
2. set GOTOOLCHAIN=auto in every Go builder stage, so a future floor bump
downloads a checksum-verified toolchain rather than hard-failing.
Dockerfile and deploy/testnet already had it; multi-node and dvenue
did not.
Half 2 is not hypothetical here: sdk/lx-trading-go/go.mod already declares
go 1.26.5, above the root module's 1.26.4, so a submodule build under
GOTOOLCHAIN=local would die at exactly this error.
The root `go` directive stays at 1.26.4 on purpose — raising it pushes a hard
patch-level floor onto every consumer. A newer toolchain building an older
directive is always valid.
docs/Dockerfile is untouched: it builds static docs and compiles no Go.
Co-authored-by: Hanzo Dev <[email protected]>
The dex Docker builds set GOPRIVATE over our orgs, which routes those module
fetches `direct` (git) and bypasses sum.golang.org. After luxfi tags were
force-republished (e.g. luxfi/[email protected], luxfi/[email protected]) the git tag content
diverged from the immutable proxy/sumdb hash, so a `direct` fetch pulled bits
that no longer matched the canonical go.sum — failing image builds with a
checksum mismatch (or poisoning go.sum to the moved bits).
Resolving through the default public proxy + sumdb yields the canonical
immutable hash that matches go.sum and that a re-publish can no longer break —
the same model already adopted by lux/kms.
Supersedes f6b7ab9 ("GOPRIVATE must cover hanzos3 + all our orgs"): that was a
correct interim fix when github.com/hanzoai/vfs and github.com/hanzos3/go-sdk
were still private and unreachable through the public proxy. Both are now public
and sumdb-verifiable, so GOPRIVATE is no longer needed. Verified by a clean
(empty-GOMODCACHE) `go mod download all` with GOPRIVATE empty: every module —
including hanzos3/[email protected] and hanzoai/[email protected] (pulled transitively via
luxfi/database/zapdb) — fetches and verifies from proxy.golang.org +
sum.golang.org. dex pulls no zooai/parsdao/lux-private modules.
- Dockerfile, deploy/testnet/Dockerfile: drop `ENV GOPRIVATE=...`. The gh_token
BuildKit secret stays only for the cold `direct` fetch fallback.
- go.sum: realign luxfi/[email protected] and luxfi/[email protected] h1: hashes to the
canonical public sumdb values (`go mod tidy`; `go mod verify` = all modules
verified). go.mod unchanged.
deploy/testnet: one-command-per-box bring-up for a fleet of standalone
`dexd run` venues across two boxes, a cross-arch determinism proof, and a
ZAP load/throughput bench (drives the existing cmd/dexbench).
- compose.yml + gen-compose.sh: N independent venues/box (default 3, scales
to ~11), one ZAP port/node, per-node data dirs, 128GB-box resource caps.
- Dockerfile: pure-Go CPU image (dexd + dexbench), native amd64/arm64.
- Makefile: make up/bench/verify/down — git pull + one command per box.
- topology.md: honest consensus model (independent venues, deterministic
per-node genesis, no gossip) + the luxd `dexd plugin` BFT path.
- overlay/: opt-in hanzozt (OpenZiti) tunneler for NAT; direct 2.5GbE is the
default for true wire numbers.
- README.md: exact per-box commands, 128GB sizing, reading bench output.
Validated locally: signed place/cross load 0 rejects (cross=1 fill/submit);
dexbench -verify across two independent venues PASS (byte-identical 3-fill
multi-level sweep).
zeekayandHanzo Dev