No GITHUB_TOKEN needed. No git config override. No GOPRIVATE.
Proxy downloads everything. GONOSUMDB skips sum DB for our repos.
go.sum checksums match proxy (not direct).
Matches the sshd/ssh, httpd/http unix pattern. Single Docker image
now ships both binaries: ENTRYPOINT is mpcd (the daemon); override
with 'mpc <subcommand>' for CLI ops (peers, identity, recover, etc).
Also aligns with lux/kms (single binary with subcommands) — operators
get the same shape across all Base-family daemons.
Add GOEXPERIMENT=runtimesecret to Makefile, CI, and Dockerfile builds.
Wrap key share loading in all 5 signing session types with
withSecretErasure() so stack/register state containing raw share bytes
is zeroed after parsing. Build-tagged stub ensures everything compiles
without the experiment flag.
- Replace github.com/dgraph-io/badger/v4 with github.com/luxfi/zapdb/v4 v4.9.2
throughout pkg/kvstore/, pkg/transport/, cmd/mpcd/, e2e/, scripts/
- Rename BadgerPath/BadgerPassword → ZapDBPath/ZapDBPassword in FactoryConfig
- Remove local replace directives from go.mod:
- hanzoai/orm: now uses published v0.3.2 (tagged on GitHub)
- hanzoai/kv-go/v9: now uses published v9.17.2-hanzo.1
- Only remaining replace: agl/ed25519 → luxfi/edwards25519
- Add vendor/ directory (GOWORK=off go mod vendor) for reproducible builds
- Update Dockerfile to golang:1.26-alpine + -mod=vendor build flag
- Update CI/CD to use self-hosted linux/amd64 runners (no cross-compilation)
- Add k8s/valkey.yaml for session KV store
- Update k8s manifests: api-kv support, ZapDB password env, fresh secrets
- Dashboard API and MPC nodes all tested running on cluster (3/3 nodes healthy)
- Fix go.mod: move chi, cors, jwt, pgx from indirect to direct deps
- Add jackc/puddle/v2 and golang.org/x/sync as indirect deps
- Add Dockerfile ARG TARGETARCH for multi-arch builds
- Add white-label hostname branding (mpc.lux.network vs cloud.lux.network)
- Add imagePullSecrets to K8s deployments
- Remove stale docker-publish.yml and docker.yml workflows
- Remove Dockerfile.go123 placeholder
- Fix release.yml Go version to 1.25.5
- Update Dockerfile from golang:1.23-alpine to golang:1.25-alpine
matching go.mod requirement (go 1.25.5)
- Add public /healthz endpoint for K8s liveness/readiness probes
- Update api-deployment.yaml probes to use /healthz instead of
JWT-protected /api/v1/status
- Run go mod tidy to fix missing go.sum entries
- Add S3 backup manager (pkg/backup/s3.go) for periodic encrypted BadgerDB
backups with upload to S3-compatible storage (MinIO)
- Add 30s keepalive pings in transport layer to prevent idle read timeouts
- Increase read timeout from 30s to 5 minutes
- Add connection tie-breaking for simultaneous peer connections (lower node
ID keeps outbound) to prevent connection storms
- Add pointer-specific peer removal (removePeerConn) to prevent orphaned
goroutines from removing replacement connections
- Export BadgerBackupExecutor type for use by backup package
- Add /backup HTTP endpoint for on-demand backup triggers
- Bump version to 0.3.2
Explicit COPY destinations and symlink from lux-mpc to mpcd so
StatefulSet commands expecting /usr/local/bin/lux-mpc still work.
Dockerfile.prebuilt allows packaging pre-compiled binaries without
a Go build step.
- Upgrade base image from golang:1.24.5-alpine to golang:1.25-alpine
to match go.mod requirement (go 1.25.5)
- Fix binary build paths: use ./cmd/mpcd instead of non-existent ./cmd/lux-mpc
- Remove non-existent lux-mpc-bridge binary
- Update CMD to use mpcd binary
- Remove GOTOOLCHAIN=local from CI
- Fix cache keys to remove github.sha suffix
- Update Dockerfile to use golang:1.24.5-alpine
- Remove all sed workarounds and vendor mode attempts
- Use main Dockerfile instead of compatibility version
- Go 1.24.5 is now released, full native support
- Add Dockerfile.go123 for compatibility with Go 1.23
- Create placeholder binaries to maintain container structure
- Update Docker workflow to use compatibility Dockerfile
- Add comprehensive Docker build documentation
- This is a temporary solution until Go 1.24.5 is released
The compatibility image maintains the correct structure but requires
mounting actual binaries built with Go 1.24.5 for functionality.
- Add replace directives for luxfi/log and luxfi/threshold
- Use older versions that don't require Go 1.24.5
- Set GOTOOLCHAIN=local for builds
- This allows Docker builds to succeed with Go 1.23
- Create new go.mod with Go 1.23 requirement
- Use go mod tidy to resolve dependencies
- This bypasses all Go 1.24.5 version requirements
- Add docker-build.sh helper script for local builds
- Use sed to change go 1.24.5 to go 1.23 during Docker build
- This allows Docker builds to work until Go 1.24.5 is available
- Only affects the Docker build process, not the actual source
- Change from GOTOOLCHAIN=go1.23 to GOTOOLCHAIN=local
- This properly bypasses the Go 1.24.5 version requirement
- Allows Docker builds to succeed with Go 1.23
- Add GOTOOLCHAIN=go1.23 environment variable
- Use GOTOOLCHAIN for all go commands in Docker build
- This allows Docker builds to work with go.mod requiring Go 1.24.5
zeekay