mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
3d8d9c98d6
luxfi/* and hanzoai/* are PUBLIC Go modules. The GOPRIVATE / GONOSUMDB / GOPROXY=direct env in Dockerfile + release.yml routed fetches around proxy.golang.org + sum.golang.org, "working" only by skipping checksum verification — which poisons go.sum with force-republished git bytes that no longer match the immutable checksum db. Drop the bypass; resolve every luxfi/hanzoai checksum from the public proxy + sumdb instead. Poisoned deps resolved (strip luxfi/hanzoai go.sum lines, then go mod tidy): - github.com/luxfi/edwards25519 v0.1.0 -> v0.1.1 (the agl/ed25519 replace target, in both go.mod and e2e/go.mod): v0.1.0 was force-republished, its zip hash diverges from the sum.golang.org pin and no copy verifies; v0.1.1 is the clean patch the proxy + sumdb agree on. - github.com/luxfi/age v1.4.0, github.com/luxfi/zap v0.8.1: version healthy, but go.sum carried poisoned zip hashes — corrected to the sumdb canonical values. - e2e/go.sum: also completed to the full canonical checksum set (hack-era builds with GOPROXY=direct skip go.sum completion). Verified with GOWORK=off (matching the .dockerignore'd workspace + CI): - go mod verify -> all modules verified (main + e2e) - CGO_ENABLED=0 go build ./... clean (main + e2e) - go test ./... -> 35 ok / 0 FAIL; signing, threshold, keygen, attestation, kms, ristretto255 curve, sr25519, and policy-gated sign-flow tests all pass. No crypto regression from the edwards25519 curve-lib bump.
52 lines
2.5 KiB
Docker
52 lines
2.5 KiB
Docker
# Stage 1: Build embedded admin UI
|
|
FROM node:22-alpine AS ui
|
|
# Pin pnpm to a known-good version so corepack doesn't pull a tagged-but-unsigned
|
|
# release. v10.x supports `onlyBuiltDependencies` in package.json and does not
|
|
# fail the install step on ignored build scripts (newer v11 returns non-zero
|
|
# unless explicitly approved, even in non-interactive Docker builds).
|
|
RUN corepack enable && corepack prepare [email protected] --activate
|
|
WORKDIR /ui
|
|
COPY ui/package.json ui/pnpm-lock.yaml* ./
|
|
# `--frozen-lockfile` first so verifiable builds win; fall back to a
|
|
# lockfile-updating install if the lock is missing.
|
|
RUN pnpm install --frozen-lockfile || pnpm install --no-frozen-lockfile
|
|
COPY ui/ .
|
|
RUN pnpm build
|
|
|
|
# MPC — single image ships both daemon (mpcd) + CLI (mpc).
|
|
# Default entrypoint: mpcd. Override ENTRYPOINT / CMD with `mpc <cmd>` for CLI.
|
|
# syntax=docker/dockerfile:1
|
|
|
|
FROM --platform=$BUILDPLATFORM golang:1.26.3-alpine AS builder
|
|
# CGO toolchain — required by go-sqlite3 (mattn) so the wallet HTTP API
|
|
# can open SQLite. Previously CGO=0 left the driver unregistered and
|
|
# /v1/mpc/wallets returned 503; the workaround was seeding wallets into
|
|
# TA's user_wallets table out-of-band.
|
|
RUN apk add --no-cache git ca-certificates gcc musl-dev sqlite-dev linux-headers
|
|
# luxfi/* + hanzoai/* are PUBLIC modules — fetched and checksum-verified through
|
|
# the default immutable proxy.golang.org + sum.golang.org. No GONOSUMDB bypass.
|
|
|
|
WORKDIR /app
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
COPY --from=ui /ui/dist ./ui/dist/
|
|
|
|
# Per SCALE_STANDARD.md §2 (https://github.com/hanzoai/hips/blob/main/docs/SCALE_STANDARD.md)
|
|
# — every Go production Dockerfile that emits JSON to a client builds
|
|
# with GOEXPERIMENT=jsonv2 (composed with runtimesecret for the MPC
|
|
# data-plane secrecy guarantees). Verified -12% time / -23% allocs on
|
|
# the edge POST roundtrip vs encoding/json v1.
|
|
ENV GOEXPERIMENT=runtimesecret,jsonv2
|
|
RUN CGO_ENABLED=1 GOOS=linux go build -ldflags="-s -w -linkmode external -extldflags '-static'" -tags 'sqlite_omit_load_extension' -o mpcd ./cmd/mpcd
|
|
RUN CGO_ENABLED=1 GOOS=linux go build -ldflags="-s -w -linkmode external -extldflags '-static'" -tags 'sqlite_omit_load_extension' -o mpc ./cmd/mpc
|
|
|
|
FROM alpine:3.21
|
|
# Runtime — statically linked binaries above don't need shared libs, but
|
|
# keep ca-certificates + tzdata for HTTPS + log timestamps.
|
|
RUN apk add --no-cache ca-certificates tzdata
|
|
COPY --from=builder /app/mpcd /usr/local/bin/mpcd
|
|
COPY --from=builder /app/mpc /usr/local/bin/mpc
|
|
EXPOSE 8081 9999 9800
|
|
ENTRYPOINT ["mpcd"]
|