@layerzerolabs/vm-tooling-stellar 0.2.113 → 0.2.115

package/dist/6YPWRWU3.js

@@ -0,0 +1,96 @@
+import { init_esm_shims, __name } from './2VBLSQAK.js';
+import { execFile, spawn } from 'child_process';
+import { promisify } from 'util';
+
+// src/commands/verifiable-build.ts
+init_esm_shims();
+var execFileAsync = promisify(execFile);
+var SOURCE_MOUNT = "/source";
+var VERIFIABLE_BUILD_PLATFORM = "linux/amd64";
+var OFFICIAL_IMAGE_REPO = "stellar/stellar-cli";
+var officialImageTagRef = /* @__PURE__ */ __name((stellarVersion, rustVersion) => `${OFFICIAL_IMAGE_REPO}:${stellarVersion}-rust${rustVersion}-slim-bookworm`, "officialImageTagRef");
+var parseAmd64Digest = /* @__PURE__ */ __name((manifestInspectJson) => {
+  const { manifests } = JSON.parse(manifestInspectJson);
+  if (!Array.isArray(manifests)) {
+    throw new Error("`docker manifest inspect` did not return a multi-arch index (no `manifests` array)");
+  }
+  const digest = manifests.find(({ platform }) => platform?.os === "linux" && platform?.architecture === "amd64")?.digest;
+  if (typeof digest !== "string" || !digest.startsWith("sha256:")) {
+    throw new Error("No linux/amd64 manifest digest found in `docker manifest inspect` output");
+  }
+  return digest;
+}, "parseAmd64Digest");
+var resolveAmd64Digest = /* @__PURE__ */ __name(async (imageTagRef) => {
+  try {
+    const { stdout } = await execFileAsync("docker", [
+      "manifest",
+      "inspect",
+      imageTagRef
+    ], {
+      maxBuffer: 16 * 1024 * 1024
+    });
+    return parseAmd64Digest(stdout);
+  } catch (cause) {
+    throw new Error(`Failed to resolve the linux/amd64 digest of ${imageTagRef} (\`docker manifest inspect\`)`, {
+      cause
+    });
+  }
+}, "resolveAmd64Digest");
+var buildVerifiableBuildDockerArgs = /* @__PURE__ */ __name(({ imageRef, sourceDir, buildArgs, bldimg }) => [
+  "run",
+  "--rm",
+  "--platform",
+  VERIFIABLE_BUILD_PLATFORM,
+  "-v",
+  `${sourceDir}:${SOURCE_MOUNT}`,
+  "-w",
+  SOURCE_MOUNT,
+  imageRef,
+  "contract",
+  "build",
+  ...buildArgs,
+  // Embedded by us (not the user): the exact build image, so the WASM records what produced it.
+  "--meta",
+  `bldimg=${bldimg}`
+], "buildVerifiableBuildDockerArgs");
+var runDocker = /* @__PURE__ */ __name((dockerArgs) => new Promise((resolve, reject) => {
+  const child = spawn("docker", dockerArgs, {
+    stdio: "inherit"
+  });
+  child.on("error", (error) => reject(new Error("Failed to spawn docker for the verifiable build", {
+    cause: error
+  })));
+  child.on("close", (code, signal) => {
+    if (code === 0) {
+      resolve();
+    } else {
+      reject(new Error(`Verifiable build failed: docker exited with ${signal ? `signal ${signal}` : `code ${code}`}`));
+    }
+  });
+}), "runDocker");
+var VerifiableBuildWrapper = class {
+  static {
+    __name(this, "VerifiableBuildWrapper");
+  }
+  async run(args, { stellarVersion, rustVersion }, options) {
+    const tagRef = officialImageTagRef(stellarVersion, rustVersion);
+    const digest = await resolveAmd64Digest(tagRef);
+    const imageRef = `${OFFICIAL_IMAGE_REPO}@${digest}`;
+    const bldimg = `docker.io/${OFFICIAL_IMAGE_REPO}@${digest}`;
+    const dockerArgs = buildVerifiableBuildDockerArgs({
+      imageRef,
+      sourceDir: options.cwd,
+      buildArgs: args,
+      bldimg
+    });
+    console.info("\u{1F512} Verifiable build (official stellar/stellar-cli image, run from host)");
+    console.info(`   image:  ${imageRef} (${VERIFIABLE_BUILD_PLATFORM}, from tag ${tagRef})`);
+    console.info(`   bldimg: ${bldimg}`);
+    console.info(`   docker ${dockerArgs.join(" ")}`);
+    await runDocker(dockerArgs);
+  }
+};
+
+export { VerifiableBuildWrapper, buildVerifiableBuildDockerArgs, officialImageTagRef, parseAmd64Digest };
+//# sourceMappingURL=6YPWRWU3.js.map
+//# sourceMappingURL=6YPWRWU3.js.map

package/dist/6YPWRWU3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/verifiable-build.ts"],"names":["execFileAsync","promisify","execFile","SOURCE_MOUNT","VERIFIABLE_BUILD_PLATFORM","OFFICIAL_IMAGE_REPO","officialImageTagRef","stellarVersion","rustVersion","parseAmd64Digest","manifestInspectJson","manifests","JSON","parse","Array","isArray","Error","digest","find","platform","os","architecture","startsWith","resolveAmd64Digest","imageTagRef","stdout","maxBuffer","cause","buildVerifiableBuildDockerArgs","imageRef","sourceDir","buildArgs","bldimg","runDocker","dockerArgs","Promise","resolve","reject","child","spawn","stdio","on","error","code","signal","VerifiableBuildWrapper","run","args","options","tagRef","cwd","console","info","join"],"mappings":";;;;;AAAA,cAAA,EAAA;AAKA,IAAMA,aAAAA,GAAgBC,UAAUC,QAAAA,CAAAA;AAIhC,IAAMC,YAAAA,GAAe,SAAA;AAIrB,IAAMC,yBAAAA,GAA4B,aAAA;AAElC,IAAMC,mBAAAA,GAAsB,qBAAA;AAOrB,IAAMC,mBAAAA,mBAAsB,MAAA,CAAA,CAACC,cAAAA,EAAwBC,WAAAA,KACxD,CAAA,EAAGH,mBAAAA,CAAAA,CAAAA,EAAuBE,cAAAA,CAAAA,KAAAA,EAAsBC,WAAAA,CAAAA,cAAAA,CAAAA,EADjB,qBAAA;AAgB5B,IAAMC,gBAAAA,2BAAoBC,mBAAAA,KAAAA;AAC7B,EAAA,MAAM,EAAEC,SAAAA,EAAS,GAAKC,IAAAA,CAAKC,MAAMH,mBAAAA,CAAAA;AAEjC,EAAA,IAAI,CAACI,KAAAA,CAAMC,OAAAA,CAAQJ,SAAAA,CAAAA,EAAY;AAC3B,IAAA,MAAM,IAAIK,MACN,oFAAA,CAAA;AAER,EAAA;AAEA,EAAA,MAAMC,MAAAA,GAASN,SAAAA,CAAUO,IAAAA,CACrB,CAAC,EAAEC,QAAAA,EAAQ,KAAOA,QAAAA,EAAUC,EAAAA,KAAO,OAAA,IAAWD,QAAAA,EAAUE,YAAAA,KAAiB,OAAA,CAAA,EAC1EJ,MAAAA;AAEH,EAAA,IAAI,OAAOA,MAAAA,KAAW,QAAA,IAAY,CAACA,MAAAA,CAAOK,UAAAA,CAAW,SAAA,CAAA,EAAY;AAC7D,IAAA,MAAM,IAAIN,MAAM,0EAAA,CAAA;AACpB,EAAA;AAEA,EAAA,OAAOC,MAAAA;AACX,CAAA,EAlBgC,kBAAA;AAyBhC,IAAMM,kBAAAA,iCAA4BC,WAAAA,KAAAA;AAC9B,EAAA,IAAI;AACA,IAAA,MAAM,EAAEC,MAAAA,EAAM,GAAK,MAAMzB,cAAc,QAAA,EAAU;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAWwB,MAAAA;AAAc,KAAA,EAAA;AACnFE,MAAAA,SAAAA,EAAW,KAAK,IAAA,GAAO;KAC3B,CAAA;AACA,IAAA,OAAOjB,iBAAiBgB,MAAAA,CAAAA;AAC5B,EAAA,CAAA,CAAA,OAASE,KAAAA,EAAO;AACZ,IAAA,MAAM,IAAIX,KAAAA,CACN,CAAA,4CAAA,EAA+CQ,WAAAA,CAAAA,8BAAAA,CAAAA,EAC/C;AAAEG,MAAAA;KAAM,CAAA;AAEhB,EAAA;AACJ,CAAA,EAZ2B,oBAAA,CAAA;AAsBpB,IAAMC,iDAAiC,MAAA,CAAA,CAAC,EAC3CC,UACAC,SAAAA,EACAC,SAAAA,EACAC,QAAM,KAMM;AACZ,EAAA,KAAA;AACA,EAAA,MAAA;AACA,EAAA,YAAA;AACA5B,EAAAA,yBAAAA;AACA,EAAA,IAAA;EACA,CAAA,EAAG0B,SAAAA,IAAa3B,YAAAA,CAAAA,CAAAA;AAChB,EAAA,IAAA;AACAA,EAAAA,YAAAA;AACA0B,EAAAA,QAAAA;AACA,EAAA,UAAA;AACA,EAAA,OAAA;AACGE,EAAAA,GAAAA,SAAAA;;AAEH,EAAA,QAAA;AACA,EAAA,CAAA,OAAA,EAAUC,MAAAA,CAAAA;AAzBgC,CAAA,EAAA,gCAAA;AA4B9C,IAAMC,4BAAY,MAAA,CAAA,CAACC,UAAAA,KACf,IAAIC,OAAAA,CAAQ,CAACC,SAASC,MAAAA,KAAAA;AAClB,EAAA,MAAMC,KAAAA,GAAQC,KAAAA,CAAM,QAAA,EAAUL,UAAAA,EAAY;IAAEM,KAAAA,EAAO;GAAU,CAAA;AAC7DF,EAAAA,KAAAA,CAAMG,GAAG,OAAA,EAAS,CAACC,UACfL,MAAAA,CAAO,IAAIrB,MAAM,iDAAA,EAAmD;IAAEW,KAAAA,EAAOe;AAAM,GAAA,CAAA,CAAA,CAAA;AAEvFJ,EAAAA,KAAAA,CAAMG,EAAAA,CAAG,OAAA,EAAS,CAACE,IAAAA,EAAMC,MAAAA,KAAAA;AACrB,IAAA,IAAID,SAAS,CAAA,EAAG;AACZP,MAAAA,OAAAA,EAAAA;IACJ,CAAA,MAAO;AACHC,MAAAA,MAAAA,CACI,IAAIrB,KAAAA,CACA,CAAA,4CAAA,EACI4B,MAAAA,GAAS,CAAA,OAAA,EAAUA,MAAAA,CAAAA,CAAAA,GAAW,CAAA,KAAA,EAAQD,IAAAA,CAAAA,CAAM,CAAA,CAC9C,CAAA,CAAA;AAGd,IAAA;EACJ,CAAA,CAAA;AACJ,CAAA,CAAA,EAnBc,WAAA,CAAA;AA4CX,IAAME,yBAAN,MAAMA;EA7Jb;;;AA8JI,EAAA,MAAaC,IACTC,IAAAA,EACA,EAAExC,cAAAA,EAAgBC,WAAAA,IAClBwC,OAAAA,EACa;AACb,IAAA,MAAMC,MAAAA,GAAS3C,mBAAAA,CAAoBC,cAAAA,EAAgBC,WAAAA,CAAAA;AACnD,IAAA,MAAMS,MAAAA,GAAS,MAAMM,kBAAAA,CAAmB0B,MAAAA,CAAAA;AACxC,IAAA,MAAMpB,QAAAA,GAAW,CAAA,EAAGxB,mBAAAA,CAAAA,CAAAA,EAAuBY,MAAAA,CAAAA,CAAAA;AAC3C,IAAA,MAAMe,MAAAA,GAAS,CAAA,UAAA,EAAa3B,mBAAAA,CAAAA,CAAAA,EAAuBY,MAAAA,CAAAA,CAAAA;AAEnD,IAAA,MAAMiB,aAAaN,8BAAAA,CAA+B;AAC9CC,MAAAA,QAAAA;AACAC,MAAAA,SAAAA,EAAWkB,OAAAA,CAAQE,GAAAA;MACnBnB,SAAAA,EAAWgB,IAAAA;AACXf,MAAAA;KACJ,CAAA;AAEAmB,IAAAA,OAAAA,CAAQC,KAAK,gFAAA,CAAA;AACbD,IAAAA,OAAAA,CAAQC,KAAK,CAAA,WAAA,EAAcvB,QAAAA,KAAazB,yBAAAA,CAAAA,WAAAA,EAAuC6C,MAAAA,CAAAA,CAAAA,CAAS,CAAA;AACxFE,IAAAA,OAAAA,CAAQC,IAAAA,CAAK,CAAA,WAAA,EAAcpB,MAAAA,CAAAA,CAAQ,CAAA;AACnCmB,IAAAA,OAAAA,CAAQC,KAAK,CAAA,UAAA,EAAalB,UAAAA,CAAWmB,IAAAA,CAAK,GAAA,CAAA,CAAA,CAAM,CAAA;AAEhD,IAAA,MAAMpB,UAAUC,UAAAA,CAAAA;AACpB,EAAA;AACJ","file":"6YPWRWU3.js","sourcesContent":["import { execFile, spawn } from 'node:child_process';\nimport { promisify } from 'node:util';\n\nimport type { ToolCommandExecutionOptions } from '@layerzerolabs/vm-tooling';\n\nconst execFileAsync = promisify(execFile);\n\n// The self-contained source is mounted here and built in place. The official image's WORKDIR is\n// already /source; we set it explicitly for clarity.\nconst SOURCE_MOUNT = '/source';\n\n// Canonical reproducible platform. External verifiers reproduce the amd64 artifact, so we always\n// run the amd64 image regardless of the host arch (the daemon emulates it when needed).\nconst VERIFIABLE_BUILD_PLATFORM = 'linux/amd64';\n\nconst OFFICIAL_IMAGE_REPO = 'stellar/stellar-cli';\n\n/**\n * The official reproducible image reference for a (Stellar CLI, Rust) version pair, e.g.\n * `stellar/stellar-cli:25.1.0-rust1.90.0-slim-bookworm`. The caller pins both versions; this is the\n * only image the tool builds against.\n */\nexport const officialImageTagRef = (stellarVersion: string, rustVersion: string): string =>\n    `${OFFICIAL_IMAGE_REPO}:${stellarVersion}-rust${rustVersion}-slim-bookworm`;\n\n/**\n * Pick the linux/amd64 manifest digest out of `docker manifest inspect` output. Pure/synchronous so\n * the selection (skip the arm64 and the unknown/unknown attestation entries) is unit-testable.\n */\n// The subset of `docker manifest inspect` output (an OCI image index) that we read.\ninterface ManifestDescriptor {\n    digest?: string;\n    platform?: { os?: string; architecture?: string };\n}\ninterface ManifestIndex {\n    manifests?: ManifestDescriptor[];\n}\n\nexport const parseAmd64Digest = (manifestInspectJson: string): string => {\n    const { manifests } = JSON.parse(manifestInspectJson) as ManifestIndex;\n\n    if (!Array.isArray(manifests)) {\n        throw new Error(\n            '`docker manifest inspect` did not return a multi-arch index (no `manifests` array)',\n        );\n    }\n\n    const digest = manifests.find(\n        ({ platform }) => platform?.os === 'linux' && platform?.architecture === 'amd64',\n    )?.digest;\n\n    if (typeof digest !== 'string' || !digest.startsWith('sha256:')) {\n        throw new Error('No linux/amd64 manifest digest found in `docker manifest inspect` output');\n    }\n\n    return digest;\n};\n\n/**\n * Resolve the immutable linux/amd64 digest of a `stellar/stellar-cli` tag via a daemon-less\n * registry query (`docker manifest inspect`). This is the reproducible reference an external\n * verifier pins to (SEP-58).\n */\nconst resolveAmd64Digest = async (imageTagRef: string): Promise<string> => {\n    try {\n        const { stdout } = await execFileAsync('docker', ['manifest', 'inspect', imageTagRef], {\n            maxBuffer: 16 * 1024 * 1024,\n        });\n        return parseAmd64Digest(stdout);\n    } catch (cause) {\n        throw new Error(\n            `Failed to resolve the linux/amd64 digest of ${imageTagRef} (\\`docker manifest inspect\\`)`,\n            { cause },\n        );\n    }\n};\n\n/**\n * Assemble the `docker run` argv for a verifiable build. Kept pure and synchronous so the mount /\n * workdir layout and the tool-injected `--meta bldimg=…` are unit-testable without Docker.\n *\n * The official image's ENTRYPOINT is `stellar`, so the trailing `contract build …` runs under it.\n * The source directory is assumed self-contained, so it is mounted at /source and built in place —\n * no surrounding workspace is required.\n */\nexport const buildVerifiableBuildDockerArgs = ({\n    imageRef,\n    sourceDir,\n    buildArgs,\n    bldimg,\n}: {\n    imageRef: string;\n    sourceDir: string;\n    buildArgs: string[];\n    bldimg: string;\n}): string[] => [\n    'run',\n    '--rm',\n    '--platform',\n    VERIFIABLE_BUILD_PLATFORM,\n    '-v',\n    `${sourceDir}:${SOURCE_MOUNT}`,\n    '-w',\n    SOURCE_MOUNT,\n    imageRef,\n    'contract',\n    'build',\n    ...buildArgs,\n    // Embedded by us (not the user): the exact build image, so the WASM records what produced it.\n    '--meta',\n    `bldimg=${bldimg}`,\n];\n\nconst runDocker = (dockerArgs: string[]): Promise<void> =>\n    new Promise((resolve, reject) => {\n        const child = spawn('docker', dockerArgs, { stdio: 'inherit' });\n        child.on('error', (error) =>\n            reject(new Error('Failed to spawn docker for the verifiable build', { cause: error })),\n        );\n        child.on('close', (code, signal) => {\n            if (code === 0) {\n                resolve();\n            } else {\n                reject(\n                    new Error(\n                        `Verifiable build failed: docker exited with ${\n                            signal ? `signal ${signal}` : `code ${code}`\n                        }`,\n                    ),\n                );\n            }\n        });\n    });\n\nexport interface VerifiableBuildVersions {\n    stellarVersion: string;\n    rustVersion: string;\n}\n\n/**\n * Reproducible `stellar contract build` that runs inside the OFFICIAL `stellar/stellar-cli` image —\n * the exact package an external verifier uses — instead of our own dev image (whose sccache/mold\n * layers could change the WASM).\n *\n * The build runs the official image directly from the HOST: our TypeScript CLI already executes on\n * the host runner, so it can `docker run` the official image itself. This is what an external\n * verifier's plain `docker run` does, and it means we never bind-mount the host Docker socket into\n * a container — eliminating the container-escape / secret-leak surface that mounting the socket\n * would create.\n *\n * The image is `stellar/stellar-cli:<stellarVersion>-rust<rustVersion>-slim-bookworm`, pinned by the\n * caller. For a stable reference we resolve it to its linux/amd64 digest and both RUN that digest\n * and embed it as the `bldimg` WASM metadata (`docker.io/stellar/stellar-cli@sha256:…`) — the tool\n * does this automatically so callers never hand-inject `--meta bldimg=…`. The source directory (the\n * cwd, assumed self-contained) is mounted at /source and built in place, and the official image runs\n * as its own user/toolchain.\n */\nexport class VerifiableBuildWrapper {\n    public async run(\n        args: string[],\n        { stellarVersion, rustVersion }: VerifiableBuildVersions,\n        options: ToolCommandExecutionOptions,\n    ): Promise<void> {\n        const tagRef = officialImageTagRef(stellarVersion, rustVersion);\n        const digest = await resolveAmd64Digest(tagRef);\n        const imageRef = `${OFFICIAL_IMAGE_REPO}@${digest}`;\n        const bldimg = `docker.io/${OFFICIAL_IMAGE_REPO}@${digest}`;\n\n        const dockerArgs = buildVerifiableBuildDockerArgs({\n            imageRef,\n            sourceDir: options.cwd,\n            buildArgs: args,\n            bldimg,\n        });\n\n        console.info('🔒 Verifiable build (official stellar/stellar-cli image, run from host)');\n        console.info(`   image:  ${imageRef} (${VERIFIABLE_BUILD_PLATFORM}, from tag ${tagRef})`);\n        console.info(`   bldimg: ${bldimg}`);\n        console.info(`   docker ${dockerArgs.join(' ')}`);\n\n        await runDocker(dockerArgs);\n    }\n}\n"]}