build: pin canonical Registry Script artifact

Author: a19q3

contracts/registry-type-script/Cargo.lock

@@ -13,10 +13,20 @@ doctest = false
 bench = false
 required-features = ["ckb-script"]
 
+[[bin]]
+name = "cellscript-registry-type-script-hash"
+path = "src/bin/ckb_data_hash.rs"
+test = false
+doctest = false
+bench = false
+required-features = ["hash-tool"]
+
 [features]
 ckb-script = []
+hash-tool = ["dep:ckb-hash"]
 
 [dependencies]
+ckb-hash = { version = "=1.1.1", optional = true }
 ckb-std = { version = "=1.1.0", default-features = false, features = ["allocator"] }
 
 [dev-dependencies]

contracts/registry-type-script/Cargo.toml

@@ -29,13 +29,28 @@ contracts/registry-type-script/build_reproducible_release.sh
 cargo test --locked --manifest-path contracts/registry-type-script/Cargo.toml
 ```
 
-The release build disables `ckb-std` default features and enables only its Rust
+Reproduce the canonical Linux artifact with the pinned container digest:
+
+```bash
+contracts/registry-type-script/build_canonical_container.sh
+```
+
+The deployable artifact is tracked under `artifacts/v0.22.0` and was produced
+for the `x86_64-unknown-linux-gnu` host with the builder image digest recorded
+in `release-manifest.json`. Rust/LLVM may order identical RISC-V functions
+differently on another build host, so the script claims a byte-for-byte
+reproduction only on that canonical host. On every other host it still builds
+the source, reports the host artifact hash, verifies the tracked canonical
+identity, and places the canonical bytes at the normal target path for
+downstream tooling. The CKB-VM suite always executes those deployable bytes.
+
+The build disables `ckb-std` default features and enables only its Rust
 allocator. Fixed-size data, Script, and lock-hash buffers call the official
 syscall layer directly; the contract does not carry the higher-level Molecule
-type graph. Consequently the canonical artifact does not depend on a host C
-compiler or the bundled `libc.c`; the pinned Rust toolchain plus
-`llvm-tools-preview` is the complete compiler toolchain used by this contract
-build.
+type graph or depend on a host C compiler and bundled `libc.c`.
+The small host-side hash utility in the same crate computes CKB's personalized
+Blake2b-256 identity without depending on the root compiler workspace or a
+sibling SDK checkout.
 
 The test suite executes the stripped RISC-V binary in CKB-VM through
 `ckb-testtool`, covering authorized creation, replacement, destruction,

contracts/registry-type-script/README.md

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+contract_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repository_root="$(cd "$contract_dir/../.." && pwd)"
+canonical_target_dir="${CARGO_TARGET_DIR:-$contract_dir/target/canonical-container}"
+builder_image="rust@sha256:77fac8b98f9f46062bb680b6d25d5bcaabfc400143952ebc572e924bcbedc3fa"
+
+mkdir -p "$canonical_target_dir"
+canonical_target_dir="$(cd "$canonical_target_dir" && pwd)"
+
+docker run --rm --platform linux/amd64 \
+    --user "$(id -u):$(id -g)" \
+    --env CARGO_HOME=/contract-target/cargo-home \
+    --env RUSTUP_HOME=/usr/local/rustup \
+    --mount "type=bind,src=$repository_root,dst=/workspace,readonly" \
+    --mount "type=bind,src=$canonical_target_dir,dst=/contract-target" \
+    --workdir /workspace \
+    "$builder_image" \
+    bash -c '
+        set -euo pipefail
+        toolchain_bin=/usr/local/rustup/toolchains/1.97.1-x86_64-unknown-linux-gnu/bin
+        export PATH="$toolchain_bin:/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+        export RUSTC="$toolchain_bin/rustc"
+        export LD_LIBRARY_PATH="$toolchain_bin/../lib"
+        test "$(rustc -vV | sed -n "s/^host: //p")" = x86_64-unknown-linux-gnu
+        test -x "$(rustc --print sysroot)/lib/rustlib/x86_64-unknown-linux-gnu/bin/rust-objcopy"
+        rustc --print target-libdir --target riscv64imac-unknown-none-elf >/dev/null
+        CARGO_TARGET_DIR=/contract-target \
+            CELLSCRIPT_HASH_TARGET_DIR=/contract-target/cellc \
+            /workspace/contracts/registry-type-script/build_reproducible_release.sh
+    '

contracts/registry-type-script/artifacts/v0.22.0/cellscript-registry-type-script

@@ -5,6 +5,7 @@ contract_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 repository_root="$(cd "$contract_dir/../.." && pwd)"
 cargo_home_dir="${CARGO_HOME:-${HOME}/.cargo}"
 target_dir="${CARGO_TARGET_DIR:-$contract_dir/target}"
+hash_target_dir="${CELLSCRIPT_HASH_TARGET_DIR:-$repository_root/target}"
 rust_sysroot="$(rustc --print sysroot)"
 host_triple="$(rustc -vV | awk '/^host: / { print $2 }')"
 rust_objcopy="$rust_sysroot/lib/rustlib/$host_triple/bin/rust-objcopy"
@@ -34,17 +35,26 @@ env -u RUSTFLAGS \
         --bin cellscript-registry-type-script
 
 artifact="$target_dir/riscv64imac-unknown-none-elf/release/cellscript-registry-type-script"
-stripped_artifact="$artifact.stripped"
-"$rust_objcopy" --strip-all "$artifact" "$stripped_artifact"
-mv "$stripped_artifact" "$artifact"
-
-sha256_hash="$(shasum -a 256 "$artifact" | awk '{ print $1 }')"
-artifact_bytes="$(wc -c < "$artifact" | tr -d ' ')"
-ckb_hash_json="$(CARGO_TARGET_DIR="$repository_root/target" cargo run --quiet --locked \
-    --manifest-path "$repository_root/Cargo.toml" \
-    -p cellscript --bin cellc -- ckb-hash --file "$artifact" --json)"
-ckb_data_hash="$(printf '%s\n' "$ckb_hash_json" | sed -n 's/.*"hash": "\([0-9a-f]*\)".*/\1/p')"
+host_artifact="$artifact.$host_triple.stripped"
+"$rust_objcopy" --strip-all "$artifact" "$host_artifact"
+
 release_manifest="$contract_dir/release-manifest.json"
+canonical_relative_path="$(sed -n 's/.*"artifact": "\([^"]*\)".*/\1/p' "$release_manifest")"
+canonical_artifact="$contract_dir/$canonical_relative_path"
+if [[ -z "$canonical_relative_path" || ! -f "$canonical_artifact" ]]; then
+    printf 'canonical Registry Type Script artifact is missing: %s\n' "$canonical_artifact" >&2
+    exit 1
+fi
+
+sha256_hash="$(shasum -a 256 "$canonical_artifact" | awk '{ print $1 }')"
+artifact_bytes="$(wc -c < "$canonical_artifact" | tr -d ' ')"
+ckb_data_hash="$(CARGO_TARGET_DIR="$hash_target_dir" cargo run --quiet --locked \
+    --manifest-path "$contract_dir/Cargo.toml" \
+    --features hash-tool \
+    --bin cellscript-registry-type-script-hash \
+    -- "$canonical_artifact")"
+ckb_hash_json="$(printf '{\n  "algorithm": "blake2b-256",\n  "hash": "%s",\n  "input_bytes": %s,\n  "personalization": "ckb-default-hash",\n  "status": "ok"\n}' \
+    "$ckb_data_hash" "$artifact_bytes")"
 expected_sha256="$(sed -n 's/.*"sha256": "\([0-9a-f]*\)".*/\1/p' "$release_manifest")"
 expected_artifact_bytes="$(sed -n 's/.*"artifact_bytes": \([0-9]*\).*/\1/p' "$release_manifest")"
 expected_ckb_data_hash="$(sed -n 's/.*"ckb_data_hash": "0x\([0-9a-f]*\)".*/\1/p' "$release_manifest")"
@@ -55,6 +65,22 @@ if [[ "$artifact_bytes" != "$expected_artifact_bytes" || "$sha256_hash" != "$exp
     exit 1
 fi
 
+host_sha256="$(shasum -a 256 "$host_artifact" | awk '{ print $1 }')"
+if [[ "$host_triple" == "x86_64-unknown-linux-gnu" ]]; then
+    if ! cmp -s "$host_artifact" "$canonical_artifact"; then
+        printf 'canonical x86_64 Linux rebuild does not match the tracked Registry Type Script artifact\n' >&2
+        printf 'expected sha256=%s actual sha256=%s\n' "$sha256_hash" "$host_sha256" >&2
+        exit 1
+    fi
+    printf 'canonical_rebuild=matched\n'
+else
+    printf 'canonical_rebuild=not_claimed host=%s host_sha256=%s\n' "$host_triple" "$host_sha256"
+fi
+
+# Downstream tools always execute the exact tracked deployable bytes. A
+# non-canonical host build is retained beside this path for inspection.
+cp "$canonical_artifact" "$artifact"
+
 printf 'artifact=%s\n' "$artifact"
 printf 'artifact_bytes=%s\n' "$artifact_bytes"
 printf 'sha256=%s\n' "$sha256_hash"

contracts/registry-type-script/build_canonical_container.sh

@@ -2,12 +2,14 @@
   "schema": "cellscript-registry-type-script-release-v1",
   "version": "0.22.0",
   "target": "riscv64imac-unknown-none-elf",
-  "artifact": "cellscript-registry-type-script",
+  "artifact": "artifacts/v0.22.0/cellscript-registry-type-script",
+  "canonical_build_host": "x86_64-unknown-linux-gnu",
+  "canonical_builder_image": "rust@sha256:77fac8b98f9f46062bb680b6d25d5bcaabfc400143952ebc572e924bcbedc3fa",
   "artifact_bytes": 3352,
-  "sha256": "0f48a8736360c121f6ae0f04ab4b0496834f6715d47e3284a0a07add609dede9",
-  "ckb_data_hash": "0x0dd596ade29e06e5bcc00f56abf36ecbe9afaa09f1b26a64436aa37854da622b",
+  "sha256": "6a7ab8eaa2281fe77ca8c7b092006c52f96006ac2c7e4b013f8f88b7bf1f742a",
+  "ckb_data_hash": "0x8b6de99567accdca438818a55c16534ed10fc335f117709b1487fd2666808bfb",
   "script_template": {
-    "code_hash": "0x0dd596ade29e06e5bcc00f56abf36ecbe9afaa09f1b26a64436aa37854da622b",
+    "code_hash": "0x8b6de99567accdca438818a55c16534ed10fc335f117709b1487fd2666808bfb",
     "hash_type": "data1",
     "args_schema": "ckb_script_hash(custody_lock)",
     "args_bytes": 32

contracts/registry-type-script/build_reproducible_release.sh

@@ -0,0 +1,26 @@
+use std::{env, fs, process::ExitCode};
+
+fn main() -> ExitCode {
+    let mut args = env::args_os();
+    let _program = args.next();
+    let Some(path) = args.next() else {
+        eprintln!("usage: cellscript-registry-type-script-hash <artifact>");
+        return ExitCode::from(2);
+    };
+    if args.next().is_some() {
+        eprintln!("expected exactly one artifact path");
+        return ExitCode::from(2);
+    }
+    let bytes = match fs::read(&path) {
+        Ok(bytes) => bytes,
+        Err(error) => {
+            eprintln!("failed to read {}: {error}", path.to_string_lossy());
+            return ExitCode::FAILURE;
+        }
+    };
+    for byte in ckb_hash::blake2b_256(bytes) {
+        print!("{byte:02x}");
+    }
+    println!();
+    ExitCode::SUCCESS
+}

contracts/registry-type-script/release-manifest.json

@@ -22,11 +22,8 @@ struct Scripts {
 }
 
 fn contract_binary() -> Bytes {
-    let path =
-        PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("target/riscv64imac-unknown-none-elf/release/cellscript-registry-type-script");
-    std::fs::read(&path)
-        .unwrap_or_else(|error| panic!("read {}: {error}; run build_reproducible_release.sh first", path.display()))
-        .into()
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("artifacts/v0.22.0/cellscript-registry-type-script");
+    std::fs::read(&path).unwrap_or_else(|error| panic!("read tracked canonical artifact {}: {error}", path.display())).into()
 }
 
 fn scripts(args: Option<Bytes>) -> Scripts {

contracts/registry-type-script/src/bin/ckb_data_hash.rs

@@ -82,9 +82,13 @@ same auditable resolver policy.
 
 Both `dev` and `ci` also build the independent
 `contracts/registry-type-script` crate for
-`riscv64imac-unknown-none-elf`, strip it with the pinned toolchain, compare its
-SHA-256 and CKB data hash to the tracked release manifest, and execute its
+`riscv64imac-unknown-none-elf`, strip it with the pinned toolchain, verify the
+tracked canonical ELF's SHA-256 and CKB data hash, and execute that ELF's
 positive and negative lifecycle matrix in CKB-VM through `ckb-testtool`.
+Linux x86_64 additionally requires the fresh build to match the tracked ELF
+byte-for-byte. Other build hosts record their host artifact hash and make no
+cross-host reproduction claim; the pinned container builder provides that
+canonical check there.
 Passing this local boundary proves the deployed bytes' behavior and identity;
 it does not prove that the code Cell or custody Lock CellDep is live on
 mainnet. Production readiness still performs live RPC and confirmation checks.