Standardised verifiable builds

README.md

@@ -45,6 +45,9 @@ Modern releases of gcc and clang, as well as Visual Studio 2019+ should work.
   * (MacOS) `brew install openssl`
   * `cargo install cargo-dylint dylint-link`.
 
+* Step 4: (**Optional**) Install [Docker Engine](https://docs.docker.com/engine/install)
+to be able to produce verifiable builds.
+
 You can always update the `cargo-contract` binary to the latest version by running the Step 2.
 
 ### Installation using Docker Image
@@ -69,6 +72,16 @@ docker run --rm -it -v $(pwd):/sources paritytech/contracts-ci-linux:production
 If you want to reproduce other steps of CI process you can use the following
 [guide](https://github.com/paritytech/scripts#reproduce-ci-locally).
 
+### Verifiable builds
+
+Some block explorers require the Wasm binary to be compiled in the deterministic environment.
+To achieve it, you should build your contract using Docker image we provide:
+```bash
+cargo contract build --verifiable
+```
+
+You can find more detailed documentation how to use the image [here](/build-image/README.md)
+
 ## Usage
 
 You can always use `cargo contract help` to print information on available

build-image/.dockerignore

@@ -0,0 +1 @@
+target/

build-image/Dockerfile

@@ -0,0 +1,63 @@
+FROM docker.io/bitnami/minideb:bullseye-amd64 as slimmed-rust
+
+# metadata
+LABEL io.parity.image.vendor="Parity Technologies" \
+    io.parity.image.title="contracts-verifiable" \
+    io.parity.image.documentation="https://github.com/paritytech/scripts/blob/master/\
+    dockerfiles/ink-ci-linux/README.md" \
+    io.parity.image.description="Inherits from docker.io/bitnami/minideb:bullseye. \
+    rust nightly, clippy, rustfmt, miri, rust-src, rustc-dev, grcov, rust-covfix, \
+    llvm-tools-preview, cargo-contract, xargo, binaryen, parallel, codecov, ink, solang" \
+    io.parity.image.documentation="https://github.com/paritytech/cargo-contract/blob/master/\
+    build-image/README.md"
+
+ENV RUSTUP_HOME=/usr/local/rustup \
+    CARGO_HOME=/usr/local/cargo \
+    PATH=/usr/local/cargo/bin:$PATH \
+    # The 1.69 toolchain is temporarily required to build ink! contracts because of
+    # https://github.com/paritytech/cargo-contract/issues/1139
+    RUST_VERSION=1.69
+
+# Minimal Rust dependencies.
+RUN set -eux \
+    && apt-get update && apt-get -y install wget \
+    && url="https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init" \
+    && wget "$url" \
+    && chmod +x rustup-init \
+    && ./rustup-init -y --no-modify-path --profile minimal --component rust-src rustfmt --default-toolchain $RUST_VERSION  \
+    && rm rustup-init \
+    && chmod -R a+w $RUSTUP_HOME $CARGO_HOME \
+    && rustup --version \
+    && cargo --version \
+    && rustc --version \
+    && apt-get remove -y --auto-remove wget \
+    && apt-get -y install gcc \
+    && rm -rf /var/lib/apt/lists/*
+
+FROM slimmed-rust as cc-builder
+
+# This is important, see https://github.com/rust-lang/docker-rust/issues/85
+ENV RUSTFLAGS="-C target-feature=-crt-static"
+
+RUN apt-get -y update && apt-get -y install gcc g++
+# Install cargo contract
+RUN cargo install cargo-contract
+
+# Cleanup after `cargo install`
+RUN rm -rf ${CARGO_HOME}/"registry" ${CARGO_HOME}/"git" /root/.cache/sccache
+
+# apt clean up
+RUN apt-get remove -y gnupg && \
+    apt-get autoremove -y && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+
+FROM slimmed-rust as ink-dev
+
+COPY --from=cc-builder /usr/local/cargo/bin/cargo-contract /usr/local/bin/cargo-contract
+
+WORKDIR /contract
+
+# default entry point
+ENTRYPOINT ["cargo", "contract", "build", "--release"]

build-image/README.md

@@ -0,0 +1,44 @@
+# Verifiable builds using Docker
+
+Docker image based on our base CI image `<base-ci-linux:latest>`.
+
+Used for reproducible builds in `cargo contract build --verifiable`
+
+**Rust versions:**
+
+Currently, the 1.69 toolchain is temporarily required to build ink! contracts because of https://github.com/paritytech/cargo-contract/issues/1139
+
+**Rust tools & toolchains:**
+
+We use stable releases from crates.io
+
+- `cargo-contract`
+- `wasm32-unknown-unknown`: The toolchain to compile Rust codebases for Wasm.
+
+[Click here](https://hub.docker.com/repository/docker/paritytech/contracts-verifiable) for the registry.
+
+## Usage
+
+The default entry point is `ENTRYPOINT [ "cargo", "contract", "build", "--release" ]`
+and work directory is set to `/contract`. You need to mount the folder with the contract to the container.
+
+```bash
+docker run -d \
+    --name ink-container \
+    --mount type=bind,source="$(pwd)",target="/contract" \
+    paritytech/contracts-verified
+```
+
+If you have multi-contract project:
+```
+my-app/
+├─ ink-project-a/
+│  ├─ Cargo.toml
+│  ├─ lib.rs
+├─ ink-project-b/
+│  ├─ Cargo.toml
+│  ├─ lib.rs
+├─ rust-toolchain
+```
+Make sure you mount `my-app` directory and then call
+`cargo contract build --verifiable --release --manifest-path ink-project-a/Cargo.toml`

crates/build/Cargo.toml

@@ -38,6 +38,9 @@ wasm-opt = "0.112.0"
 which = "4.4.0"
 zip = { version = "0.6.6", default-features = false }
 strum = { version = "0.24", features = ["derive"] }
+tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
+tokio-stream = "0.1"
+bollard = "0.14"
 
 contract-metadata = { version = "3.0.1", path = "../metadata" }
 

crates/build/README.md

@@ -1,6 +1,6 @@
 # contract-build
 
-A crate for building [`ink!`](https://github.com/paritytech/ink) smart contracts. Used by 
+A crate for building [`ink!`](https://github.com/paritytech/ink) smart contracts. Used by
 [`cargo-contract`](https://github.com/paritytech/cargo-contract).
 
 ## Usage
@@ -36,7 +36,8 @@ let args = contract_build::ExecuteArgs {
     skip_wasm_validation: false,
     target: Target::Wasm,
     max_memory_pages: 16,
+    image: None,
 };
 
 contract_build::execute(args);
-```
+```

crates/build/src/args.rs

@@ -45,7 +45,7 @@ impl TryFrom<&VerbosityFlags> for Verbosity {
 }
 
 /// Denotes if output should be printed to stdout.
-#[derive(Clone, Copy, Default, serde::Serialize, Eq, PartialEq)]
+#[derive(Clone, Copy, Default, serde::Serialize, serde::Deserialize, Eq, PartialEq)]
 pub enum Verbosity {
     /// Use default output
     #[default]
@@ -89,7 +89,15 @@ impl Network {
 
 /// Describes which artifacts to generate
 #[derive(
-    Copy, Clone, Default, Eq, PartialEq, Debug, clap::ValueEnum, serde::Serialize,
+    Copy,
+    Clone,
+    Default,
+    Eq,
+    PartialEq,
+    Debug,
+    clap::ValueEnum,
+    serde::Serialize,
+    serde::Deserialize,
 )]
 #[clap(name = "build-artifacts")]
 pub enum BuildArtifacts {