Standardised verifiable builds

build-image/.dockerignore

@@ -0,0 +1 @@
+target/

build-image/Dockerfile

@@ -0,0 +1,78 @@
+ARG VCS_REF=master
+ARG REGISTRY_PATH=docker.io/paritytech
+ARG BUILD_DATE
+
+FROM ${REGISTRY_PATH}/base-ci-linux:latest
+
+# metadata
+LABEL io.parity.image.vendor="Parity Technologies" \
+    io.parity.image.title="${REGISTRY_PATH}/contracts-verified" \
+    io.parity.image.documentation="https://github.com/paritytech/scripts/blob/${VCS_REF}/\
+    dockerfiles/ink-ci-linux/README.md" \
+    io.parity.image.description="Inherits from docker.io/paritytech/base-ci-linux. \
+    rust nightly, clippy, rustfmt, miri, rust-src, rustc-dev, grcov, rust-covfix, \
+    llvm-tools-preview, cargo-contract, xargo, binaryen, parallel, codecov, ink, solang" \
+    io.parity.image.revision="${VCS_REF}" \
+    io.parity.image.documentation="https://github.com/paritytech/cargo-contract/blob/${VCS_REF}/\
+    build-image/README.md" \
+    io.parity.image.created="${BUILD_DATE}"
+
+WORKDIR /builds
+
+RUN set -eux; \
+    apt-get -y update && \
+    apt-get install -y --no-install-recommends zlib1g-dev npm wabt && \
+    npm install --ignore-scripts -g yarn && \
+
+    # `binaryen` is needed by `cargo-contract` for optimizing Wasm files.
+    # We fetch the latest release which contains a Linux binary.
+    curl -L $(curl --silent https://api.github.com/repos/WebAssembly/binaryen/releases \
+    | jq -r '.[0].assets | [.[] | .browser_download_url] | map(select(match("x86_64-linux\\.tar\\.gz$"))) | .[0]' \
+    ) | tar -xz -C /usr/local/bin/ --wildcards --strip-components=2 'binaryen-*/bin/wasm-opt' && \
+
+    # Install LLVM for solang
+    curl -L https://github.com/hyperledger/solang-llvm/releases/download/llvm15-1/llvm15.0-linux-x86-64.tar.xz > llvm15.0-linux-x86-64.tar.xz && \
+    tar Jxf llvm15.0-linux-x86-64.tar.xz && \
+    export PATH=$(pwd)/llvm15.0/bin:$PATH && \
+
+    # The stable toolchain is used to build ink! itself through the use of the
+    # `RUSTC_BOOSTRAP=1` environment variable. We also need to install the
+    # `wasm32-unknown-unknown` target since that's the platform that ink! smart contracts
+    # run on.
+
+    # The 1.69 toolchain is temporarily required to build ink! contracts because of
+    # https://github.com/paritytech/cargo-contract/issues/1139 \
+    rustup toolchain install 1.69 && \
+    rustup target add wasm32-unknown-unknown --toolchain 1.69 && \
+    rustup component add rust-src clippy rustfmt --toolchain 1.69 && \
+    rustup default 1.69 && \
+
+    # `cargo-dylint` and `dylint-link` are dependencies needed to run `cargo-contract`.
+    cargo install cargo-dylint dylint-link && \
+
+    # Install the latest stable release of `cargo-contract`
+    cargo install cargo-contract && \
+
+    # Install the latest `solang`
+    cargo install solang && \
+
+    # Versions
+    rustup show && \
+    cargo --version && \
+    cargo-contract --version && \
+    wasm-opt --version && \
+
+    # Clean up and remove compilation artifacts that a cargo install creates (>250M).
+    rm -rf "${CARGO_HOME}/registry" "${CARGO_HOME}/git" /root/.cache/sccache && \
+
+    # apt clean up
+    apt-get remove -y gnupg && \
+    apt-get autoremove -y && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+# A contract workdir which should be bind mounted to the container. See README for detailed documentation.
+WORKDIR /contract
+
+# A default entry point for manual execution
+ENTRYPOINT [ "cargo", "contract", "build", "--release" ]

build-image/README.md

@@ -0,0 +1,58 @@
+# Verifiable build using Docker
+
+Docker image based on our base CI image `<base-ci-linux:latest>`.
+
+Used for reproducible builds in `cargo contract --verifiable`
+
+## Dependencies and Tools
+
+- `llvm-dev`
+- `zlib1g-dev`
+- `npm`
+- `yarn`
+- `wabt`
+- `binaryen`
+
+**Inherited from `<base-ci-linux:latest>`**
+
+- `libssl-dev`
+- `clang-10`
+- `lld`
+- `libclang-dev`
+- `make`
+- `cmake`
+- `git`
+- `pkg-config`
+- `curl`
+- `time`
+- `rhash`
+- `ca-certificates`
+- `jq`
+
+**Rust versions:**
+
+Currently, the 1.69 toolchain is temporarily required to build ink! contracts because of https://github.com/paritytech/cargo-contract/issues/1139
+
+**Rust tools & toolchains:**
+
+We use stable releases from crates.io
+
+- `cargo-contract`
+- `cargo-dylint` and `dylint-link`
+- `pwasm-utils-cli`
+- `solang`
+- `wasm32-unknown-unknown`: The toolchain to compile Rust codebases for Wasm.
+
+[Click here](https://hub.docker.com/repository/docker/paritytech/contracts-ci-linux) for the registry.
+
+## Usage
+
+The default entry point is `ENTRYPOINT [ "cargo", "contract", "build", "--release" ]`
+and work directory is set to `/contract`. You need to mount the folder with the contract to the container.
+
+```bash
+docker run -d \
+    --name ink-container \
+    --mount type=bind,source="$(pwd)",target="/contract" \
+    paritytech/contracts-verified
+```

build-image/build.sh

@@ -0,0 +1,4 @@
+docker run -d \
+    --name ink-container \
+    --mount type=bind,source="$(pwd)",target="/contract" \
+    parity/ver-build

crates/build/Cargo.toml

@@ -38,6 +38,9 @@ wasm-opt = "0.112.0"
 which = "4.4.0"
 zip = { version = "0.6.6", default-features = false }
 strum = { version = "0.24", features = ["derive"] }
+tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
+tokio-stream = "0.1"
+bollard = "0.14"
 
 contract-metadata = { version = "3.0.1", path = "../metadata" }
 

crates/build/src/args.rs

@@ -45,7 +45,7 @@ impl TryFrom<&VerbosityFlags> for Verbosity {
 }
 
 /// Denotes if output should be printed to stdout.
-#[derive(Clone, Copy, Default, serde::Serialize, Eq, PartialEq)]
+#[derive(Clone, Copy, Default, serde::Serialize, serde::Deserialize, Eq, PartialEq)]
 pub enum Verbosity {
     /// Use default output
     #[default]
@@ -89,7 +89,15 @@ impl Network {
 
 /// Describes which artifacts to generate
 #[derive(
-    Copy, Clone, Default, Eq, PartialEq, Debug, clap::ValueEnum, serde::Serialize,
+    Copy,
+    Clone,
+    Default,
+    Eq,
+    PartialEq,
+    Debug,
+    clap::ValueEnum,
+    serde::Serialize,
+    serde::Deserialize,
 )]
 #[clap(name = "build-artifacts")]
 pub enum BuildArtifacts {