Reproducible risc0 guest code builds (#841)

* Try build guest in docker

* Add env var GUEST_BUILD_NO_DOCKER to build risc0 guest code natively

* Use citrea_risc0::BITCOIN_DA_ID instead of hardcoded digest

* Fix fmt

* Fix risc0 bitcoin da feature=bench

* Fix unsafe block for bench risc0 bitcoin da

* Move citrea deps to citrea section

* Remove unsafe from report_bench_metrics

* Try fix coverage

* Don't build guest code in docker in coverage CI

.github/workflows/checks.yml

@@ -187,6 +187,7 @@ jobs:
         run: make coverage
         env:
           RUST_BACKTRACE: 1
+          GUEST_BUILD_NO_DOCKER: 1
       - name: Upload coverage
         uses: codecov/codecov-action@v4
         with:

bin/citrea/Cargo.toml

@@ -17,13 +17,14 @@ bitcoin-da = { path = "../../crates/bitcoin-da", features = ["native"] }
 citrea-fullnode = { path = "../../crates/fullnode" }
 citrea-primitives = { path = "../../crates/primitives" }
 citrea-prover = { path = "../../crates/prover" }
+citrea-risc0 = { package = "risc0", path = "./provers/risc0" }
+citrea-risc0-bonsai-adapter = { path = "../../crates/sovereign-sdk/adapters/risc0-bonsai", features = ["native"] }
 citrea-sequencer = { path = "../../crates/sequencer" }
 citrea-stf = { path = "../../crates/citrea-stf", features = ["native"] }
 ethereum-rpc = { path = "../../crates/ethereum-rpc" }
 sequencer-client = { path = "../../crates/sequencer-client" }
 
 # Sovereign-SDK deps
-citrea-risc0-bonsai-adapter = { path = "../../crates/sovereign-sdk/adapters/risc0-bonsai", features = ["native"] }
 soft-confirmation-rule-enforcer = { path = "../../crates/soft-confirmation-rule-enforcer" }
 sov-db = { path = "../../crates/sovereign-sdk/full-node/db/sov-db" }
 sov-ledger-rpc = { path = "../../crates/sovereign-sdk/full-node/sov-ledger-rpc", features = ["server"] }
@@ -49,7 +50,6 @@ log-panics = { workspace = true }
 reth-primitives = { workspace = true }
 reth-rpc-types = { workspace = true }
 reth-transaction-pool = { workspace = true }
-risc0 = { path = "./provers/risc0" }
 secp256k1 = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }

bin/citrea/provers/risc0/build.rs

@@ -1,7 +1,10 @@
 use std::collections::HashMap;
 
+use risc0_build::{embed_methods_with_options, DockerOptions, GuestOptions};
+
 fn main() {
     println!("cargo:rerun-if-env-changed=SKIP_GUEST_BUILD");
+    println!("cargo:rerun-if-env-changed=GUEST_BUILD_NO_DOCKER");
     println!("cargo:rerun-if-env-changed=OUT_DIR");
 
     if std::env::var("SKIP_GUEST_BUILD").is_ok() {
@@ -20,7 +23,7 @@ fn main() {
         std::fs::write(methods_path, elf).expect("Failed to write mock rollup elf");
     } else {
         let guest_pkg_to_options = get_guest_options();
-        risc0_build::embed_methods_with_options(guest_pkg_to_options);
+        embed_methods_with_options(guest_pkg_to_options);
     }
 }
 
@@ -31,11 +34,29 @@ fn get_guest_options() -> HashMap<&'static str, risc0_build::GuestOptions> {
     if cfg!(feature = "bench") {
         features.push("bench".to_string());
     }
+    let use_docker = if std::env::var("GUEST_BUILD_NO_DOCKER").is_ok() {
+        println!("Skipping guest build for CI run");
+        None
+    } else {
+        let this_package_dir = std::env!("CARGO_MANIFEST_DIR");
+        let root_dir = format!("{this_package_dir}/../../../../");
+        Some(DockerOptions {
+            root_dir: Some(root_dir.into()),
+        })
+    };
+
     guest_pkg_to_options.insert(
         "sov-demo-prover-guest-mock",
-        risc0_build::GuestOptions {
-            features,
-            ..Default::default()
+        GuestOptions {
+            features: features.clone(),
+            use_docker: use_docker.clone(),
+        },
+    );
+    guest_pkg_to_options.insert(
+        "citrea-bitcoin-prover",
+        GuestOptions {
+            features: features.clone(),
+            use_docker: use_docker.clone(),
         },
     );
     guest_pkg_to_options

bin/citrea/provers/risc0/guest-bitcoin/src/bin/bitcoin_da.rs

@@ -14,8 +14,8 @@ use sov_rollup_interface::da::DaVerifier;
 use sov_state::ZkStorage;
 
 #[cfg(feature = "bench")]
-fn report_bench_metrics(start_cycles: usize, end_cycles: usize) {
-    let cycles_per_block = (end_cycles - start_cycles) as u64;
+fn report_bench_metrics(start_cycles: u64, end_cycles: u64) {
+    let cycles_per_block = end_cycles - start_cycles;
     let tuple = ("Cycles per block".to_string(), cycles_per_block);
     let mut serialized = Vec::new();
     serialized.extend(tuple.0.as_bytes());
@@ -24,9 +24,8 @@ fn report_bench_metrics(start_cycles: usize, end_cycles: usize) {
     serialized.extend(&size_bytes);
 
     // calculate the syscall name.
-    let cycle_string = String::from("cycle_metrics\0");
-    let metrics_syscall_name =
-        risc0_zkvm_platform::syscall::SyscallName::from_bytes_with_nul(cycle_string.as_ptr());
+    let name = c"cycle_metrics";
+    let metrics_syscall_name = risc0_zkvm_platform::syscall::SyscallName::from_c_str(name).unwrap();
 
     risc0_zkvm::guest::env::send_recv_slice::<u8, u8>(metrics_syscall_name, &serialized);
 }

bin/citrea/provers/risc0/guest-mock/src/bin/mock_da.rs

@@ -20,9 +20,8 @@ fn report_bench_metrics(start_cycles: u64, end_cycles: u64) {
     serialized.extend(&size_bytes);
 
     // calculate the syscall name.
-    let name = c"cycle_metrics".as_ptr();
-    let metrics_syscall_name =
-        unsafe { risc0_zkvm_platform::syscall::SyscallName::from_bytes_with_nul(name as _) };
+    let name = c"cycle_metrics";
+    let metrics_syscall_name = risc0_zkvm_platform::syscall::SyscallName::from_c_str(name).unwrap();
 
     risc0_zkvm::guest::env::send_recv_slice::<u8, u8>(metrics_syscall_name, &serialized);
 }

bin/citrea/src/rollup/bitcoin.rs

@@ -83,10 +83,7 @@ impl RollupBlueprint for BitcoinRollup {
 
     #[instrument(level = "trace", skip(self), ret)]
     fn get_code_commitment(&self) -> <Self::Vm as Zkvm>::CodeCommitment {
-        Digest::from([
-            581052143, 2275184185, 1715279787, 1149073804, 1128615771, 1332991789, 268524604,
-            982556413,
-        ])
+        Digest::new(citrea_risc0::BITCOIN_DA_ID)
     }
 
     #[instrument(level = "trace", skip_all, err)]
@@ -123,7 +120,7 @@ impl RollupBlueprint for BitcoinRollup {
         _da_service: &Self::DaService,
     ) -> Self::ProverService {
         let vm = Risc0BonsaiHost::new(
-            risc0::BITCOIN_DA_ELF,
+            citrea_risc0::BITCOIN_DA_ELF,
             std::env::var("BONSAI_API_URL").unwrap_or("".to_string()),
             std::env::var("BONSAI_API_KEY").unwrap_or("".to_string()),
         );

bin/citrea/src/rollup/mock.rs

@@ -76,7 +76,7 @@ impl RollupBlueprint for MockDemoRollup {
     }
 
     fn get_code_commitment(&self) -> <Self::Vm as Zkvm>::CodeCommitment {
-        Digest::new(risc0::MOCK_DA_ID)
+        Digest::new(citrea_risc0::MOCK_DA_ID)
     }
 
     async fn create_da_service(
@@ -93,7 +93,7 @@ impl RollupBlueprint for MockDemoRollup {
         _da_service: &Self::DaService,
     ) -> Self::ProverService {
         let vm = Risc0BonsaiHost::new(
-            risc0::MOCK_DA_ELF,
+            citrea_risc0::MOCK_DA_ELF,
             std::env::var("BONSAI_API_URL").unwrap_or("".to_string()),
             std::env::var("BONSAI_API_KEY").unwrap_or("".to_string()),
         );