Skip to content

Commit bb344b0

Browse files
XuJiandongXuJiandong
committed
chore: mainnet deloyment information
1 parent f59b6e9 commit bb344b0

File tree

8 files changed

+463
-0
lines changed

8 files changed

+463
-0
lines changed

‎deployment/mainnet/README.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
This document is a guide for reviewers to inspect deployment information.
2+
The main function is to ensure the deployment is correct.
3+
4+
## Requirements
5+
Install and configure necessary software.
6+
7+
* Compile or download ckb-cli
8+
https://github.com/nervosnetwork/ckb-cli Use version: 1.15.0 or above
9+
10+
* Configure ckb-cli
11+
Before signing, please configure ckb-cli to use the correct mainnet. You can use the following commands:
12+
```
13+
$ ckb-cli
14+
CKB > config --url https://mainnet.ckb.dev
15+
info[ ckb-cli version ]: 1.15.0 (8c892a5 2025-06-06)
16+
[ url ]: https://mainnet.ckb.dev (network: Mainnet, #17314192
17+
```
18+
This step is very important, otherwise subsequent signing will fail. This setting takes effect immediately, no need to sync blocks or wait.
19+
20+
* Install [jq](https://jqlang.org/)
21+
22+
23+
## How to upgrade
24+
It is locked by 3-of-5 multisig with following people:
25+
26+
| # | Email | CKB Address |
27+
|---|-------|-------------|
28+
| 1 | xxuejie@gmail.com | ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsqw8jqfpfe9lwsvs74j3a27aalhqshrslps8hlplq |
29+
| 2 | quake.wang@gmail.com | ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsq2u7q5rqr3nam68g2wfel9365l855m7fcg58j52a |
30+
| 3 | hanssen0@hanssen0.com | ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsq2hvk2yvt998w799ra8t73gunvrjrlw4agv2t7np |
31+
| 4 | rink1969@gmail.com | ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsqt4q36wdxa34k89g5snyw694jy0nxht8yshfyw55 |
32+
| 5 | copperheart05@gmail.com | ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsq0jyvhms76lphfm56dmd2s06k9yxwkxy4gqzah69 |
33+
34+
35+
## Process
36+
37+
Reviewers should inspect `info.json` to ensure it contains the correct configuration. There are 3 key aspects to verify:
38+
39+
1. The cell data contains the correct binary generated by a reproducible build.
40+
2. The corresponding lock script uses multisig with the correct arguments. This is the most critical aspect.
41+
- check address of reviewer is correct
42+
- check configuration of multisig is correct (e.g. m-of-n)
43+
- check code_hash and hash_type is correct
44+
45+
3. The corresponding type script uses Type ID.
46+
47+
To simplify these verification steps, a [bash script](./verify.sh) is provided. Reviewers can follow the steps described in the script to verify the configuration above.
48+

‎deployment/mainnet/deployment.toml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
[[cells]]
2+
name = "quantum-resistant-lock-script"
3+
enable_type_id = true
4+
location = { file = "../../build/release/c-sphincs-all-in-one-lock" }
5+
6+
7+
# This is the lock script in output. Check it very carefully.
8+
# 1. xxuejie@gmail.com ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsqw8jqfpfe9lwsvs74j3a27aalhqshrslps8hlplq
9+
# 2. quake.wang@gmail.com ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsq2u7q5rqr3nam68g2wfel9365l855m7fcg58j52a
10+
# 3. hanssen0@hanssen0.com ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsq2hvk2yvt998w799ra8t73gunvrjrlw4agv2t7np
11+
# 4. rink1969@gmail.com ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsqt4q36wdxa34k89g5snyw694jy0nxht8yshfyw55
12+
# 5. copperheart05@gmail.com ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsq0jyvhms76lphfm56dmd2s06k9yxwkxy4gqzah69
13+
14+
[lock]
15+
code_hash = "0x5c5069eb0857efc65e1bca0c07df34c31663b3622fd3876c876320fc9634e2a8"
16+
args = "0xb9f04d55adb7b0fa0b56a752c72f201003115907"
17+
hash_type = "type"

‎deployment/mainnet/info.json‎

Lines changed: 290 additions & 0 deletions
Large diffs are not rendered by default.

‎deployment/mainnet/migrations/.gitkeep‎

Whitespace-only changes.

‎deployment/mainnet/step-1-gen-tx.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
ckb-cli deploy gen-txs \
3+
--deployment-config ./deployment.toml \
4+
--migration-dir ./migrations \
5+
--fee-rate 2000 \
6+
--from-address ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsqw9zyl653xlmzkkwmkguk0sqxkalkyat8suxxefv \
7+
--info-file info.json

‎deployment/mainnet/step-2-sign.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
3+
ckb-cli deploy sign-txs \
4+
--from-account ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsqw9zyl653xlmzkkwmkguk0sqxkalkyat8suxxefv \
5+
--add-signatures \
6+
--info-file info.json

‎deployment/mainnet/step-3-apply.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/bash
2+
3+
ckb-cli deploy apply-txs --migration-dir ./migrations --info-file info.json

‎deployment/mainnet/verify.sh‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
#!/bin/bash
2+
3+
4+
## step 1: verify binary
5+
function verify_binary() {
6+
get_expected_hash() {
7+
grep "build/release/c-sphincs-all-in-one-lock$" ../../checksums.txt | awk '{print $1}'
8+
}
9+
10+
expected_hash=$(get_expected_hash)
11+
12+
actual_hash=$(jq -r '.cell_tx.outputs_data[0]' info.json | xxd -r -p | shasum -a 256 | awk '{print $1}')
13+
14+
if [ "$expected_hash" != "$actual_hash" ]; then
15+
echo "✗ Binary verification failed!"
16+
exit 1
17+
fi
18+
echo "✓ Binary verification passed!"
19+
}
20+
21+
verify_binary
22+
23+
24+
## step 2: verify lock script
25+
26+
function verify_lock_script() {
27+
code_hash=$(jq -r '.cell_tx.outputs[0].lock.code_hash' info.json)
28+
hash_type=$(jq -r '.cell_tx.outputs[0].lock.hash_type' info.json)
29+
args=$(jq -r '.cell_tx.outputs[0].lock.args' info.json)
30+
31+
# https://github.com/nervosnetwork/rfcs/blob/master/rfcs/0024-ckb-genesis-script-list/0024-ckb-genesis-script-list.md#secp256k1multisig
32+
expected_code_hash="0x5c5069eb0857efc65e1bca0c07df34c31663b3622fd3876c876320fc9634e2a8"
33+
expected_hash_type="type"
34+
35+
if [ "$code_hash" != "$expected_code_hash" ]; then
36+
echo "✗ code_hash verification failed!"
37+
exit 1
38+
fi
39+
40+
if [ "$hash_type" != "$expected_hash_type" ]; then
41+
echo "✗ hash_type verification failed!"
42+
exit 1
43+
fi
44+
echo "✓ Lock script verification passed!"
45+
46+
multisig_output=$(ckb-cli tx build-multisig-address \
47+
--sighash-address ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsqw8jqfpfe9lwsvs74j3a27aalhqshrslps8hlplq \
48+
--sighash-address ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsq2u7q5rqr3nam68g2wfel9365l855m7fcg58j52a \
49+
--sighash-address ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsq2hvk2yvt998w799ra8t73gunvrjrlw4agv2t7np \
50+
--sighash-address ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsqt4q36wdxa34k89g5snyw694jy0nxht8yshfyw55 \
51+
--sighash-address ckb1qzda0cr08m85hc8jlnfp3zer7xulejywt49kt2rr0vthywaa50xwsq0jyvhms76lphfm56dmd2s06k9yxwkxy4gqzah69 \
52+
--threshold 3 \
53+
--require-first-n 0 \
54+
--multisig-code-hash legacy)
55+
56+
expected_args=$(echo "$multisig_output" | grep "lock-arg:" | awk '{print $2}')
57+
58+
if [ "$args" != "$expected_args" ]; then
59+
echo "✗ Lock args verification failed!"
60+
echo " Expected: $expected_args"
61+
echo " Actual: $args"
62+
exit 1
63+
fi
64+
echo "✓ Lock args verification passed!"
65+
}
66+
67+
verify_lock_script
68+
69+
## step 3: verify type script
70+
function verify_type_script() {
71+
code_hash=$(jq -r '.cell_tx.outputs[0].type.code_hash' info.json)
72+
hash_type=$(jq -r '.cell_tx.outputs[0].type.hash_type' info.json)
73+
args=$(jq -r '.cell_tx.outputs[0].type.args' info.json)
74+
75+
# https://github.com/nervosnetwork/rfcs/blob/4b502ffcb02fc7019e0dd4b5f866b5f09819cfbe/rfcs/0024-ckb-genesis-script-list/0024-ckb-genesis-script-list.md#type-id
76+
expected_code_hash="0x00000000000000000000000000000000000000000000000000545950455f4944"
77+
expected_hash_type="type"
78+
79+
if [ "$code_hash" != "$expected_code_hash" ]; then
80+
echo "✗ type script code_hash verification failed!"
81+
exit 1
82+
fi
83+
84+
if [ "$hash_type" != "$expected_hash_type" ]; then
85+
echo "✗ type script hash_type verification failed!"
86+
exit 1
87+
fi
88+
89+
echo "✓ Type script verification passed!"
90+
}
91+
92+
verify_type_script

0 commit comments

Comments
 (0)